org.bouncycastle.cms.jcajce
Class JceKeyTransRecipient

java.lang.Object
  org.bouncycastle.cms.AbstractRecipient
      org.bouncycastle.cms.AbstractKeyTransRecipient
          org.bouncycastle.cms.jcajce.JceKeyTransRecipient

All Implemented Interfaces:

KeyTransRecipient, Recipient

Direct Known Subclasses:

JceKeyTransAuthenticatedRecipient, JceKeyTransEnvelopedRecipient

public abstract class JceKeyTransRecipient

extends AbstractKeyTransRecipient

Field Summary

protected EnvelopedDataHelper	contentHelper
protected java.util.Map	extraMappings
protected EnvelopedDataHelper	helper
protected boolean	unwrappedKeyMustBeEncodable
protected boolean	validateKeySize

Constructor Summary

JceKeyTransRecipient(java.security.PrivateKey recipientKey)

Method Summary

protected java.security.Key	extractSecretKey(org.bouncycastle.asn1.x509.AlgorithmIdentifier keyEncryptionAlgorithm, org.bouncycastle.asn1.x509.AlgorithmIdentifier encryptedKeyAlgorithm, byte[] encryptedEncryptionKey)
JceKeyTransRecipient	setAlgorithmMapping(org.bouncycastle.asn1.ASN1ObjectIdentifier algorithm, java.lang.String algorithmName) Internally algorithm ids are converted into cipher names using a lookup table.
JceKeyTransRecipient	setAllowedContentAlgorithms(java.util.Set allowedContentAlgorithms) Set the content-encryption algorithms this recipient is willing to unwrap a key for.
JceKeyTransRecipient	setContentProvider(java.security.Provider provider) Set the provider to use for content processing.
JceKeyTransRecipient	setContentProvider(java.lang.String providerName) Set the provider to use for content processing.
JceKeyTransRecipient	setKeySizeValidation(boolean doValidate) Set validation of retrieved key sizes against the algorithm parameters for the encrypted key where possible - default is off.
JceKeyTransRecipient	setMinimumTagSize(int tagSizeInBits) Set the minimum AEAD authentication tag size (in bits) this recipient will accept.
JceKeyTransRecipient	setMustProduceEncodableUnwrappedKey(boolean unwrappedKeyMustBeEncodable) Flag that unwrapping must produce a key that will return a meaningful value from a call to Key.getEncoded().
JceKeyTransRecipient	setProvider(java.security.Provider provider) Set the provider to use for key recovery and content processing.
JceKeyTransRecipient	setProvider(java.lang.String providerName) Set the provider to use for key recovery and content processing.

Methods inherited from class org.bouncycastle.cms.AbstractKeyTransRecipient

isGOST

Methods inherited from class org.bouncycastle.cms.AbstractRecipient

checkTagSize, isContentAlgorithmAllowed, setAllowedContentAlgorithmSet, setMinimumTagSizeInBits

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.bouncycastle.cms.KeyTransRecipient

getRecipientOperator

Field Detail

helper

protected EnvelopedDataHelper helper

contentHelper

protected EnvelopedDataHelper contentHelper

extraMappings

protected java.util.Map extraMappings

validateKeySize

protected boolean validateKeySize

unwrappedKeyMustBeEncodable

protected boolean unwrappedKeyMustBeEncodable

Constructor Detail

JceKeyTransRecipient

public JceKeyTransRecipient(java.security.PrivateKey recipientKey)

Method Detail

setProvider

public JceKeyTransRecipient setProvider(java.security.Provider provider)

Set the provider to use for key recovery and content processing.

Parameters:

provider - provider to use.

Returns:

this recipient.

setProvider

public JceKeyTransRecipient setProvider(java.lang.String providerName)

Set the provider to use for key recovery and content processing.

Parameters:

providerName - the name of the provider to use.

Returns:

this recipient.

setAlgorithmMapping

public JceKeyTransRecipient setAlgorithmMapping(org.bouncycastle.asn1.ASN1ObjectIdentifier algorithm,
                                                java.lang.String algorithmName)

Internally algorithm ids are converted into cipher names using a lookup table. For some providers the standard lookup table won't work. Use this method to establish a specific mapping from an algorithm identifier to a specific algorithm.

For example: unwrapper.setAlgorithmMapping(PKCSObjectIdentifiers.rsaEncryption, "RSA");

Parameters:

algorithm - OID of algorithm in recipient.

algorithmName - JCE algorithm name to use.

Returns:

the current Recipient.

setContentProvider

public JceKeyTransRecipient setContentProvider(java.security.Provider provider)

Set the provider to use for content processing. If providerName is null a "no provider" search will be used to satisfy getInstance calls.

Parameters:

provider - the provider to use.

Returns:

this recipient.

setContentProvider

public JceKeyTransRecipient setContentProvider(java.lang.String providerName)

Set the provider to use for content processing. If providerName is null a "no provider" search will be used to satisfy getInstance calls.

Parameters:

providerName - the name of the provider to use.

Returns:

this recipient.

setMustProduceEncodableUnwrappedKey

public JceKeyTransRecipient setMustProduceEncodableUnwrappedKey(boolean unwrappedKeyMustBeEncodable)

Flag that unwrapping must produce a key that will return a meaningful value from a call to Key.getEncoded(). This is important if you are using a HSM for unwrapping and using a software based provider for decrypting the content. Default value: false.

Parameters:

unwrappedKeyMustBeEncodable - true if getEncoded() should return key bytes, false if not necessary.

Returns:

this recipient.

setKeySizeValidation

public JceKeyTransRecipient setKeySizeValidation(boolean doValidate)

Set validation of retrieved key sizes against the algorithm parameters for the encrypted key where possible - default is off.

This setting will not have any affect if the encryption algorithm in the recipient does not specify a particular key size, or if the unwrapper is a HSM and the byte encoding of the unwrapped secret key is not available.

Parameters:

doValidate - true if unwrapped key's should be validated against the content encryption algorithm, false otherwise.

Returns:

this recipient.

setAllowedContentAlgorithms

public JceKeyTransRecipient setAllowedContentAlgorithms(java.util.Set allowedContentAlgorithms)

Set the content-encryption algorithms this recipient is willing to unwrap a key for. When set, an attempt to recover content protected under any other algorithm is rejected, mitigating an attacker substituting a weaker content-encryption algorithm into the recipient info.

Parameters:

allowedContentAlgorithms - the set of permitted content-encryption algorithm OIDs.

Returns:

this recipient.

setMinimumTagSize

public JceKeyTransRecipient setMinimumTagSize(int tagSizeInBits)

Set the minimum AEAD authentication tag size (in bits) this recipient will accept. When set, an attempt to recover AuthEnvelopedData whose content algorithm carries a shorter tag is rejected, mitigating an attacker downgrading the tag to a weaker length.

Parameters:

tagSizeInBits - the minimum acceptable AEAD tag size, in bits.

Returns:

this recipient.

extractSecretKey

protected java.security.Key extractSecretKey(org.bouncycastle.asn1.x509.AlgorithmIdentifier keyEncryptionAlgorithm,
                                             org.bouncycastle.asn1.x509.AlgorithmIdentifier encryptedKeyAlgorithm,
                                             byte[] encryptedEncryptionKey)
                                      throws CMSException

Throws:

CMSException