Class BcExternalPublicKeyDataDecryptorFactory

java.lang.Object
org.bouncycastle.openpgp.operator.AbstractPublicKeyDataDecryptorFactory
org.bouncycastle.openpgp.operator.bc.BcPublicKeyDataDecryptorFactory
org.bouncycastle.openpgp.api.operator.bc.BcExternalPublicKeyDataDecryptorFactory
All Implemented Interfaces:
PGPDataDecryptorFactory, PublicKeyDataDecryptorFactory
public abstract class BcExternalPublicKeyDataDecryptorFactory extends BcPublicKeyDataDecryptorFactory
Base class for a BcPublicKeyDataDecryptorFactory whose private key material is held outside the OpenPGP key - typically on a hardware token - as described by OpenPGP External Secret Keys and signalled by SecretKeyPacket.USAGE_EXTERNAL.

All session-key recovery logic (packet parsing, length checks, the RFC 6637 / RFC 9580 KDF and key unwrap) is inherited from BcPublicKeyDataDecryptorFactory; a subclass supplies only the raw private-key operation by implementing getExternalKeyCryptoCallback().

Note that a secret key handled through this class need not actually be external: if the supplied key does carry usable software key material, getCryptoCallback() returns the inherited software callback so the (much cheaper) in-process path is used instead.

  • Constructor Details

    • BcExternalPublicKeyDataDecryptorFactory

      public BcExternalPublicKeyDataDecryptorFactory(OpenPGPKey.OpenPGPSecretKey secretKey) throws PGPException
      Create a decryptor factory for the given secret key.
      Parameters:
      secretKey - the (typically external) OpenPGP secret key
      Throws:
      PGPException - if the key cannot be unlocked

  • Method Details

    • getSecretKey

      protected OpenPGPKey.OpenPGPSecretKey getSecretKey()
      Return the secret key this factory decrypts for.
      Returns:
      secret key

    • getCryptoCallback

      protected BcPublicKeyCryptoCallback getCryptoCallback()
      Description copied from class: BcPublicKeyDataDecryptorFactory
      Return the callback used for the raw private-key operations. Subclasses backing the key with a hardware device override this to route those operations to the device.
      Overrides:
      getCryptoCallback in class BcPublicKeyDataDecryptorFactory
      Returns:
      crypto callback

    • getExternalKeyCryptoCallback

      public abstract BcPublicKeyCryptoCallback getExternalKeyCryptoCallback()
      Return the callback routing the raw private-key operation to the external device.
      Returns:
      crypto callback for the externally-held key