001/* 002 * nimbus-jose-jwt 003 * 004 * Copyright 2012-2016, Connect2id Ltd. 005 * 006 * Licensed under the Apache License, Version 2.0 (the "License"); you may not use 007 * this file except in compliance with the License. You may obtain a copy of the 008 * License at 009 * 010 * http://www.apache.org/licenses/LICENSE-2.0 011 * 012 * Unless required by applicable law or agreed to in writing, software distributed 013 * under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR 014 * CONDITIONS OF ANY KIND, either express or implied. See the License for the 015 * specific language governing permissions and limitations under the License. 016 */ 017 018package com.nimbusds.jose.crypto; 019 020 021import javax.crypto.SecretKey; 022import javax.crypto.spec.SecretKeySpec; 023 024import com.nimbusds.jose.crypto.impl.AlgorithmSupportMessage; 025import com.nimbusds.jose.crypto.impl.ContentCryptoProvider; 026import com.nimbusds.jose.crypto.impl.DirectCryptoProvider; 027import net.jcip.annotations.ThreadSafe; 028 029import com.nimbusds.jose.*; 030import com.nimbusds.jose.jwk.OctetSequenceKey; 031import com.nimbusds.jose.util.Base64URL; 032import com.nimbusds.jose.util.ByteUtils; 033 034 035/** 036 * Direct encrypter of {@link com.nimbusds.jose.JWEObject JWE objects} with a 037 * shared symmetric key. 038 * 039 * <p>See RFC 7518 040 * <a href="https://tools.ietf.org/html/rfc7518#section-4.5">section 4.5</a> 041 * for more information.</p> 042 * 043 * <p>This class is thread-safe. 044 * 045 * <p>Supports the following key management algorithms: 046 * 047 * <ul> 048 * <li>{@link com.nimbusds.jose.JWEAlgorithm#DIR} 049 * </ul> 050 * 051 * <p>Supports the following content encryption algorithms: 052 * 053 * <ul> 054 * <li>{@link com.nimbusds.jose.EncryptionMethod#A128CBC_HS256} (requires 256 bit key) 055 * <li>{@link com.nimbusds.jose.EncryptionMethod#A192CBC_HS384} (requires 384 bit key) 056 * <li>{@link com.nimbusds.jose.EncryptionMethod#A256CBC_HS512} (requires 512 bit key) 057 * <li>{@link com.nimbusds.jose.EncryptionMethod#A128GCM} (requires 128 bit key) 058 * <li>{@link com.nimbusds.jose.EncryptionMethod#A192GCM} (requires 192 bit key) 059 * <li>{@link com.nimbusds.jose.EncryptionMethod#A256GCM} (requires 256 bit key) 060 * <li>{@link com.nimbusds.jose.EncryptionMethod#A128CBC_HS256_DEPRECATED} (requires 256 bit key) 061 * <li>{@link com.nimbusds.jose.EncryptionMethod#A256CBC_HS512_DEPRECATED} (requires 512 bit key) 062 * </ul> 063 * 064 * @author Vladimir Dzhuvinov 065 * @version 2017-06-01 066 */ 067@ThreadSafe 068public class DirectEncrypter extends DirectCryptoProvider implements JWEEncrypter { 069 070 071 /** 072 * Creates a new direct encrypter. 073 * 074 * @param key The symmetric key. Its algorithm should be "AES". Must be 075 * 128 bits (16 bytes), 192 bits (24 bytes), 256 bits (32 076 * bytes), 384 bits (48 bytes) or 512 bits (64 bytes) long. 077 * Must not be {@code null}. 078 * 079 * @throws KeyLengthException If the symmetric key length is not 080 * compatible. 081 */ 082 public DirectEncrypter(final SecretKey key) 083 throws KeyLengthException { 084 085 super(key); 086 } 087 088 089 /** 090 * Creates a new direct encrypter. 091 * 092 * @param keyBytes The symmetric key, as a byte array. Must be 128 bits 093 * (16 bytes), 192 bits (24 bytes), 256 bits (32 094 * bytes), 384 bits (48 bytes) or 512 bits (64 bytes) 095 * long. Must not be {@code null}. 096 * 097 * @throws KeyLengthException If the symmetric key length is not 098 * compatible. 099 */ 100 public DirectEncrypter(final byte[] keyBytes) 101 throws KeyLengthException { 102 103 this(new SecretKeySpec(keyBytes, "AES")); 104 } 105 106 107 /** 108 * Creates a new direct encrypter. 109 * 110 * @param octJWK The symmetric key, as a JWK. Must be 128 bits (16 111 * bytes), 192 bits (24 bytes), 256 bits (32 bytes), 384 112 * bits (48 bytes) or 512 bits (64 bytes) long. Must not 113 * be {@code null}. 114 * 115 * @throws KeyLengthException If the symmetric key length is not 116 * compatible. 117 */ 118 public DirectEncrypter(final OctetSequenceKey octJWK) 119 throws KeyLengthException { 120 121 this(octJWK.toSecretKey("AES")); 122 } 123 124 125 @Override 126 public JWECryptoParts encrypt(final JWEHeader header, final byte[] clearText) 127 throws JOSEException { 128 129 JWEAlgorithm alg = header.getAlgorithm(); 130 131 if (! alg.equals(JWEAlgorithm.DIR)) { 132 throw new JOSEException(AlgorithmSupportMessage.unsupportedJWEAlgorithm(alg, SUPPORTED_ALGORITHMS)); 133 } 134 135 // Check key length matches encryption method 136 EncryptionMethod enc = header.getEncryptionMethod(); 137 138 if (enc.cekBitLength() != ByteUtils.safeBitLength(getKey().getEncoded())) { 139 throw new KeyLengthException(enc.cekBitLength(), enc); 140 } 141 142 final Base64URL encryptedKey = null; // The second JWE part 143 144 return ContentCryptoProvider.encrypt(header, clearText, getKey(), encryptedKey, getJCAContext()); 145 } 146}