net.shibboleth.utilities.java.support.security

Class DataSealer

java.lang.Object

net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

net.shibboleth.utilities.java.support.security.DataSealer

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent

public class DataSealer
extends AbstractInitializableComponent

Applies a MAC to time-limited information and encrypts with a symmetric key.

Field Summary

Fields

Modifier and Type	Field and Description
private DataSealerKeyStrategy	keyStrategy Source of keys.
private org.slf4j.Logger	log Class logger.
private java.security.SecureRandom	random Source of secure random data.

Constructor Summary

Constructors

Constructor and Description
DataSealer()

Method Summary

Modifier and Type	Method and Description
void	doInitialize() Performs the initialization of the component.
private java.lang.String	extractAndCheckDecryptedData(byte[] decryptedBytes) Extract the GZIP'd data and test for expiration before returning it.
void	setKeyStrategy(DataSealerKeyStrategy strategy) Set the key strategy.
void	setRandom(java.security.SecureRandom r) Set the pseudorandom generator.
private void	testEncryption(javax.crypto.SecretKey key) Run a test over the configured bean properties.
java.lang.String	unwrap(java.lang.String wrapped) Decrypts and verifies an encrypted bundle created with wrap(String, long).
java.lang.String	unwrap(java.lang.String wrapped, java.lang.StringBuffer keyUsed) Decrypts and verifies an encrypted bundle created with wrap(String, long), optionally returning the label of the key used to encrypt the data.
java.lang.String	wrap(java.lang.String data, long exp) Encodes data into an AEAD-encrypted blob, gzip(exp|data) exp = expiration time of the data; 8 bytes; Big-endian data = the data; a UTF-8-encoded string

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

destroy, doDestroy, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

log

@Nonnull
private org.slf4j.Logger log

Class logger.

keyStrategy

@NonnullAfterInit
private DataSealerKeyStrategy keyStrategy

Source of keys.

random

@NonnullAfterInit
private java.security.SecureRandom random

Source of secure random data.

Constructor Detail

DataSealer

public DataSealer()

Method Detail

setKeyStrategy

public void setKeyStrategy(@Nonnull
                           DataSealerKeyStrategy strategy)

Set the key strategy.

Parameters:

strategy - key strategy

setRandom

public void setRandom(@Nonnull
                      java.security.SecureRandom r)

Set the pseudorandom generator.

Parameters:

r - the pseudorandom generator to set

doInitialize

public void doInitialize()
                  throws ComponentInitializationException

Performs the initialization of the component. This method is executed within the lock on the object being initialized. The default implementation of this method is a no-op.

Overrides:

doInitialize in class AbstractInitializableComponent

Throws:

ComponentInitializationException - thrown if there is a problem initializing the component

unwrap

@Nonnull
public java.lang.String unwrap(@Nonnull @NotEmpty
                                        java.lang.String wrapped)
                                 throws DataSealerException

Decrypts and verifies an encrypted bundle created with wrap(String, long).

Parameters:

wrapped - the encoded blob

Returns:

the decrypted data, if it's unexpired

Throws:

DataSealerException - if the data cannot be unwrapped and verified

unwrap

@Nonnull
public java.lang.String unwrap(@Nonnull @NotEmpty
                                        java.lang.String wrapped,
                                        @Nullable
                                        java.lang.StringBuffer keyUsed)
                                 throws DataSealerException

Decrypts and verifies an encrypted bundle created with wrap(String, long), optionally returning the label of the key used to encrypt the data.

Parameters:

wrapped - the encoded blob

keyUsed - a buffer to receive the alias of the key used to encrypt the data

Returns:

the decrypted data, if it's unexpired

Throws:

DataSealerException - if the data cannot be unwrapped and verified

extractAndCheckDecryptedData

@Nonnull
private java.lang.String extractAndCheckDecryptedData(@Nonnull @NotEmpty
                                                               byte[] decryptedBytes)
                                                        throws DataSealerException

Extract the GZIP'd data and test for expiration before returning it.

Parameters:

decryptedBytes - the data we are looking at

Returns:

the decoded data if it is valid and unexpired

Throws:

DataSealerException - if the data cannot be unwrapped and verified

wrap

@Nonnull
public java.lang.String wrap(@Nonnull @NotEmpty
                                      java.lang.String data,
                                      long exp)
                               throws DataSealerException

Encodes data into an AEAD-encrypted blob, gzip(exp|data)

• exp = expiration time of the data; 8 bytes; Big-endian
• data = the data; a UTF-8-encoded string

As part of encryption, the key alias is supplied as additional authenticated data to the cipher. Afterwards, the encrypted data is prepended by the IV and then again by the alias (in length-prefixed UTF-8 format), which identifies the key used. Finally the result is base64-encoded.

Parameters:

data - the data to wrap

exp - expiration time

Returns:

the encoded blob

Throws:

DataSealerException - if the wrapping operation fails

testEncryption

private void testEncryption(@Nonnull
                            javax.crypto.SecretKey key)
                     throws DataSealerException

Run a test over the configured bean properties.

Parameters:

key - key to test

Throws:

DataSealerException - if the test fails