org.nhindirect.common.crypto.impl

Class StaticCachedPKCS11TokenKeyStoreProtectionManager

java.lang.Object

org.nhindirect.common.crypto.impl.AbstractPKCS11TokenKeyStoreProtectionManager

org.nhindirect.common.crypto.impl.StaticPKCS11TokenKeyStoreProtectionManager

org.nhindirect.common.crypto.impl.StaticCachedPKCS11TokenKeyStoreProtectionManager

All Implemented Interfaces:

KeyStoreProtectionManager, MutableKeyStoreProtectionManager, WrappableKeyProtectionManager

public class StaticCachedPKCS11TokenKeyStoreProtectionManager
extends StaticPKCS11TokenKeyStoreProtectionManager

This implementations uses the same login process as the StaticPKCS11TokenKeyStoreProtectionManager, however the keystore and private key protection keys are loaded into the manager at init time and cached in the class. The advantage is that multiple trips do not have to be made to the HSM to get the secret keys per certificate operation. They disadvantage is that secret keys or cached in process memory.

This class is also a generic band aid for systems that get disconnected from their HSMs due to policy and technical reasons. These systems need access to the secret keys even after they are disconnected.

NOTE: PrivateKeyEntry object are not cached because most PKCS11 implementations consider them non-extractable meaning they cannot be taken off of the PKCS11 token and stored into process memory. A persistent connection the PKCS11 token is generally required for PrivateKeyEntry objects.

Since:

1.4.1

Author:

Greg Meyer

Field Summary

Fields inherited from class org.nhindirect.common.crypto.impl.AbstractPKCS11TokenKeyStoreProtectionManager

DEFAULT_KESTORE_TYPE, IV_BYTES, SUNPKCS11_KEYSTORE_PROVIDER_NAME, WRAP_ALGO

Constructor Summary

Constructors

Constructor and Description
StaticCachedPKCS11TokenKeyStoreProtectionManager() Empty constructor
StaticCachedPKCS11TokenKeyStoreProtectionManager(PKCS11Credential credential, String keyStorePassPhraseAlias, String privateKeyPassPhraseAlias) Constructs the store with a credential manager and aliases.

Method Summary

Modifier and Type	Method and Description
Key	getKeyStoreProtectionKey() Gets the key protecting private keys in the key store.
Key	getPrivateKeyProtectionKey() Gets the key protecting the key store as a whole.
void	initTokenStore() Initializes access to the token.

Methods inherited from class org.nhindirect.common.crypto.impl.AbstractPKCS11TokenKeyStoreProtectionManager

clearEntry, clearKey, clearKeyStoreProtectionKey, clearPrivateKeyProtectionKey, getAllEntries, getAllKeys, getEntry, getKey, getKS, setCredential, setEntry, setKey, setKeyStorePassPhraseAlias, setKeyStoreProtectionKey, setKeyStoreProtectionKeyAsBytes, setKeyStoreProtectionKeyAsString, setKeyStoreProviderName, setKeyStoreSource, setKeyStoreSourceAsString, setKeyStoreType, setPcks11ConfigFile, setPrivateKeyPassPhraseAlias, setPrivateKeyProtectionKey, setPrivateKeyProtectionKeyAsBytes, setPrivateKeyProtectionKeyAsString, unwrapWithSecretKey, wrapWithSecretKey

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

StaticCachedPKCS11TokenKeyStoreProtectionManager

public StaticCachedPKCS11TokenKeyStoreProtectionManager()
                                                 throws CryptoException

Empty constructor

Throws:

CryptoException

StaticCachedPKCS11TokenKeyStoreProtectionManager

public StaticCachedPKCS11TokenKeyStoreProtectionManager(PKCS11Credential credential,
                                                        String keyStorePassPhraseAlias,
                                                        String privateKeyPassPhraseAlias)
                                                 throws CryptoException

Constructs the store with a credential manager and aliases.

Parameters:

credential - The credentials to log into the store.

keyStorePassPhraseAlias - The alias name of the key store key in the PKCS11 token.

privateKeyPassPhraseAlias - The alias name of the private key protection key in the PKCS11 token.

Throws:

CryptoException

Method Detail

initTokenStore

public void initTokenStore()
                    throws CryptoException

Initializes access to the token. This is implementation specific and may require user interaction.

Overrides:

initTokenStore in class StaticPKCS11TokenKeyStoreProtectionManager

Throws:

CryptoException

getPrivateKeyProtectionKey

public Key getPrivateKeyProtectionKey()
                               throws CryptoException

Gets the key protecting the key store as a whole.

Specified by:

getPrivateKeyProtectionKey in interface KeyStoreProtectionManager

Overrides:

getPrivateKeyProtectionKey in class AbstractPKCS11TokenKeyStoreProtectionManager

Returns:

The key protecting the key store as a whole.

Throws:

CryptoException

getKeyStoreProtectionKey

public Key getKeyStoreProtectionKey()
                             throws CryptoException

Gets the key protecting private keys in the key store.

Specified by:

getKeyStoreProtectionKey in interface KeyStoreProtectionManager

Overrides:

getKeyStoreProtectionKey in class AbstractPKCS11TokenKeyStoreProtectionManager

Returns:

The key protecting private keys in the key store.

Throws:

CryptoException