com.microsoft.sqlserver.jdbc

Class SQLServerColumnEncryptionAzureKeyVaultProvider

java.lang.Object

com.microsoft.sqlserver.jdbc.SQLServerColumnEncryptionKeyStoreProvider

com.microsoft.sqlserver.jdbc.SQLServerColumnEncryptionAzureKeyVaultProvider

public class SQLServerColumnEncryptionAzureKeyVaultProvider
extends SQLServerColumnEncryptionKeyStoreProvider

Provides implementation similar to certificate store provider. A CEK encrypted with certificate store provider should be decryptable by this provider and vice versa. Envolope Format for the encrypted column encryption key version + keyPathLength + ciphertextLength + keyPath + ciphertext + signature version: A single byte indicating the format version. keyPathLength: Length of the keyPath. ciphertextLength: ciphertext length keyPath: keyPath used to encrypt the column encryption key. This is only used for troubleshooting purposes and is not verified during decryption. ciphertext: Encrypted column encryption key signature: Signature of the entire byte array. Signature is validated before decrypting the column encryption key.

Constructor Summary

Constructors

Constructor and Description
SQLServerColumnEncryptionAzureKeyVaultProvider(SQLServerKeyVaultAuthenticationCallback authenticationCallback, ExecutorService executorService) Constructor that takes a callback function to authenticate to AAD.

Method Summary

Modifier and Type	Method and Description
byte[]	decryptColumnEncryptionKey(String masterKeyPath, String encryptionAlgorithm, byte[] encryptedColumnEncryptionKey) This function uses the asymmetric key specified by the key path and decrypts an encrypted CEK with RSA encryption algorithm.
byte[]	encryptColumnEncryptionKey(String masterKeyPath, String encryptionAlgorithm, byte[] columnEncryptionKey) This function uses the asymmetric key specified by the key path and encrypts CEK with RSA encryption algorithm.
String	getName()
void	setName(String name)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

SQLServerColumnEncryptionAzureKeyVaultProvider

public SQLServerColumnEncryptionAzureKeyVaultProvider(SQLServerKeyVaultAuthenticationCallback authenticationCallback,
                                                      ExecutorService executorService)
                                               throws SQLServerException

Constructor that takes a callback function to authenticate to AAD. This is used by KeyVaultClient at runtime to authenticate to Azure Key Vault.

Parameters:

authenticationCallback - - Callback function used for authenticating to AAD.

executorService -

Throws:

SQLServerException

Method Detail

setName

public void setName(String name)

Specified by:

setName in class SQLServerColumnEncryptionKeyStoreProvider

getName

public String getName()

Specified by:

getName in class SQLServerColumnEncryptionKeyStoreProvider

decryptColumnEncryptionKey

public byte[] decryptColumnEncryptionKey(String masterKeyPath,
                                         String encryptionAlgorithm,
                                         byte[] encryptedColumnEncryptionKey)
                                  throws SQLServerException

This function uses the asymmetric key specified by the key path and decrypts an encrypted CEK with RSA encryption algorithm.

Specified by:

decryptColumnEncryptionKey in class SQLServerColumnEncryptionKeyStoreProvider

Parameters:

masterKeyPath - - Complete path of an asymmetric key in AKV

encryptionAlgorithm - - Asymmetric Key Encryption Algorithm

encryptedColumnEncryptionKey - - Encrypted Column Encryption Key

Returns:

Plain text column encryption key

Throws:

SQLServerException

encryptColumnEncryptionKey

public byte[] encryptColumnEncryptionKey(String masterKeyPath,
                                         String encryptionAlgorithm,
                                         byte[] columnEncryptionKey)
                                  throws SQLServerException

This function uses the asymmetric key specified by the key path and encrypts CEK with RSA encryption algorithm.

Specified by:

encryptColumnEncryptionKey in class SQLServerColumnEncryptionKeyStoreProvider

Parameters:

masterKeyPath - - Complete path of an asymmetric key in AKV

encryptionAlgorithm - - Asymmetric Key Encryption Algorithm

columnEncryptionKey - - Plain text column encryption key

Returns:

Encrypted column encryption key

Throws:

SQLServerException