org.nhindirect.common.crypto.impl

Class BootstrappedKeyStoreProtectionManager

java.lang.Object

org.nhindirect.common.crypto.impl.BootstrappedKeyStoreProtectionManager

All Implemented Interfaces:

KeyStoreProtectionManager, WrappableKeyProtectionManager

public class BootstrappedKeyStoreProtectionManager
extends Object
implements KeyStoreProtectionManager, WrappableKeyProtectionManager

Implementation of a key store manager where the protection keys are provided as injected parameters. This class is useful if the pass phrases or keys are stored in configuration files and can be provided as declarative config statements.

Since:

1.3

Author:

Greg Meyer

Field Summary

Fields

Modifier and Type	Field and Description
static String	KeyStoreProtKey
static String	PrivKeyProtKey

Constructor Summary

Constructors

Constructor and Description
BootstrappedKeyStoreProtectionManager() Empty constructore
BootstrappedKeyStoreProtectionManager(String keyStoreProtectionKey, String privateKeyProtectionKey) Constructs a manager by providing the protection keys as strings.
BootstrappedKeyStoreProtectionManager(String keyStoreProtectionKey, String privateKeyProtectionKey, Map<String,KeyStore.Entry> entries) Constructs a manager by providing the protection keys as strings and a collection of key entries

Method Summary

Modifier and Type	Method and Description
Map<String,KeyStore.Entry>	getAllEntries() Gets a Map of all entries managed by the token.
Map<String,Key>	getAllKeys() Gets a Map of all keys managed by the token.
KeyStore.Entry	getEntry(String entryName) Gets a specific entry by name
Key	getKey(String keyName) Gets a specific key by name.
Key	getKeyStoreProtectionKey() Gets the key protecting private keys in the key store.
Key	getPrivateKeyProtectionKey() Gets the key protecting the key store as a whole.
void	setKeyEntries(Map<String,KeyStore.Entry> entries) Sets the key entries.
void	setKeyStoreProtectionKey(byte[] keyStoreProtectionKey) Sets the pass phrase that protects the key store as a whole as a byte array.
void	setKeyStoreProtectionKey(String keyStoreProtectionKey) Sets the pass phrase that protects the key store as a whole as a String.
void	setPrivateKeyProtectionKey(byte[] privateKeyProtectionKey) Sets the pass phrase that protects the private keys in the key store as a byte array.
void	setPrivateKeyProtectionKey(String privateKeyProtectionKey) Sets the pass phrase that protects the private keys in the key store as a String.
Key	unwrapWithSecretKey(SecretKey kek, byte[] wrappedData, String keyAlg, int keyType) Unwraps the key with a symmetric secret key encryption key.
byte[]	wrapWithSecretKey(SecretKey kek, Key keyToWrap) Wraps a key with a symmetric secret key encryption key.

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

PrivKeyProtKey

public static final String PrivKeyProtKey

See Also:

Constant Field Values

KeyStoreProtKey

public static final String KeyStoreProtKey

See Also:

Constant Field Values

Constructor Detail

BootstrappedKeyStoreProtectionManager

public BootstrappedKeyStoreProtectionManager()

Empty constructore

BootstrappedKeyStoreProtectionManager

public BootstrappedKeyStoreProtectionManager(String keyStoreProtectionKey,
                                             String privateKeyProtectionKey)

Constructs a manager by providing the protection keys as strings.

Parameters:

keyStoreProtectionKey - The pass phrase that protects the key store as a whole.

privateKeyProtectionKey - The pass phrase that protects the private keys in the key store.

BootstrappedKeyStoreProtectionManager

public BootstrappedKeyStoreProtectionManager(String keyStoreProtectionKey,
                                             String privateKeyProtectionKey,
                                             Map<String,KeyStore.Entry> entries)

Constructs a manager by providing the protection keys as strings and a collection of key entries

Parameters:

keyStoreProtectionKey - The pass phrase that protects the key store as a whole.

privateKeyProtectionKey - The pass phrase that protects the private keys in the key store.

entries - Key entries

Method Detail

setKeyStoreProtectionKey

public void setKeyStoreProtectionKey(byte[] keyStoreProtectionKey)

Sets the pass phrase that protects the key store as a whole as a byte array.

Parameters:

keyStoreProtectionKey - The pass phrase that protects the key store as a whole as a byte array.

setKeyStoreProtectionKey

public void setKeyStoreProtectionKey(String keyStoreProtectionKey)

Sets the pass phrase that protects the key store as a whole as a String.

Parameters:

keyStoreProtectionKey - The pass phrase that protects the key store as a whole as a String.

setPrivateKeyProtectionKey

public void setPrivateKeyProtectionKey(byte[] privateKeyProtectionKey)

Sets the pass phrase that protects the private keys in the key store as a byte array.

Parameters:

privateKeyProtectionKey - The pass phrase that protects the private keys in the key store as a byte array.

setPrivateKeyProtectionKey

public void setPrivateKeyProtectionKey(String privateKeyProtectionKey)

Sets the pass phrase that protects the private keys in the key store as a String.

Parameters:

privateKeyProtectionKey - The pass phrase that protects the private keys in the key store as a String.

setKeyEntries

public void setKeyEntries(Map<String,KeyStore.Entry> entries)

Sets the key entries.

Parameters:

entries - The key entries

getPrivateKeyProtectionKey

public Key getPrivateKeyProtectionKey()
                               throws CryptoException

Gets the key protecting the key store as a whole.

Specified by:

getPrivateKeyProtectionKey in interface KeyStoreProtectionManager

Returns:

The key protecting the key store as a whole.

Throws:

CryptoException

getKeyStoreProtectionKey

public Key getKeyStoreProtectionKey()
                             throws CryptoException

Gets the key protecting private keys in the key store.

Specified by:

getKeyStoreProtectionKey in interface KeyStoreProtectionManager

Returns:

The key protecting private keys in the key store.

Throws:

CryptoException

getAllKeys

public Map<String,Key> getAllKeys()
                           throws CryptoException

Gets a Map of all keys managed by the token.

Specified by:

getAllKeys in interface KeyStoreProtectionManager

Returns:

Returns a map of all keys in the token. The mapping is string alias to the key.

Throws:

CryptoException

getKey

public Key getKey(String keyName)
           throws CryptoException

Gets a specific key by name.

Specified by:

getKey in interface KeyStoreProtectionManager

Parameters:

keyName - The name of the key to retrieve. Returns null if the key doesn't exist.

Returns:

They key specified by the name.

Throws:

CryptoException

getAllEntries

public Map<String,KeyStore.Entry> getAllEntries()
                                         throws CryptoException

Gets a Map of all entries managed by the token.

Specified by:

getAllEntries in interface KeyStoreProtectionManager

Returns:

Returns a map of all entries in the token. The mapping is a string alias to the entry.

Throws:

CryptoException

getEntry

public KeyStore.Entry getEntry(String entryName)
                        throws CryptoException

Gets a specific entry by name

Specified by:

getEntry in interface KeyStoreProtectionManager

Parameters:

entryName - The name of the entry to retrieve. Returns null if the entry doesn't exist.

Returns:

They entry specified by the name.

Throws:

CryptoException

wrapWithSecretKey

public byte[] wrapWithSecretKey(SecretKey kek,
                                Key keyToWrap)
                         throws CryptoException

Wraps a key with a symmetric secret key encryption key.}

Specified by:

wrapWithSecretKey in interface WrappableKeyProtectionManager

Parameters:

kek - The key encryption key.

keyToWrap - The key to be wrapped.

Returns:

A wrapped representation of the key as a byte array.

Throws:

CryptoException

unwrapWithSecretKey

public Key unwrapWithSecretKey(SecretKey kek,
                               byte[] wrappedData,
                               String keyAlg,
                               int keyType)
                        throws CryptoException

Unwraps the key with a symmetric secret key encryption key.}

Specified by:

unwrapWithSecretKey in interface WrappableKeyProtectionManager

Parameters:

kek - The key encryption key.

wrappedData - The wrapped key as a byte array.

keyAlg - The algorithm of the key that is being decrypted. Typical parameters are "RSA", "DSA", and "AES" depending on the key type.

keyType - The type of key that is wrapped. Valid values should use the Cipher.PRIVATE_KEY and Cipher.SECRET_KEY constants.

Returns:

The unwrapped key. Depending on implementation, the actual key material may not be available using the getEncoded() method; the sensitive key information is held on the token. The returned key may still be used for cryptographic operations, but the Provider name parameter of the cryptographic functions will generally need to match the Provider name of the underlying keystore.

Throws:

CryptoException