/*
    * Licensed to the Apache Software Foundation (ASF) under one
    * or more contributor license agreements.  See the NOTICE file
    * distributed with this work for additional information
    * regarding copyright ownership.  The ASF licenses this file
    * to you under the Apache License, Version 2.0 (the
    * "License"); you may not use this file except in compliance
    * with the License.  You may obtain a copy of the License at
    *
   *   http://www.apache.org/licenses/LICENSE-2.0
   *
   * Unless required by applicable law or agreed to in writing,
   * software distributed under the License is distributed on an
   * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
   * KIND, either express or implied.  See the License for the
   * specific language governing permissions and limitations
   * under the License.
   */
  package org.apache.myfaces.shared.util;
  
  import java.io.ByteArrayInputStream;
  import java.io.ByteArrayOutputStream;
  import java.io.IOException;
  import java.io.ObjectInputStream;
  import java.io.ObjectOutputStream;
  import java.io.UnsupportedEncodingException;
  import java.security.AccessController;
  import java.security.NoSuchAlgorithmException;
  import java.security.PrivilegedActionException;
  import java.security.PrivilegedExceptionAction;
  import java.util.Random;
  import java.util.logging.Level;
  import java.util.logging.Logger;
  import java.util.zip.GZIPInputStream;
  import java.util.zip.GZIPOutputStream;
  
  import javax.crypto.Cipher;
  import javax.crypto.KeyGenerator;
  import javax.crypto.Mac;
  import javax.crypto.SecretKey;
  import javax.crypto.spec.IvParameterSpec;
  import javax.crypto.spec.SecretKeySpec;
  import javax.faces.FacesException;
  import javax.faces.application.ViewExpiredException;
  import javax.faces.context.ExternalContext;
  import javax.servlet.ServletContext;
  
  import org.apache.commons.codec.binary.Base64;
  import org.apache.myfaces.buildtools.maven2.plugin.builder.annotation.JSFWebConfigParam;
  import org.apache.myfaces.shared.util.serial.SerialFactory;
  
  /**
   * <p>This Class exposes a handful of methods related to encryption,
   * compression and serialization of the view state.</p>
   * 
   * <ul>
   * <li>ISO-8859-1 is the character set used.</li>
   * <li>GZIP is used for all compression/decompression.</li>
   * <li>Base64 is used for all encoding and decoding.</li>
   * <li>DES is the default encryption algorithm</li>
   * <li>ECB is the default mode</li>
   * <li>PKCS5Padding is the default padding</li>
   * <li>HmacSHA1 is the default MAC algorithm</li>
   * <li>The default algorithm can be overridden using the
   * <i>org.apache.myfaces.ALGORITHM</i> parameter</li>
   * <li>The default mode and padding can be overridden using the
   * <i>org.apache.myfaces.ALGORITHM.PARAMETERS</i> parameter</li>
   * <li>This class has not been tested with modes other than ECB and CBC</li>
   * <li>An initialization vector can be specified via the
   * <i>org.apache.myfaces.ALGORITHM.IV</i> parameter</li>
   * <li>The default MAC algorithm can be overridden using the
   * <i>org.apache.myfaces.MAC_ALGORITHM</i> parameter</li>
   * </ul>
   *
   * <p>The secret is interpretted as base 64 encoded.  In other
   * words, if your secret is "76543210", you would put "NzY1NDMyMTA=" in
   * the deployment descriptor.  This is needed so that key values are not
   * limited to just values composed of printable characters.</p>
   *
   * <p>If you are using CBC mode encryption, you <b>must</b> specify an
   * initialization vector.</p>
   *
   * <p>If you are using the AES algorithm and getting a SecurityException
   * complaining about keysize, you most likely need to get the unlimited
   * strength jurisdiction policy files from a place like
   * http://java.sun.com/j2se/1.4.2/download.html .</p>
   *
   * @author Dennis C. Byrne
   * @see org.apache.myfaces.webapp.StartupServletContextListener
   */
  public final class StateUtils
  {
  
      //private static final Log log = LogFactory.getLog(StateUtils.class);
      private static final Logger log = Logger.getLogger(StateUtils.class.getName());
  
      public static final String ZIP_CHARSET = "ISO-8859-1";
  
      public static final String DEFAULT_ALGORITHM = "DES";
     public static final String DEFAULT_ALGORITHM_PARAMS = "ECB/PKCS5Padding";
 
     public static final String INIT_PREFIX = "org.apache.myfaces.";
     
     /**
      * Indicate if the view state is encrypted or not. By default, encryption is enabled.
      */
     @JSFWebConfigParam(name="org.apache.myfaces.USE_ENCRYPTION",since="1.1",
             defaultValue="true",expectedValues="true,false",group="state")
     public static final String USE_ENCRYPTION = INIT_PREFIX + "USE_ENCRYPTION";
     
     /**
      * Defines the secret (Base64 encoded) used to initialize the secret key
      * for encryption algorithm. See MyFaces wiki/web site documentation 
      * for instructions on how to configure an application for 
      * different encryption strengths.
      */
     @JSFWebConfigParam(name="org.apache.myfaces.SECRET",since="1.1",group="state")
     public static final String INIT_SECRET = INIT_PREFIX + "SECRET";
     
     /**
      * Indicate the encryption algorithm used for encrypt the view state.
      */
     @JSFWebConfigParam(name="org.apache.myfaces.ALGORITHM",since="1.1",
             defaultValue="DES",group="state",tags="performance")
     public static final String INIT_ALGORITHM = INIT_PREFIX + "ALGORITHM";
 
     /**
      * If is set to "false", the secret key used for encryption algorithm is not cached. This is used
      * when the returned SecretKey for encryption algorithm is not thread safe. 
      */
     @JSFWebConfigParam(name="org.apache.myfaces.SECRET.CACHE",since="1.1",group="state")
     public static final String INIT_SECRET_KEY_CACHE = INIT_SECRET + ".CACHE";
     
     /**
      * Defines the initialization vector (Base64 encoded) used for the encryption algorithm
      */
     @JSFWebConfigParam(name="org.apache.myfaces.ALGORITHM.IV",since="1.1",group="state")
     public static final String INIT_ALGORITHM_IV = INIT_ALGORITHM + ".IV";
     
     /**
      * Defines the default mode and padding used for the encryption algorithm
      */
     @JSFWebConfigParam(name="org.apache.myfaces.ALGORITHM.PARAMETERS",since="1.1",
             defaultValue="ECB/PKCS5Padding",group="state")
     public static final String INIT_ALGORITHM_PARAM = INIT_ALGORITHM + ".PARAMETERS";
     
     /**
      * Defines the factory class name using for serialize/deserialize the view state returned 
      * by state manager into a byte array. The expected class must implement
      * org.apache.myfaces.shared.util.serial.SerialFactory interface.
      */
     @JSFWebConfigParam(name="org.apache.myfaces.SERIAL_FACTORY", since="1.1",group="state",tags="performance")
     public static final String SERIAL_FACTORY = INIT_PREFIX + "SERIAL_FACTORY";
     
     /**
      * Indicate if the view state should be compressed before encrypted(optional) and encoded
      */
     @JSFWebConfigParam(name="org.apache.myfaces.COMPRESS_STATE_IN_CLIENT",since="1.1",defaultValue="false",
             expectedValues="true,false",group="state",tags="performance")
     public static final String COMPRESS_STATE_IN_CLIENT = INIT_PREFIX + "COMPRESS_STATE_IN_CLIENT";
 
     public static final String DEFAULT_MAC_ALGORITHM = "HmacSHA1";
 
     /**
      * Indicate the algorithm used to calculate the Message Authentication Code that is
      * added to the view state.
      */
     @JSFWebConfigParam(name="org.apache.myfaces.MAC_ALGORITHM",defaultValue="HmacSHA1",
             group="state",tags="performance")
     public static final String INIT_MAC_ALGORITHM = "org.apache.myfaces.MAC_ALGORITHM";
     
     /**
      * Define the initialization code that are used to initialize the secret key used
      * on the Message Authentication Code algorithm
      */
     @JSFWebConfigParam(name="org.apache.myfaces.MAC_SECRET",group="state")
     public static final String INIT_MAC_SECRET = "org.apache.myfaces.MAC_SECRET";
 
     /**
      * If is set to "false", the secret key used for MAC algorithm is not cached. This is used
      * when the returned SecretKey for mac algorithm is not thread safe. 
      */
     @JSFWebConfigParam(name="org.apache.myfaces.MAC_SECRET.CACHE",group="state")
     public static final String INIT_MAC_SECRET_KEY_CACHE = "org.apache.myfaces.MAC_SECRET.CACHE";
     
     /** Utility class, do not instatiate */
     private StateUtils()
     {
         //nope
     }
 
     private static void testConfiguration(ExternalContext ctx)
     {
 
         String algorithmParams = ctx.getInitParameter(INIT_ALGORITHM_PARAM);
         
         if (algorithmParams == null)
         {
             algorithmParams = ctx.getInitParameter(INIT_ALGORITHM_PARAM.toLowerCase());
         }
         String iv = ctx.getInitParameter(INIT_ALGORITHM_IV);
         
         if (iv == null)
         {
             iv = ctx.getInitParameter(INIT_ALGORITHM_IV.toLowerCase());
         }
         
         if (algorithmParams != null && algorithmParams.startsWith("CBC") )
         {
             if(iv == null)
             {
                 throw new FacesException(INIT_ALGORITHM_PARAM +
                         " parameter has been set with CBC mode," +
                         " but no initialization vector has been set " +
                         " with " + INIT_ALGORITHM_IV);
             }
         }
 
     }
     
     public static boolean enableCompression(ExternalContext ctx)
     {
         if(ctx == null)
         {
             throw new NullPointerException("ExternalContext ctx");
         }
     
         return "true".equals(ctx.getInitParameter(COMPRESS_STATE_IN_CLIENT));
     }
     
     public static boolean isSecure(ExternalContext ctx)
     {
         
         if(ctx == null)
         {
             throw new NullPointerException("ExternalContext ctx");
         }
         
         return ! "false".equals(ctx.getInitParameter(USE_ENCRYPTION));
     }
 
     /**
      * This fires during the Render Response phase, saving state.
      */
 
     public static final String construct(Object object, ExternalContext ctx)
     {
         byte[] bytes = getAsByteArray(object, ctx);
         if( enableCompression(ctx) )
         {
             bytes = compress(bytes);
         }
         if(isSecure(ctx))
         {
             bytes = encrypt(bytes, ctx);
         }
         bytes = encode(bytes);
         try
         {
             return new String(bytes, ZIP_CHARSET);
         }
         catch (UnsupportedEncodingException e)
         {
             throw new FacesException(e);
         }
     }
 
     /**
      * Performs serialization with the serialization provider created by the 
      * SerialFactory.  
      * 
      * @param object
      * @param ctx
      * @return
      */
     
     public static final byte[] getAsByteArray(Object object, ExternalContext ctx)
     {
         ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
         
         // get the Factory that was instantiated @ startup
         SerialFactory serialFactory = (SerialFactory) ctx.getApplicationMap().get(SERIAL_FACTORY);
         
         if(serialFactory == null)
         {
             throw new NullPointerException("serialFactory");
         }
         
         try
         {
             ObjectOutputStream writer = serialFactory.getObjectOutputStream(outputStream);
             writer.writeObject(object);
             byte[] bytes = outputStream.toByteArray();
             writer.close();
             outputStream.close();
             writer = null;
             outputStream = null;
             return bytes;
         }
         catch (IOException e)
         {
             throw new FacesException(e);
         }
     }
 
     public static byte[] encrypt(byte[] insecure, ExternalContext ctx)
     {
 
         if (ctx == null)
         {
             throw new NullPointerException("ExternalContext ctx");
         }
 
         testConfiguration(ctx);
         
         SecretKey secretKey = (SecretKey) getSecret(ctx);
         String algorithm = findAlgorithm(ctx);
         String algorithmParams = findAlgorithmParams(ctx);
         byte[] iv = findInitializationVector(ctx);
         
         SecretKey macSecretKey = (SecretKey) getMacSecret(ctx);
         String macAlgorithm = findMacAlgorithm(ctx);
                 
         try
         {
             // keep local to avoid threading issue
             Mac mac = Mac.getInstance(macAlgorithm);
             mac.init(macSecretKey);
             Cipher cipher = Cipher.getInstance(algorithm + "/" + algorithmParams);
             if (iv != null)
             {
                 IvParameterSpec ivSpec = new IvParameterSpec(iv);
                 cipher.init(Cipher.ENCRYPT_MODE, secretKey, ivSpec);
             }
             else
             {
                 cipher.init(Cipher.ENCRYPT_MODE, secretKey);
             }
             if (log.isLoggable(Level.FINE))
             {
                 log.fine("encrypting w/ " + algorithm + "/" + algorithmParams);
             }
             
             //EtM Composition Approach
             int macLenght = mac.getMacLength();
             byte[] secure = new byte[cipher.getOutputSize(insecure.length)+ macLenght];
             int secureCount = cipher.doFinal(insecure,0,insecure.length,secure);
             mac.update(secure, 0, secureCount);
             mac.doFinal(secure, secureCount);
                         
             return secure;
         }
         catch (Exception e)
         {
             throw new FacesException(e);
         }
     }
 
     public static final byte[] compress(byte[] bytes)
     {
         ByteArrayOutputStream baos = new ByteArrayOutputStream();
         try
         {
             GZIPOutputStream gzip = new GZIPOutputStream(baos);
             gzip.write(bytes, 0, bytes.length);
             gzip.finish();
             byte[] fewerBytes = baos.toByteArray();
             gzip.close();
             baos.close();
             gzip = null;
             baos = null;
             return fewerBytes;
         }
         catch (IOException e)
         {
             throw new FacesException(e);
         }
     }
 
     public static final byte[] encode(byte[] bytes)
     {
           return new Base64().encode(bytes);
     }
 
     /**
      * This fires during the Restore View phase, restoring state.
      */
     public static final Object reconstruct(String string, ExternalContext ctx)
     {
         byte[] bytes;
         try
         {
             if(log.isLoggable(Level.FINE))
             {
                 log.fine("Processing state : " + string);
             }
 
             bytes = string.getBytes(ZIP_CHARSET);
             bytes = decode(bytes);
             if(isSecure(ctx))
             {
                 bytes = decrypt(bytes, ctx);
             }
             if( enableCompression(ctx) )
             {
                 bytes = decompress(bytes);
             }
             return getAsObject(bytes, ctx);
         }
         catch (Throwable e)
         {
             if (log.isLoggable(Level.FINE))
             {
                 log.log(Level.FINE, "View State cannot be reconstructed", e);
             }
             return null;
         }
     }
 
     public static final byte[] decode(byte[] bytes)
     {
           return new Base64().decode(bytes);
     }
 
     public static final byte[] decompress(byte[] bytes)
     {
         if(bytes == null)
         {
             throw new NullPointerException("byte[] bytes");
         }
         
         ByteArrayInputStream bais = new ByteArrayInputStream(bytes);
         ByteArrayOutputStream baos = new ByteArrayOutputStream();
         byte[] buffer = new byte[bytes.length];
         int length;
 
         try
         {
             GZIPInputStream gis = new GZIPInputStream(bais);
             while ((length = gis.read(buffer)) != -1)
             {
                 baos.write(buffer, 0, length);
             }
 
             byte[] moreBytes = baos.toByteArray();
             baos.close();
             bais.close();
             gis.close();
             baos = null;
             bais = null;
             gis = null;
             return moreBytes;
         }
         catch (IOException e)
         {
             throw new FacesException(e);
         }
     }
     
     public static byte[] decrypt(byte[] secure, ExternalContext ctx)
     {
         if (ctx == null)
         {
             throw new NullPointerException("ExternalContext ctx");
         }
 
         testConfiguration(ctx);
                 
         SecretKey secretKey = (SecretKey) getSecret(ctx);
         String algorithm = findAlgorithm(ctx);
         String algorithmParams = findAlgorithmParams(ctx);
         byte[] iv = findInitializationVector(ctx);
         
         SecretKey macSecretKey = (SecretKey) getMacSecret(ctx);
         String macAlgorithm = findMacAlgorithm(ctx);
 
         try
         {
             // keep local to avoid threading issue
             Mac mac = Mac.getInstance(macAlgorithm);
             mac.init(macSecretKey);
             Cipher cipher = Cipher.getInstance(algorithm + "/"
                     + algorithmParams);
             if (iv != null)
             {
                 IvParameterSpec ivSpec = new IvParameterSpec(iv);
                 cipher.init(Cipher.DECRYPT_MODE, secretKey, ivSpec);
             }
             else
             {
                 cipher.init(Cipher.DECRYPT_MODE, secretKey);
             }
             if (log.isLoggable(Level.FINE))
             {
                 log.fine("decrypting w/ " + algorithm + "/" + algorithmParams);
             }
 
             //EtM Composition Approach
             int macLenght = mac.getMacLength();
             mac.update(secure, 0, secure.length-macLenght);
             byte[] signedDigestHash = mac.doFinal();
 
             boolean isMacEqual = true;
             for (int i = 0; i < signedDigestHash.length; i++)
             {
                 if (signedDigestHash[i] != secure[secure.length-macLenght+i])
                 {
                     isMacEqual = false;
                     // MYFACES-2934 Must compare *ALL* bytes of the hash, 
                     // otherwise a side-channel timing attack is theorically possible
                     // but with a very very low probability, because the
                     // comparison time is too small to be measured compared to
                     // the overall request time and in real life applications,
                     // there are too many uncertainties involved.
                     //break;
                 }
             }
             if (!isMacEqual)
             {
                 throw new ViewExpiredException();
             }
             
             return cipher.doFinal(secure, 0, secure.length-macLenght);
         }
         catch (Exception e)
         {
             throw new FacesException(e);
         }
     }
 
     /**
      * Performs deserialization with the serialization provider created from the
      * SerialFactory.
      * 
      * @param bytes
      * @param ctx
      * @return
      */
     
     public static final Object getAsObject(byte[] bytes, ExternalContext ctx)
     {
         ByteArrayInputStream input = null;
 
         try
         {
             input = new ByteArrayInputStream(bytes);
 
             // get the Factory that was instantiated @ startup
             SerialFactory serialFactory = (SerialFactory) ctx.getApplicationMap().get(SERIAL_FACTORY);
             
             if(serialFactory == null)
             {
                 throw new NullPointerException("serialFactory");
             }
             
             ObjectInputStream s = null;
             Exception pendingException = null;
             try
             {
                 s = serialFactory.getObjectInputStream(input); 
                 Object object = null;
                 if (System.getSecurityManager() != null)
                 {
                     final ObjectInputStream ois = s;
                     object = AccessController.doPrivileged(new PrivilegedExceptionAction<Object>()
                     {
                         //Put IOException and ClassNotFoundException as "checked" exceptions,
                         //so AccessController wrap them in a PrivilegedActionException
                         public Object run() throws PrivilegedActionException, 
                                                    IOException, ClassNotFoundException
                         {
                             return ois.readObject();
                         }
                     });
                     // Since s has the same instance as ois,
                     // we don't need to close it here, rather
                     // close it on the finally block related to s
                     // and avoid duplicate close exceptions
                     // finally
                     // {
                     //    ois.close();
                     // }
                 }
                 else
                 {
                     object = s.readObject();
                 }
                 return object;
             }
             catch (Exception e)
             {
                 pendingException = e;
                 throw new FacesException(e);
             }
             finally
             {
                 if (s != null)
                 {
                     try
                     {
                         s.close();
                     }
                     catch (IOException e)
                     {
                         // If a previous exception is thrown 
                         // ignore this, but if not, wrap it in a
                         // FacesException and throw it. In this way
                         // we preserve the original semantic of this
                         // method, but we handle correctly the case
                         // when we close a stream. Obviously, the 
                         // information about this exception is lost,
                         // but note that the interesting information 
                         // is always on pendingException, since we
                         // only do a readObject() on the outer try block.
                         if (pendingException == null)
                         {
                             throw new FacesException(e);
                         }                        
                     }
                     finally
                     {
                         s = null;
                     }
                 }
             }
         }
         finally
         {
             if (input != null)
             {
                 try
                 {
                     input.close();
                 }
                 catch (IOException e)
                 {
                     //ignore it, because ByteArrayInputStream.close has
                     //no effect, but it is better to call close and preserve
                     //semantic from previous code.
                 }
                 finally
                 {
                     input = null;
                 }
             }
         }
     }
 
     /**
      * Utility method for generating base 64 encoded strings.
      * 
      * @param args
      * @throws UnsupportedEncodingException
      */
     public static void main (String[] args) throws UnsupportedEncodingException
     {
         byte[] bytes = encode(args[0].getBytes(ZIP_CHARSET));
           System.out.println(new String(bytes, ZIP_CHARSET));
     }
 
     private static byte[] findInitializationVector(ExternalContext ctx)
     {
         
         byte[] iv = null;
         String ivString = ctx.getInitParameter(INIT_ALGORITHM_IV);
         
         if(ivString == null)
         {
             ivString = ctx.getInitParameter(INIT_ALGORITHM_IV.toLowerCase());
         }
         
         if (ivString != null)
         {
             iv = new Base64().decode(ivString.getBytes());
         }
         
         return iv;
     }
 
     private static String findAlgorithmParams(ExternalContext ctx)
     {
         
         String algorithmParams = ctx.getInitParameter(INIT_ALGORITHM_PARAM);
         
         if (algorithmParams == null)
         {
             algorithmParams = ctx.getInitParameter(INIT_ALGORITHM_PARAM.toLowerCase());
         }
         
         if (algorithmParams == null)
         {
             algorithmParams = DEFAULT_ALGORITHM_PARAMS;
         }
         
         if (log.isLoggable(Level.FINE))
         {
             log.fine("Using algorithm paramaters " + algorithmParams);
         }
         
         return algorithmParams;
     }
 
     private static String findAlgorithm(ExternalContext ctx)
     {
         
         String algorithm = ctx.getInitParameter(INIT_ALGORITHM);
         
         if (algorithm == null)
         {
             algorithm = ctx.getInitParameter(INIT_ALGORITHM.toLowerCase());
         }
 
         return findAlgorithm( algorithm );
     }
     
     private static String findAlgorithm(ServletContext ctx)
     {
 
         String algorithm = ctx.getInitParameter(INIT_ALGORITHM);
         
         if (algorithm == null)
         {
             algorithm = ctx.getInitParameter(INIT_ALGORITHM.toLowerCase());
         }
 
         return findAlgorithm( algorithm );
     }
     
     private static String findAlgorithm(String initParam)
     {
         
         if (initParam == null)
         {
             initParam = DEFAULT_ALGORITHM;
         }
         
         if (log.isLoggable(Level.FINE))
         {
             log.fine("Using algorithm " + initParam);
         }
         
         return initParam;
         
     }
 
     /**
      * Does nothing if the user has disabled the SecretKey cache. This is
      * useful when dealing with a JCA provider whose SecretKey 
      * implementation is not thread safe.
      * 
      * Instantiates a SecretKey instance based upon what the user has 
      * specified in the deployment descriptor.  The SecretKey is then 
      * stored in application scope where it can be used for all requests.
      */
     
     public static void initSecret(ServletContext ctx)
     {
         
         if(ctx == null)
         {
             throw new NullPointerException("ServletContext ctx");
         }
         
         if (log.isLoggable(Level.FINE))
         {
             log.fine("Storing SecretKey @ " + INIT_SECRET_KEY_CACHE);
         }
 
         // Create and store SecretKey on application scope
         String cache = ctx.getInitParameter(INIT_SECRET_KEY_CACHE);
         
         if(cache == null)
         {
             cache = ctx.getInitParameter(INIT_SECRET_KEY_CACHE.toLowerCase());
         }
         
         if (!"false".equals(cache))
         {
             String algorithm = findAlgorithm(ctx);
             // you want to create this as few times as possible
             ctx.setAttribute(INIT_SECRET_KEY_CACHE, new SecretKeySpec(
                     findSecret(ctx, algorithm), algorithm));
         }
 
         if (log.isLoggable(Level.FINE))
         {
             log.fine("Storing SecretKey @ " + INIT_MAC_SECRET_KEY_CACHE);
         }
         
         String macCache = ctx.getInitParameter(INIT_MAC_SECRET_KEY_CACHE);
         
         if(macCache == null)
         {
             macCache = ctx.getInitParameter(INIT_MAC_SECRET_KEY_CACHE.toLowerCase());
         }
         
         if (!"false".equals(macCache))
         {
             String macAlgorithm = findMacAlgorithm(ctx);
             // init mac secret and algorithm 
             ctx.setAttribute(INIT_MAC_SECRET_KEY_CACHE, new SecretKeySpec(
                     findMacSecret(ctx, macAlgorithm), macAlgorithm));
         }
     }
     
     private static SecretKey getSecret(ExternalContext ctx)
     {
         Object secretKey = (SecretKey) ctx.getApplicationMap().get(INIT_SECRET_KEY_CACHE);
         
         if (secretKey == null)
         {
             String cache = ctx.getInitParameter(INIT_SECRET_KEY_CACHE);
             
             if(cache == null)
             {
                 cache = ctx.getInitParameter(INIT_SECRET_KEY_CACHE.toLowerCase());
             }
             
             if ("false".equals(cache))
             {
                 // No cache is used. This option is activated
                 String secret = ctx.getInitParameter(INIT_SECRET);
                 
                 if (secret == null)
                 {
                     secret = ctx.getInitParameter(INIT_SECRET.toLowerCase());
                 }
 
                 if (secret == null)
                 {
                     throw new NullPointerException("Could not find secret using key '" + INIT_SECRET + "'");
                 }
                 
                 String algorithm = findAlgorithm(ctx);
                 
                 secretKey = new SecretKeySpec(findSecret(ctx, algorithm), algorithm);
             }
             else
             {
                 throw new NullPointerException("Could not find SecretKey in application scope using key '" 
                         + INIT_SECRET_KEY_CACHE + "'");
             }
         }
         
         if( ! ( secretKey instanceof SecretKey ) )
         {
             throw new ClassCastException("Did not find an instance of SecretKey "
                     + "in application scope using the key '" + INIT_SECRET_KEY_CACHE + "'");
         }
 
         
         return (SecretKey) secretKey;
     }
 
     private static byte[] findSecret(ExternalContext ctx, String algorithm)
     {
         String secret = ctx.getInitParameter(INIT_SECRET);
         
         if (secret == null)
         {
             secret = ctx.getInitParameter(INIT_SECRET.toLowerCase());
         }
         
         return findSecret(secret, algorithm);
     }    
     
     private static byte[] findSecret(ServletContext ctx, String algorithm)
     {
         String secret = ctx.getInitParameter(INIT_SECRET);
         
         if (secret == null)
         {
             secret = ctx.getInitParameter(INIT_SECRET.toLowerCase());
         }
         
         return findSecret(secret, algorithm);
     }
     
     private static byte[] findSecret(String secret, String algorithm)
     {
         byte[] bytes = null;
         
         if(secret == null)
         {
             try
             {
                 KeyGenerator kg = KeyGenerator.getInstance(algorithm);
                 bytes = kg.generateKey().getEncoded();
                 
                 if(log.isLoggable(Level.FINE))
                 {
                     log.fine("generated random password of length " + bytes.length);
                 }
             }
             catch (NoSuchAlgorithmException e)
             {
                 // Generate random password length 8, 
                 int length = 8;
                 bytes = new byte[length];
                 new Random().nextBytes(bytes);
                 
                 if(log.isLoggable(Level.FINE))
                 {
                     log.fine("generated random password of length " + length);
                 }
             }
         }
         else 
         {
             bytes = new Base64().decode(secret.getBytes());
         }
         
         return bytes;
     }
 
     private static String findMacAlgorithm(ExternalContext ctx)
     {
         
         String algorithm = ctx.getInitParameter(INIT_MAC_ALGORITHM);
         
         if (algorithm == null)
         {
             algorithm = ctx.getInitParameter(INIT_MAC_ALGORITHM.toLowerCase());
         }
 
         return findMacAlgorithm( algorithm );
 
     }
     
     private static String findMacAlgorithm(ServletContext ctx)
     {
 
         String algorithm = ctx.getInitParameter(INIT_MAC_ALGORITHM);
         
         if (algorithm == null)
         {
             algorithm = ctx.getInitParameter(INIT_MAC_ALGORITHM.toLowerCase());
         }
 
         return findMacAlgorithm( algorithm );
         
     }
     
     private static String findMacAlgorithm(String initParam)
     {
         
         if (initParam == null)
         {
             initParam = DEFAULT_MAC_ALGORITHM;
         }
         
         if (log.isLoggable(Level.FINE))
         {
             log.fine("Using algorithm " + initParam);
         }
         
         return initParam;
         
     }
     
     private static SecretKey getMacSecret(ExternalContext ctx)
     {
         Object secretKey = (SecretKey) ctx.getApplicationMap().get(INIT_MAC_SECRET_KEY_CACHE);
         
         if (secretKey == null)
         {
             String cache = ctx.getInitParameter(INIT_MAC_SECRET_KEY_CACHE);
             
             if(cache == null)
             {
                 cache = ctx.getInitParameter(INIT_MAC_SECRET_KEY_CACHE.toLowerCase());
             }
             
             if ("false".equals(cache))
             {
                 // No cache is used. This option is activated
                 String secret = ctx.getInitParameter(INIT_MAC_SECRET);
                 
                 if (secret == null)
                 {
                     secret = ctx.getInitParameter(INIT_MAC_SECRET.toLowerCase());
                 }
                 
                 if (secret == null)
                 {
                     throw new NullPointerException("Could not find secret using key '" + INIT_MAC_SECRET + "'");
                 }
                 
                 String macAlgorithm = findMacAlgorithm(ctx);
 
                 secretKey = new SecretKeySpec(findMacSecret(ctx, macAlgorithm), macAlgorithm);
             }
             else
             {
                 throw new NullPointerException("Could not find SecretKey in application scope using key '" 
                         + INIT_MAC_SECRET_KEY_CACHE + "'");
             }
         }
         
         if( ! ( secretKey instanceof SecretKey ) )
         {
             throw new ClassCastException("Did not find an instance of SecretKey "
                     + "in application scope using the key '" + INIT_MAC_SECRET_KEY_CACHE + "'");
         }
 
         
         return (SecretKey) secretKey;
     }
 
     private static byte[] findMacSecret(ExternalContext ctx, String algorithm)
     {
         String secret = ctx.getInitParameter(INIT_MAC_SECRET);
         
         if (secret == null)
         {
             secret = ctx.getInitParameter(INIT_MAC_SECRET.toLowerCase());
         }
  
         return findMacSecret(secret, algorithm);
     }    
     
     private static byte[] findMacSecret(ServletContext ctx, String algorithm)
     {
         String secret = ctx.getInitParameter(INIT_MAC_SECRET);
         
         if (secret == null)
         {
             secret = ctx.getInitParameter(INIT_MAC_SECRET.toLowerCase());
         }
         
         return findMacSecret(secret, algorithm);
     }
 
     private static byte[] findMacSecret(String secret, String algorithm)
     {
         byte[] bytes = null;
         
         if(secret == null)
         {
             try
             {
                 KeyGenerator kg = KeyGenerator.getInstance(algorithm);
                 bytes = kg.generateKey().getEncoded();
                 
                 if(log.isLoggable(Level.FINE))
                 {
                     log.fine("generated random mac password of length " + bytes.length);
                 }
             }
             catch (NoSuchAlgorithmException e)
             {
                 // Generate random password length 8, 
                 int length = 8;
                 bytes = new byte[length];
                 new Random().nextBytes(bytes);
                 
                 if(log.isLoggable(Level.FINE))
                 {
                     log.fine("generated random mac password of length " + length);
                 }
             }
         }
         else 
         {
             bytes = new Base64().decode(secret.getBytes());
         }
         
         return bytes;
     }
 }