public interface DelegatedKey
extends javax.crypto.SecretKey
Cipher but
instead contain their own cryptographic logic. This can be used to wrap more
complex logic, HSM integration, or service-calls.
Most delegated keys will only support a subset of these operations. (For
example, AES keys will generally not support sign(byte[], String) or
verify(byte[], byte[], String) and HMAC keys will generally not
support anything except sign and verify.)
UnsupportedOperationException should be thrown in these cases.
| Modifier and Type | Method and Description |
|---|---|
byte[] |
decrypt(byte[] cipherText,
byte[] additionalAssociatedData,
java.lang.String algorithm)
Decrypts the provided ciphertext and returns a byte-array containing the
plaintext.
|
byte[] |
encrypt(byte[] plainText,
byte[] additionalAssociatedData,
java.lang.String algorithm)
Encrypts the provided plaintext and returns a byte-array containing the ciphertext.
|
byte[] |
sign(byte[] dataToSign,
java.lang.String algorithm)
Calculates and returns a signature for
dataToSign. |
java.security.Key |
unwrap(byte[] wrappedKey,
java.lang.String wrappedKeyAlgorithm,
int wrappedKeyType,
byte[] additionalAssociatedData,
java.lang.String algorithm)
Unwraps (decrypts) the provided
wrappedKey to recover the
original key. |
boolean |
verify(byte[] dataToSign,
byte[] signature,
java.lang.String algorithm)
Checks the provided signature for correctness.
|
byte[] |
wrap(java.security.Key key,
byte[] additionalAssociatedData,
java.lang.String algorithm)
Wraps (encrypts) the provided
key to make it safe for
storage or transmission. |
byte[] encrypt(byte[] plainText,
byte[] additionalAssociatedData,
java.lang.String algorithm)
throws java.security.InvalidKeyException,
javax.crypto.IllegalBlockSizeException,
javax.crypto.BadPaddingException,
java.security.NoSuchAlgorithmException,
javax.crypto.NoSuchPaddingException
plainText - additionalAssociatedData - Optional additional data which must then also be provided for successful
decryption. Both null and arrays of length 0 are treated identically.
Not all keys will support this parameter.algorithm - the transformation to be used when encrypting the datajava.lang.UnsupportedOperationException - if encryption is not supported or if additionalAssociatedData is
provided, but not supported.java.security.InvalidKeyExceptionjavax.crypto.IllegalBlockSizeExceptionjavax.crypto.BadPaddingExceptionjava.security.NoSuchAlgorithmExceptionjavax.crypto.NoSuchPaddingExceptionbyte[] decrypt(byte[] cipherText,
byte[] additionalAssociatedData,
java.lang.String algorithm)
throws java.security.InvalidKeyException,
javax.crypto.IllegalBlockSizeException,
javax.crypto.BadPaddingException,
java.security.NoSuchAlgorithmException,
javax.crypto.NoSuchPaddingException,
java.security.InvalidAlgorithmParameterException
cipherText - additionalAssociatedData - Optional additional data which was provided during encryption.
Both null and arrays of length 0 are treated
identically. Not all keys will support this parameter.algorithm - the transformation to be used when decrypting the datajava.lang.UnsupportedOperationException - if decryption is not supported or if
additionalAssociatedData is provided, but not
supported.java.security.InvalidKeyExceptionjavax.crypto.IllegalBlockSizeExceptionjavax.crypto.BadPaddingExceptionjava.security.NoSuchAlgorithmExceptionjavax.crypto.NoSuchPaddingExceptionjava.security.InvalidAlgorithmParameterExceptionbyte[] wrap(java.security.Key key,
byte[] additionalAssociatedData,
java.lang.String algorithm)
throws java.security.InvalidKeyException,
java.security.NoSuchAlgorithmException,
javax.crypto.NoSuchPaddingException,
javax.crypto.IllegalBlockSizeException
key to make it safe for
storage or transmission.key - additionalAssociatedData - Optional additional data which must then also be provided for
successful unwrapping. Both null and arrays of
length 0 are treated identically. Not all keys will support
this parameter.algorithm - the transformation to be used when wrapping the keyjava.lang.UnsupportedOperationException - if wrapping is not supported or if
additionalAssociatedData is provided, but not
supported.java.security.InvalidKeyExceptionjava.security.NoSuchAlgorithmExceptionjavax.crypto.NoSuchPaddingExceptionjavax.crypto.IllegalBlockSizeExceptionjava.security.Key unwrap(byte[] wrappedKey,
java.lang.String wrappedKeyAlgorithm,
int wrappedKeyType,
byte[] additionalAssociatedData,
java.lang.String algorithm)
throws java.security.NoSuchAlgorithmException,
javax.crypto.NoSuchPaddingException,
java.security.InvalidKeyException
wrappedKey to recover the
original key.wrappedKey - additionalAssociatedData - Optional additional data which was provided during wrapping.
Both null and arrays of length 0 are treated
identically. Not all keys will support this parameter.algorithm - the transformation to be used when unwrapping the keyjava.lang.UnsupportedOperationException - if wrapping is not supported or if
additionalAssociatedData is provided, but not
supported.java.security.NoSuchAlgorithmExceptionjavax.crypto.NoSuchPaddingExceptionjava.security.InvalidKeyExceptionbyte[] sign(byte[] dataToSign,
java.lang.String algorithm)
throws java.security.GeneralSecurityException
dataToSign.dataToSign - algorithm - java.lang.UnsupportedOperationException - if signing is not supportedjava.security.GeneralSecurityExceptionboolean verify(byte[] dataToSign,
byte[] signature,
java.lang.String algorithm)
dataToSign - signature - algorithm - signature matches the dataToSign.java.lang.UnsupportedOperationException - if signature validation is not supported