public interface DelegatedKey
extends javax.crypto.SecretKey
Cipher but instead contain their
own cryptographic logic. This can be used to wrap more complex logic, HSM integration, or
service-calls.
Most delegated keys will only support a subset of these operations. (For example, AES keys
will generally not support sign(byte[], String) or verify(byte[], byte[],
String) and HMAC keys will generally not support anything except sign and
verify.) UnsupportedOperationException should be thrown in these cases.
| Modifier and Type | Method and Description |
|---|---|
byte[] |
decrypt(byte[] cipherText,
byte[] additionalAssociatedData,
java.lang.String algorithm)
Decrypts the provided ciphertext and returns a byte-array containing the plaintext.
|
byte[] |
encrypt(byte[] plainText,
byte[] additionalAssociatedData,
java.lang.String algorithm)
Encrypts the provided plaintext and returns a byte-array containing the ciphertext.
|
byte[] |
sign(byte[] dataToSign,
java.lang.String algorithm)
Calculates and returns a signature for
dataToSign. |
java.security.Key |
unwrap(byte[] wrappedKey,
java.lang.String wrappedKeyAlgorithm,
int wrappedKeyType,
byte[] additionalAssociatedData,
java.lang.String algorithm)
Unwraps (decrypts) the provided
wrappedKey to recover the original key. |
boolean |
verify(byte[] dataToSign,
byte[] signature,
java.lang.String algorithm)
Checks the provided signature for correctness.
|
byte[] |
wrap(java.security.Key key,
byte[] additionalAssociatedData,
java.lang.String algorithm)
Wraps (encrypts) the provided
key to make it safe for storage or transmission. |
byte[] encrypt(byte[] plainText,
byte[] additionalAssociatedData,
java.lang.String algorithm)
throws java.security.InvalidKeyException,
javax.crypto.IllegalBlockSizeException,
javax.crypto.BadPaddingException,
java.security.NoSuchAlgorithmException,
javax.crypto.NoSuchPaddingException
plainText - additionalAssociatedData - Optional additional data which must then also be provided for
successful decryption. Both null and arrays of length 0 are treated
identically. Not all keys will support this parameter.algorithm - the transformation to be used when encrypting the datajava.lang.UnsupportedOperationException - if encryption is not supported or if
additionalAssociatedData is provided, but not supported.java.security.InvalidKeyExceptionjavax.crypto.IllegalBlockSizeExceptionjavax.crypto.BadPaddingExceptionjava.security.NoSuchAlgorithmExceptionjavax.crypto.NoSuchPaddingExceptionbyte[] decrypt(byte[] cipherText,
byte[] additionalAssociatedData,
java.lang.String algorithm)
throws java.security.InvalidKeyException,
javax.crypto.IllegalBlockSizeException,
javax.crypto.BadPaddingException,
java.security.NoSuchAlgorithmException,
javax.crypto.NoSuchPaddingException,
java.security.InvalidAlgorithmParameterException
cipherText - additionalAssociatedData - Optional additional data which was provided during encryption.
Both null and arrays of length 0 are treated identically. Not all keys will
support this parameter.algorithm - the transformation to be used when decrypting the datajava.lang.UnsupportedOperationException - if decryption is not supported or if
additionalAssociatedData is provided, but not supported.java.security.InvalidKeyExceptionjavax.crypto.IllegalBlockSizeExceptionjavax.crypto.BadPaddingExceptionjava.security.NoSuchAlgorithmExceptionjavax.crypto.NoSuchPaddingExceptionjava.security.InvalidAlgorithmParameterExceptionbyte[] wrap(java.security.Key key,
byte[] additionalAssociatedData,
java.lang.String algorithm)
throws java.security.InvalidKeyException,
java.security.NoSuchAlgorithmException,
javax.crypto.NoSuchPaddingException,
javax.crypto.IllegalBlockSizeException
key to make it safe for storage or transmission.key - additionalAssociatedData - Optional additional data which must then also be provided for
successful unwrapping. Both null and arrays of length 0 are treated
identically. Not all keys will support this parameter.algorithm - the transformation to be used when wrapping the keyjava.lang.UnsupportedOperationException - if wrapping is not supported or if
additionalAssociatedData is provided, but not supported.java.security.InvalidKeyExceptionjava.security.NoSuchAlgorithmExceptionjavax.crypto.NoSuchPaddingExceptionjavax.crypto.IllegalBlockSizeExceptionjava.security.Key unwrap(byte[] wrappedKey,
java.lang.String wrappedKeyAlgorithm,
int wrappedKeyType,
byte[] additionalAssociatedData,
java.lang.String algorithm)
throws java.security.NoSuchAlgorithmException,
javax.crypto.NoSuchPaddingException,
java.security.InvalidKeyException
wrappedKey to recover the original key.wrappedKey - additionalAssociatedData - Optional additional data which was provided during wrapping.
Both null and arrays of length 0 are treated identically. Not all keys will
support this parameter.algorithm - the transformation to be used when unwrapping the keyjava.lang.UnsupportedOperationException - if wrapping is not supported or if
additionalAssociatedData is provided, but not supported.java.security.NoSuchAlgorithmExceptionjavax.crypto.NoSuchPaddingExceptionjava.security.InvalidKeyExceptionbyte[] sign(byte[] dataToSign,
java.lang.String algorithm)
throws java.security.GeneralSecurityException
dataToSign.dataToSign - algorithm - java.lang.UnsupportedOperationException - if signing is not supportedjava.security.GeneralSecurityExceptionboolean verify(byte[] dataToSign,
byte[] signature,
java.lang.String algorithm)
dataToSign - signature - algorithm - signature matches the dataToSign.java.lang.UnsupportedOperationException - if signature validation is not supported