import com.objsys.asn1j.runtime.Asn1ObjectIdentifier;

import ru.CryptoPro.JCP.ASN.CertificateExtensions.PrivateKeyUsagePeriod;
import ru.CryptoPro.JCP.ASN.Gost_CryptoPro_PrivateKey._Gost_CryptoPro_PrivateKeyValues;
import ru.CryptoPro.JCP.ASN.PKIX1Explicit88.Extension;
import ru.CryptoPro.JCP.JCP;
import ru.CryptoPro.JCP.Key.InternalGostPrivateKey;
import ru.CryptoPro.JCP.Key.KeyInterface;
import ru.CryptoPro.JCP.Key.PrivateKeyInterface;
import ru.CryptoPro.JCP.Key.SpecKey;
import ru.CryptoPro.JCP.KeyStore.JCPPrivateKeyEntry;
import ru.CryptoPro.JCP.params.JCPProtectionParameter;
import ru.CryptoPro.JCP.tools.JCPLogger;
import ru.CryptoPro.JCP.tools.PKUPDecoder;

import java.security.KeyFactory;
import java.security.KeyStore;
import java.security.PrivateKey;
import java.security.cert.X509Certificate;
import java.util.Calendar;

public class KeyProp {

    private static final int SPEC_SIGNATURE = 2;
    private static final int SPEC_KEY_EXCHANGE = 1;

    static class KeyInfo {

        int keyLength;
        boolean isExportable;
        boolean isRSA;

        Calendar notBefore;
        Calendar notAfter;
        boolean match;

    }

    private static KeyInfo getKeyInfo(PrivateKey privateKey,
        boolean isExchange, X509Certificate cert) throws Exception {

        KeyInfo keyInfo = new KeyInfo();
        String keyAlgorithm = privateKey.getAlgorithm();

        // Размер ключа ГОСТ.

        if (keyAlgorithm.equalsIgnoreCase(JCP.GOST_EL_2012_512_NAME) ||
            keyAlgorithm.equalsIgnoreCase(JCP.GOST_DH_2012_512_NAME)) {
            keyInfo.keyLength = 512;
        }

        if (keyAlgorithm.equalsIgnoreCase(JCP.GOST_EL_2012_256_NAME) ||
            keyAlgorithm.equalsIgnoreCase(JCP.GOST_DH_2012_256_NAME) ||
            keyAlgorithm.equalsIgnoreCase(JCP.GOST_EL_DEGREE_NAME) ||
            keyAlgorithm.equalsIgnoreCase(JCP.GOST_EL_DH_NAME)) {
            keyInfo.keyLength = 256;
        }

        // Разные свойства.

        KeyFactory kf = KeyFactory.getInstance(keyAlgorithm, JCP.PROVIDER_NAME); // алгоритм ключа важен
        PrivateKeyInterface pki = kf.getKeySpec(privateKey, PrivateKeyInterface.class);

        if (pki instanceof PrivateKeyInterface) {

            // Экспортируемость.

            keyInfo.isExportable = pki.isExportable();

            // Срок действия.

            final Extension keyUsagePeriodExtension = isExchange
                ? pki.getExtension(new Asn1ObjectIdentifier(_Gost_CryptoPro_PrivateKeyValues.id_CryptoPro_private_keys_extension_exchange_key_usage_period))
                : pki.getExtension(new Asn1ObjectIdentifier(_Gost_CryptoPro_PrivateKeyValues.id_CryptoPro_private_keys_extension_signature_key_usage_period));

            if (keyUsagePeriodExtension != null) {

                PrivateKeyUsagePeriod keyUsagePeriod = new PrivateKeyUsagePeriod();
                if (PKUPDecoder.decodeExtension(keyUsagePeriodExtension, keyUsagePeriod)) {

                    if (keyUsagePeriod.notBefore != null) {
                        try {
                            keyInfo.notBefore = keyUsagePeriod.notBefore.getTime();
                        } catch (Exception e) {}
                    } // if

                    if (keyUsagePeriod.notAfter != null) {
                        try {
                            keyInfo.notAfter = keyUsagePeriod.notAfter.getTime();
                        } catch (Exception e) {}
                    } // if

                }

            }

            // Проверка на соответствие.

            if (cert != null) {
                keyInfo.match = pki.match(cert.getPublicKey());
            }

        }

        // В случае ключа RSA - надо смотреть длину иначе.

        if (keyAlgorithm.equalsIgnoreCase(JCP.RSA_NAME)) {
            if (privateKey instanceof SpecKey) {

                SpecKey specKey = (SpecKey) privateKey;
                keyInfo.isRSA = true;
                keyInfo.keyLength = specKey.getKeySize();

            }
        }

        return keyInfo;

    }

    private static void getKeyInfo(KeyStore keyStore, String alias,
        char[] password, int keySpec) throws Exception {

        JCPProtectionParameter parameter = new JCPProtectionParameter(
            password, true, true, keySpec);

        try {

            JCPPrivateKeyEntry entry = (JCPPrivateKeyEntry)
                keyStore.getEntry(alias, parameter);

            PrivateKey privateKey = entry.getPrivateKey();
            X509Certificate cert  = (X509Certificate) entry.getCertificate();

            switch (keySpec) {
                case SPEC_SIGNATURE: System.out.println("** Signature key exists."); break;
                case SPEC_KEY_EXCHANGE: System.out.println("** Exchange key exists."); break;
            }

            KeyInfo keyInfo = getKeyInfo(privateKey, keySpec == 1, cert);

            System.out.println("\tKey algorithm: " + privateKey.getAlgorithm());
            System.out.println("\tKey length: " + keyInfo.keyLength);
            System.out.println("\tKey is exportable: " + keyInfo.isExportable);
            System.out.println("\tKey is RSA: " + keyInfo.isRSA);

            if (keyInfo.notBefore != null) {
                System.out.println("\tUse key not before: " +
                    keyInfo.notBefore.getTime());
            }

            if (keyInfo.notAfter != null) {
                System.out.println("\tUse key not after: " +
                    keyInfo.notAfter.getTime());
            }

            if (cert != null) {
                System.out.println("\tCertificate exists. Subject: "
                    + cert.getSubjectDN() + ". It matches the key: "
                        + keyInfo.match);
            }

        } catch (Exception e) {

            switch (keySpec) {
                case SPEC_SIGNATURE: System.out.println("** Signature key does not exist."); break;
                case SPEC_KEY_EXCHANGE: System.out.println("** Exchange key does not exist."); break;
            }

        }

    }

    public static void main(String[] args) throws Exception {

        KeyStore keyStore = KeyStore.getInstance(JCP.HD_STORE_NAME, JCP.PROVIDER_NAME);
        keyStore.load(null, null);

        getKeyInfo(keyStore, "sig_key", "sig_key_password".toCharArray(), SPEC_SIGNATURE); // контейнер с ключом подписи
        getKeyInfo(keyStore, "exc_key", "exc_key_password".toCharArray(), SPEC_KEY_EXCHANGE); // контейнер с ключом подписи и обмена

    }

}