Package com.amazonaws.services.dynamodbv2.datamodeling.encryption

Interface DelegatedKey

All Superinterfaces:

Destroyable, Key, SecretKey, Serializable

public interface DelegatedKey
extends SecretKey

Identifies keys which should not be used directly with Cipher but instead contain their own cryptographic logic. This can be used to wrap more complex logic, HSM integration, or service-calls.

Most delegated keys will only support a subset of these operations. (For example, AES keys will generally not support sign(byte[], String) or verify(byte[], byte[], String) and HMAC keys will generally not support anything except sign and verify.) UnsupportedOperationException should be thrown in these cases.

Author:

Greg Rubin

Field Summary

Fields inherited from interface javax.crypto.SecretKey

serialVersionUID

Method Summary

Modifier and Type	Method	Description
byte[]	decrypt(byte[] cipherText, byte[] additionalAssociatedData, String algorithm)	Decrypts the provided ciphertext and returns a byte-array containing the plaintext.
byte[]	encrypt(byte[] plainText, byte[] additionalAssociatedData, String algorithm)	Encrypts the provided plaintext and returns a byte-array containing the ciphertext.
byte[]	sign(byte[] dataToSign, String algorithm)	Calculates and returns a signature for dataToSign.
Key	unwrap(byte[] wrappedKey, String wrappedKeyAlgorithm, int wrappedKeyType, byte[] additionalAssociatedData, String algorithm)	Unwraps (decrypts) the provided wrappedKey to recover the original key.
boolean	verify(byte[] dataToSign, byte[] signature, String algorithm)	Checks the provided signature for correctness.
byte[]	wrap(Key key, byte[] additionalAssociatedData, String algorithm)	Wraps (encrypts) the provided key to make it safe for storage or transmission.

Methods inherited from interface javax.security.auth.Destroyable

destroy, isDestroyed

Methods inherited from interface java.security.Key

getAlgorithm, getEncoded, getFormat

Method Detail

encrypt

byte[] encrypt(byte[] plainText,
               byte[] additionalAssociatedData,
               String algorithm)
        throws InvalidKeyException,
               IllegalBlockSizeException,
               BadPaddingException,
               NoSuchAlgorithmException,
               NoSuchPaddingException

Encrypts the provided plaintext and returns a byte-array containing the ciphertext.

Parameters:

plainText -

additionalAssociatedData - Optional additional data which must then also be provided for successful decryption. Both null and arrays of length 0 are treated identically. Not all keys will support this parameter.

algorithm - the transformation to be used when encrypting the data

Returns:

ciphertext the ciphertext produced by this encryption operation

Throws:

UnsupportedOperationException - if encryption is not supported or if additionalAssociatedData is provided, but not supported.

InvalidKeyException

IllegalBlockSizeException

BadPaddingException

NoSuchAlgorithmException

NoSuchPaddingException

decrypt

byte[] decrypt(byte[] cipherText,
               byte[] additionalAssociatedData,
               String algorithm)
        throws InvalidKeyException,
               IllegalBlockSizeException,
               BadPaddingException,
               NoSuchAlgorithmException,
               NoSuchPaddingException,
               InvalidAlgorithmParameterException

Decrypts the provided ciphertext and returns a byte-array containing the plaintext.

Parameters:

cipherText -

additionalAssociatedData - Optional additional data which was provided during encryption. Both null and arrays of length 0 are treated identically. Not all keys will support this parameter.

algorithm - the transformation to be used when decrypting the data

Returns:

plaintext the result of decrypting the input ciphertext

Throws:

UnsupportedOperationException - if decryption is not supported or if additionalAssociatedData is provided, but not supported.

InvalidKeyException

IllegalBlockSizeException

BadPaddingException

NoSuchAlgorithmException

NoSuchPaddingException

InvalidAlgorithmParameterException

wrap

byte[] wrap(Key key,
            byte[] additionalAssociatedData,
            String algorithm)
     throws InvalidKeyException,
            NoSuchAlgorithmException,
            NoSuchPaddingException,
            IllegalBlockSizeException

Wraps (encrypts) the provided key to make it safe for storage or transmission.

Parameters:

key -

additionalAssociatedData - Optional additional data which must then also be provided for successful unwrapping. Both null and arrays of length 0 are treated identically. Not all keys will support this parameter.

algorithm - the transformation to be used when wrapping the key

Returns:

the wrapped key

Throws:

UnsupportedOperationException - if wrapping is not supported or if additionalAssociatedData is provided, but not supported.

InvalidKeyException

NoSuchAlgorithmException

NoSuchPaddingException

IllegalBlockSizeException

unwrap

Key unwrap(byte[] wrappedKey,
           String wrappedKeyAlgorithm,
           int wrappedKeyType,
           byte[] additionalAssociatedData,
           String algorithm)
    throws NoSuchAlgorithmException,
           NoSuchPaddingException,
           InvalidKeyException

Unwraps (decrypts) the provided wrappedKey to recover the original key.

Parameters:

wrappedKey -

additionalAssociatedData - Optional additional data which was provided during wrapping. Both null and arrays of length 0 are treated identically. Not all keys will support this parameter.

algorithm - the transformation to be used when unwrapping the key

Returns:

the unwrapped key

Throws:

UnsupportedOperationException - if wrapping is not supported or if additionalAssociatedData is provided, but not supported.

NoSuchAlgorithmException

NoSuchPaddingException

InvalidKeyException

sign

byte[] sign(byte[] dataToSign,
            String algorithm)
     throws GeneralSecurityException

Calculates and returns a signature for dataToSign.

Parameters:

dataToSign -

algorithm -

Returns:

the signature

Throws:

UnsupportedOperationException - if signing is not supported

GeneralSecurityException

verify

boolean verify(byte[] dataToSign,
               byte[] signature,
               String algorithm)

Checks the provided signature for correctness.

Parameters:

dataToSign -

signature -

algorithm -

Returns:

true if and only if the signature matches the dataToSign.

Throws:

UnsupportedOperationException - if signature validation is not supported