From 40bce84a471ff47902d81bcf8a2034ae031d2be5 Mon Sep 17 00:00:00 2001 From: nagendra0721 Date: Tue, 9 Jun 2026 19:09:43 +0530 Subject: [PATCH 1/8] removing logs which exposes critical details Signed-off-by: nagendra0721 --- .../service/impl/KeymanagerServiceImpl.java | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/keymanagerservice/service/impl/KeymanagerServiceImpl.java b/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/keymanagerservice/service/impl/KeymanagerServiceImpl.java index 3ef29330..ab9483b3 100644 --- a/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/keymanagerservice/service/impl/KeymanagerServiceImpl.java +++ b/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/keymanagerservice/service/impl/KeymanagerServiceImpl.java @@ -945,23 +945,13 @@ private Object[] getKeyDetails(Optional Date: Wed, 10 Jun 2026 18:42:40 +0530 Subject: [PATCH 2/8] modified the log and remove master key details from log Signed-off-by: nagendra0721 --- .../service/impl/KeymanagerServiceImpl.java | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/keymanagerservice/service/impl/KeymanagerServiceImpl.java b/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/keymanagerservice/service/impl/KeymanagerServiceImpl.java index ab9483b3..3ef6842c 100644 --- a/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/keymanagerservice/service/impl/KeymanagerServiceImpl.java +++ b/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/keymanagerservice/service/impl/KeymanagerServiceImpl.java @@ -945,14 +945,24 @@ private Object[] getKeyDetails(Optional Date: Wed, 10 Jun 2026 18:51:04 +0530 Subject: [PATCH 3/8] remove db keystore details printing in logs Signed-off-by: nagendra0721 --- .../keymanagerservice/service/impl/KeymanagerServiceImpl.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/keymanagerservice/service/impl/KeymanagerServiceImpl.java b/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/keymanagerservice/service/impl/KeymanagerServiceImpl.java index 3ef6842c..5568d9fe 100644 --- a/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/keymanagerservice/service/impl/KeymanagerServiceImpl.java +++ b/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/keymanagerservice/service/impl/KeymanagerServiceImpl.java @@ -953,7 +953,7 @@ private Object[] getKeyDetails(Optional Date: Wed, 10 Jun 2026 19:01:07 +0530 Subject: [PATCH 4/8] remove db keystore details printing in logs Signed-off-by: nagendra0721 --- .../keymanagerservice/service/impl/KeymanagerServiceImpl.java | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/keymanagerservice/service/impl/KeymanagerServiceImpl.java b/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/keymanagerservice/service/impl/KeymanagerServiceImpl.java index 5568d9fe..155b4e2e 100644 --- a/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/keymanagerservice/service/impl/KeymanagerServiceImpl.java +++ b/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/keymanagerservice/service/impl/KeymanagerServiceImpl.java @@ -306,7 +306,7 @@ private CertificateInfo getCertificateFromDBStore(String applic Optional keyFromDBStore = dbHelper .getKeyStoreFromDB(currentKeyAlias.get(0).getAlias()); if (!keyFromDBStore.isPresent()) { - LOGGER.info(KeymanagerConstant.SESSIONID, KeymanagerConstant.KEYFROMDB, keyFromDBStore.toString(), + LOGGER.info(KeymanagerConstant.SESSIONID, KeymanagerConstant.KEYFROMDB, KeymanagerConstant.EMPTY, "Key in DBStore does not exist for this alias. Throwing exception"); throw new NoUniqueAliasException(KeymanagerErrorConstant.NO_UNIQUE_ALIAS.getErrorCode(), KeymanagerErrorConstant.NO_UNIQUE_ALIAS.getErrorMessage()); @@ -934,7 +934,7 @@ private KeyAlias getKeyAlias(String appId, String refId){ private Object[] getKeyDetails(Optional keyFromDBStore, String keyAlias) { if (!keyFromDBStore.isPresent()) { - LOGGER.info(KeymanagerConstant.SESSIONID, KeymanagerConstant.KEYFROMDB, keyFromDBStore.toString(), + LOGGER.info(KeymanagerConstant.SESSIONID, KeymanagerConstant.KEYFROMDB, KeymanagerConstant.KEYALIAS, "Key in DBStore does not exist for this alias. So fetching the certificate from HSM."); PrivateKeyEntry signKeyEntry = keyStore.getAsymmetricKey(keyAlias); PrivateKey signPrivateKey = signKeyEntry.getPrivateKey(); From 38043f57eb1e8081ebf3676833d2bd67dc5fac0e Mon Sep 17 00:00:00 2001 From: nagendra0721 Date: Wed, 10 Jun 2026 19:05:17 +0530 Subject: [PATCH 5/8] remove keylength from log Signed-off-by: nagendra0721 --- .../keymanagerservice/service/impl/KeymanagerServiceImpl.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/keymanagerservice/service/impl/KeymanagerServiceImpl.java b/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/keymanagerservice/service/impl/KeymanagerServiceImpl.java index 155b4e2e..b317c366 100644 --- a/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/keymanagerservice/service/impl/KeymanagerServiceImpl.java +++ b/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/keymanagerservice/service/impl/KeymanagerServiceImpl.java @@ -954,7 +954,7 @@ private Object[] getKeyDetails(Optional Date: Wed, 10 Jun 2026 19:15:15 +0530 Subject: [PATCH 6/8] remove db keystore details printing in logs Signed-off-by: nagendra0721 --- ...eyDecrytorHelper.java => SessionKeyDecryptorHelper.java} | 6 +++--- .../service/impl/KeymanagerServiceImpl.java | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) rename kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/keymanagerservice/helper/{SessionKeyDecrytorHelper.java => SessionKeyDecryptorHelper.java} (99%) diff --git a/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/keymanagerservice/helper/SessionKeyDecrytorHelper.java b/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/keymanagerservice/helper/SessionKeyDecryptorHelper.java similarity index 99% rename from kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/keymanagerservice/helper/SessionKeyDecrytorHelper.java rename to kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/keymanagerservice/helper/SessionKeyDecryptorHelper.java index cc58254e..cbcbbe88 100644 --- a/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/keymanagerservice/helper/SessionKeyDecrytorHelper.java +++ b/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/keymanagerservice/helper/SessionKeyDecryptorHelper.java @@ -52,9 +52,9 @@ * */ @Component -public class SessionKeyDecrytorHelper { +public class SessionKeyDecryptorHelper { - private static final Logger LOGGER = KeymanagerLogger.getLogger(SessionKeyDecrytorHelper.class); + private static final Logger LOGGER = KeymanagerLogger.getLogger(SessionKeyDecryptorHelper.class); /** * {@link CryptoCoreSpec} instance for cryptographic functionalities. @@ -352,7 +352,7 @@ private Object[] getPrivateKey(String referenceId, KeyAlias fetchedKeyAlias) { String ksAlias = fetchedKeyAlias.getAlias(); Optional dbKeyStore = dbHelper.getKeyStoreFromDB(ksAlias); if (!dbKeyStore.isPresent()) { - LOGGER.error(KeymanagerConstant.SESSIONID, KeymanagerConstant.KEYFROMDB, dbKeyStore.toString(), + LOGGER.error(KeymanagerConstant.SESSIONID, KeymanagerConstant.KEYFROMDB, KeymanagerConstant.EMPTY, "Key in DBStore does not exist for this alias. Throwing exception"); throw new NoUniqueAliasException(KeymanagerErrorConstant.NO_UNIQUE_ALIAS.getErrorCode(), KeymanagerErrorConstant.NO_UNIQUE_ALIAS.getErrorMessage()); diff --git a/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/keymanagerservice/service/impl/KeymanagerServiceImpl.java b/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/keymanagerservice/service/impl/KeymanagerServiceImpl.java index b317c366..db603daf 100644 --- a/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/keymanagerservice/service/impl/KeymanagerServiceImpl.java +++ b/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/keymanagerservice/service/impl/KeymanagerServiceImpl.java @@ -75,7 +75,7 @@ import io.mosip.kernel.keymanagerservice.exception.KeymanagerServiceException; import io.mosip.kernel.keymanagerservice.exception.NoUniqueAliasException; import io.mosip.kernel.keymanagerservice.helper.KeymanagerDBHelper; -import io.mosip.kernel.keymanagerservice.helper.SessionKeyDecrytorHelper; +import io.mosip.kernel.keymanagerservice.helper.SessionKeyDecryptorHelper; import io.mosip.kernel.keymanagerservice.logger.KeymanagerLogger; import io.mosip.kernel.keymanagerservice.service.KeymanagerService; import io.mosip.kernel.keymanagerservice.util.KeymanagerUtil; @@ -154,7 +154,7 @@ public class KeymanagerServiceImpl implements KeymanagerService { CryptomanagerUtils cryptomanagerUtil; @Autowired - SessionKeyDecrytorHelper keyDecryptorHelper; + SessionKeyDecryptorHelper keyDecryptorHelper; @Autowired private ECKeyPairGenRequestValidator ecKeyPairGenRequestValidator; From f28261018ffe1b1d91f830172ec8696f6c019822 Mon Sep 17 00:00:00 2001 From: nagendra0721 Date: Thu, 11 Jun 2026 17:53:03 +0530 Subject: [PATCH 7/8] #575: fix double hashing issue Signed-off-by: nagendra0721 --- .../kernel/tokenidgenerator/generator/TokenIDGenerator.java | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/tokenidgenerator/generator/TokenIDGenerator.java b/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/tokenidgenerator/generator/TokenIDGenerator.java index c73c84f5..e7c6c268 100644 --- a/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/tokenidgenerator/generator/TokenIDGenerator.java +++ b/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/tokenidgenerator/generator/TokenIDGenerator.java @@ -25,8 +25,8 @@ public class TokenIDGenerator { public String generateTokenID(String uin, String partnerCode) { try { - String uinHash = HMACUtils2.digestAsPlainText(HMACUtils2.generateHash((uin + uinSalt).getBytes())); - String hash = HMACUtils2.digestAsPlainText(HMACUtils2.generateHash((partnerCodeSalt + partnerCode + uinHash).getBytes())); + String uinHash = HMACUtils2.digestAsPlainText((uin + uinSalt).getBytes()); + String hash = HMACUtils2.digestAsPlainText((partnerCodeSalt + partnerCode + uinHash).getBytes()); return new BigInteger(hash.getBytes()).toString().substring(0, tokenIDLength); } catch (java.security.NoSuchAlgorithmException e) { LOGGER.error("Error generating token ID: No such algorithm found", e); From 755427f0d5814fb7868581bdbaf97477d7e75b30 Mon Sep 17 00:00:00 2001 From: nagendra0721 Date: Thu, 11 Jun 2026 18:05:24 +0530 Subject: [PATCH 8/8] #575: fix double hashing issue Signed-off-by: nagendra0721 --- .../kernel/tokenidgenerator/generator/TokenIDGenerator.java | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/tokenidgenerator/generator/TokenIDGenerator.java b/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/tokenidgenerator/generator/TokenIDGenerator.java index e7c6c268..8ee7f849 100644 --- a/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/tokenidgenerator/generator/TokenIDGenerator.java +++ b/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/tokenidgenerator/generator/TokenIDGenerator.java @@ -1,6 +1,7 @@ package io.mosip.kernel.tokenidgenerator.generator; import java.math.BigInteger; +import java.nio.charset.StandardCharsets; import io.mosip.kernel.core.logger.spi.Logger; import io.mosip.kernel.core.util.HMACUtils2; @@ -25,8 +26,8 @@ public class TokenIDGenerator { public String generateTokenID(String uin, String partnerCode) { try { - String uinHash = HMACUtils2.digestAsPlainText((uin + uinSalt).getBytes()); - String hash = HMACUtils2.digestAsPlainText((partnerCodeSalt + partnerCode + uinHash).getBytes()); + String uinHash = HMACUtils2.digestAsPlainText((uin + uinSalt).getBytes(StandardCharsets.UTF_8)); + String hash = HMACUtils2.digestAsPlainText((partnerCodeSalt + partnerCode + uinHash).getBytes(StandardCharsets.UTF_8)); return new BigInteger(hash.getBytes()).toString().substring(0, tokenIDLength); } catch (java.security.NoSuchAlgorithmException e) { LOGGER.error("Error generating token ID: No such algorithm found", e);