com.ibm.cloud.objectstorage.services.s3.internal.crypto

Class ContentCryptoScheme

java.lang.Object

com.ibm.cloud.objectstorage.services.s3.internal.crypto.ContentCryptoScheme

public abstract class ContentCryptoScheme
extends Object

Cryptographic scheme for content encrypt/decryption.

Author:

Hanson Char

Field Summary

Fields

Modifier and Type	Field and Description
static ContentCryptoScheme	AES_CBC Encryption Only (EO) scheme.
static ContentCryptoScheme	AES_CTR This is an auxiliary scheme used for range retrieval when object is encrypted via AES/GCM.
static ContentCryptoScheme	AES_GCM Authenticated Encryption (AE) scheme.
static long	MAX_GCM_BLOCKS The maximum number of 16-byte blocks that can be encrypted with a GCM cipher.
static long	MAX_GCM_BYTES The maximum number of bytes that can be encrypted with a GCM cipher.

Constructor Summary

Constructors

Constructor and Description
ContentCryptoScheme()

Method Summary

Modifier and Type	Method and Description
byte[]	adjustIV(byte[] iv, long startingBytePos)
CipherLite	createCipherLite(SecretKey cek, byte[] iv, int cipherMode) Creates and initializes a cipher lite for content encrypt/decryption.
CipherLite	createCipherLite(SecretKey cek, byte[] iv, int cipherMode, Provider provider, boolean alwaysUseProvider) Creates and initializes a CipherLite for content encrypt/decryption.
static ContentCryptoScheme	fromCEKAlgo(String cekAlgo) Returns the content crypto scheme of the given content encryption algorithm.
static ContentCryptoScheme	fromCEKAlgo(String cekAlgo, boolean isRangeGet)
abstract int	getBlockSizeInBytes()
abstract String	getCipherAlgorithm()
abstract int	getIVLengthInBytes()
abstract String	getKeyGeneratorAlgorithm()
abstract int	getKeyLengthInBits()
String	getKeySpec() A convenient method motivated by KMS.
String	getPreferredCipherProvider() Returns the preferred security provider to use for this crypto scheme.
int	getTagLengthInBits()
static byte[]	incrementBlocks(byte[] counter, long blockDelta) Increment the rightmost 32 bits of a 16-byte counter by the specified delta.
protected CipherLite	newCipherLite(Cipher cipher, SecretKey cek, int cipherMode) This is a factory method intended to be overridden by sublcasses to return the appropriate instance of cipher lite.
String	toString()

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Field Detail

MAX_GCM_BLOCKS

public static final long MAX_GCM_BLOCKS

The maximum number of 16-byte blocks that can be encrypted with a GCM cipher. Note the maximum bit-length of the plaintext is (2^39 - 256), which translates to a maximum byte-length of (2^36 - 32), which in turn translates to a maximum block-length of (2^32 - 2).

Reference: NIST Special Publication 800-38D..

See Also:

Constant Field Values

MAX_GCM_BYTES

public static final long MAX_GCM_BYTES

The maximum number of bytes that can be encrypted with a GCM cipher.

See Also:

Constant Field Values

AES_CBC

public static final ContentCryptoScheme AES_CBC

Encryption Only (EO) scheme.

AES_GCM

public static final ContentCryptoScheme AES_GCM

Authenticated Encryption (AE) scheme.

AES_CTR

public static final ContentCryptoScheme AES_CTR

This is an auxiliary scheme used for range retrieval when object is encrypted via AES/GCM.

Constructor Detail

ContentCryptoScheme

public ContentCryptoScheme()

Method Detail

getKeyGeneratorAlgorithm

public abstract String getKeyGeneratorAlgorithm()

getCipherAlgorithm

public abstract String getCipherAlgorithm()

getPreferredCipherProvider

public String getPreferredCipherProvider()

Returns the preferred security provider to use for this crypto scheme. Java 6 does not support AES/GCM/NoPadding in the default provider, and newer versions implement it by buffering all of the ciphertext in memory, so AesGcm prefers to use the BouncyCastle provider.

getKeyLengthInBits

public abstract int getKeyLengthInBits()

getBlockSizeInBytes

public abstract int getBlockSizeInBytes()

getIVLengthInBytes

public abstract int getIVLengthInBytes()

getTagLengthInBits

public int getTagLengthInBits()

adjustIV

public byte[] adjustIV(byte[] iv,
                       long startingBytePos)

toString

public String toString()

Overrides:

toString in class Object

incrementBlocks

public static byte[] incrementBlocks(byte[] counter,
                                     long blockDelta)

Increment the rightmost 32 bits of a 16-byte counter by the specified delta. Both the specified delta and the resultant value must stay within the capacity of 32 bits. (Package private for testing purposes.)

Parameters:

counter - a 16-byte counter used in AES/CTR

blockDelta - the number of blocks (16-byte) to increment

fromCEKAlgo

public static ContentCryptoScheme fromCEKAlgo(String cekAlgo)

Returns the content crypto scheme of the given content encryption algorithm.

fromCEKAlgo

public static ContentCryptoScheme fromCEKAlgo(String cekAlgo,
                                              boolean isRangeGet)

createCipherLite

public CipherLite createCipherLite(SecretKey cek,
                                   byte[] iv,
                                   int cipherMode,
                                   Provider provider,
                                   boolean alwaysUseProvider)

Creates and initializes a CipherLite for content encrypt/decryption.

Parameters:

cek - content encrypting key

iv - initialization vector

cipherMode - such as Cipher.ENCRYPT_MODE

provider - the security provider the user specified. For backwards compatibility, if this scheme defines a preferred provider, the user-specified provider is by default ignored.

alwaysUseProvider - if true, always use the user-specified provider above, even if this scheme has a preferred provider.

Returns:

the cipher lite created and initialized.

newCipherLite

protected CipherLite newCipherLite(Cipher cipher,
                                   SecretKey cek,
                                   int cipherMode)

This is a factory method intended to be overridden by sublcasses to return the appropriate instance of cipher lite.

createCipherLite

public CipherLite createCipherLite(SecretKey cek,
                                   byte[] iv,
                                   int cipherMode)
                            throws InvalidKeyException,
                                   NoSuchAlgorithmException,
                                   NoSuchProviderException,
                                   NoSuchPaddingException,
                                   InvalidAlgorithmParameterException

Creates and initializes a cipher lite for content encrypt/decryption.

Parameters:

cek - content encrypting key

iv - initialization vector

cipherMode - such as Cipher.ENCRYPT_MODE

Returns:

the cipher lite created and initialized.

Throws:

InvalidKeyException

NoSuchAlgorithmException

NoSuchProviderException

NoSuchPaddingException

InvalidAlgorithmParameterException

getKeySpec

public final String getKeySpec()

A convenient method motivated by KMS.