public class DataSealer extends AbstractInitializableComponent
Modifier and Type | Field and Description |
---|---|
private DataSealerKeyStrategy |
keyStrategy
Source of keys.
|
private org.slf4j.Logger |
log
Class logger.
|
private SecureRandom |
random
Source of secure random data.
|
Constructor and Description |
---|
DataSealer() |
Modifier and Type | Method and Description |
---|---|
void |
doInitialize()
Performs the initialization of the component.
|
private String |
extractAndCheckDecryptedData(byte[] decryptedBytes)
Extract the GZIP'd data and test for expiration before returning it.
|
void |
setKeyStrategy(DataSealerKeyStrategy strategy)
Set the key strategy.
|
void |
setRandom(SecureRandom r)
Set the pseudorandom generator.
|
private void |
testEncryption(SecretKey key)
Run a test over the configured bean properties.
|
String |
unwrap(String wrapped)
Decrypts and verifies an encrypted bundle created with
wrap(String, long) . |
String |
unwrap(String wrapped,
StringBuffer keyUsed)
Decrypts and verifies an encrypted bundle created with
wrap(String, long) , optionally
returning the label of the key used to encrypt the data. |
String |
wrap(String data,
long exp)
Encodes data into an AEAD-encrypted blob, gzip(exp|data)
exp = expiration time of the data; 8 bytes; Big-endian
data = the data; a UTF-8-encoded string
|
destroy, doDestroy, initialize, isDestroyed, isInitialized
@Nonnull private org.slf4j.Logger log
@NonnullAfterInit private DataSealerKeyStrategy keyStrategy
@NonnullAfterInit private SecureRandom random
public void setKeyStrategy(@Nonnull DataSealerKeyStrategy strategy)
strategy
- key strategypublic void setRandom(@Nonnull SecureRandom r)
r
- the pseudorandom generator to setpublic void doInitialize() throws ComponentInitializationException
doInitialize
in class AbstractInitializableComponent
ComponentInitializationException
- thrown if there is a problem initializing the component@Nonnull public String unwrap(@Nonnull @NotEmpty String wrapped) throws DataSealerException
wrap(String, long)
.wrapped
- the encoded blobDataSealerException
- if the data cannot be unwrapped and verified@Nonnull public String unwrap(@Nonnull @NotEmpty String wrapped, @Nullable StringBuffer keyUsed) throws DataSealerException
wrap(String, long)
, optionally
returning the label of the key used to encrypt the data.wrapped
- the encoded blobkeyUsed
- a buffer to receive the alias of the key used to encrypt the dataDataSealerException
- if the data cannot be unwrapped and verified@Nonnull private String extractAndCheckDecryptedData(@Nonnull @NotEmpty byte[] decryptedBytes) throws DataSealerException
decryptedBytes
- the data we are looking atDataSealerException
- if the data cannot be unwrapped and verified@Nonnull public String wrap(@Nonnull @NotEmpty String data, long exp) throws DataSealerException
As part of encryption, the key alias is supplied as additional authenticated data to the cipher. Afterwards, the encrypted data is prepended by the IV and then again by the alias (in length-prefixed UTF-8 format), which identifies the key used. Finally the result is base64-encoded.
data
- the data to wrapexp
- expiration timeDataSealerException
- if the wrapping operation failsprivate void testEncryption(@Nonnull SecretKey key) throws DataSealerException
key
- key to testDataSealerException
- if the test failsCopyright © 1999–2018. All rights reserved.