org.bouncycastle.pkcs.jcajce

Class JcePKCSPBEOutputEncryptorBuilder

java.lang.Object

org.bouncycastle.pkcs.jcajce.JcePKCSPBEOutputEncryptorBuilder

public class JcePKCSPBEOutputEncryptorBuilder
extends java.lang.Object

JCA-based builder for an OutputEncryptor that applies one of the password-based encryption schemes used to protect PKCS#8 / PKCS#12 payloads:

• the legacy PKCS#12 pkcs-12PbeIds family (RFC 7292 Appendix C) — selected when the constructor is passed one of those OIDs,
• PBES2 (RFC 8018) — selected for any other key-encryption algorithm; the embedded key-derivation function may be PBKDF2 or scrypt (RFC 7914) via an explicit PBKDFConfig.

Constructor Summary

Constructors

Constructor and Description
JcePKCSPBEOutputEncryptorBuilder(org.bouncycastle.asn1.ASN1ObjectIdentifier keyEncryptionAlg) Construct a builder for a single algorithm.
JcePKCSPBEOutputEncryptorBuilder(org.bouncycastle.crypto.util.PBKDFConfig pbkdfAlgorithm, org.bouncycastle.asn1.ASN1ObjectIdentifier keyEncryptionAlg) Constructor allowing different derivation functions such as PBKDF2 and scrypt.

Method Summary

Modifier and Type	Method and Description
OutputEncryptor	build(char[] password) Bind the builder to a password and return a configured OutputEncryptor.
JcePKCSPBEOutputEncryptorBuilder	setIterationCount(int iterationCount) Set the iteration count for the PBE calculation.
JcePKCSPBEOutputEncryptorBuilder	setKeySizeProvider(SecretKeySizeProvider keySizeProvider) Set the lookup provider of AlgorithmIdentifier returning key_size_in_bits used to handle PKCS5 decryption.
JcePKCSPBEOutputEncryptorBuilder	setPRF(org.bouncycastle.asn1.x509.AlgorithmIdentifier prf) Set the PRF to use for key generation.
JcePKCSPBEOutputEncryptorBuilder	setProvider(java.security.Provider provider)
JcePKCSPBEOutputEncryptorBuilder	setProvider(java.lang.String providerName)
JcePKCSPBEOutputEncryptorBuilder	setRandom(java.security.SecureRandom random)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

JcePKCSPBEOutputEncryptorBuilder

public JcePKCSPBEOutputEncryptorBuilder(org.bouncycastle.asn1.ASN1ObjectIdentifier keyEncryptionAlg)

Construct a builder for a single algorithm. If keyEncryptionAlg is a PKCS#12 PBE OID, the resulting encryptor uses the PKCS#12 wire profile; otherwise the encryptor uses PBES2 with the default PBKDF2 configuration and keyEncryptionAlg as the underlying encryption scheme.

Parameters:

keyEncryptionAlg - the algorithm identifier the encryptor should apply.

JcePKCSPBEOutputEncryptorBuilder

public JcePKCSPBEOutputEncryptorBuilder(org.bouncycastle.crypto.util.PBKDFConfig pbkdfAlgorithm,
                                        org.bouncycastle.asn1.ASN1ObjectIdentifier keyEncryptionAlg)

Constructor allowing different derivation functions such as PBKDF2 and scrypt.

Parameters:

pbkdfAlgorithm - key derivation algorithm definition to use.

keyEncryptionAlg - encryption algorithm to apply the derived key with.

Method Detail

setProvider

public JcePKCSPBEOutputEncryptorBuilder setProvider(java.security.Provider provider)

setProvider

public JcePKCSPBEOutputEncryptorBuilder setProvider(java.lang.String providerName)

setRandom

public JcePKCSPBEOutputEncryptorBuilder setRandom(java.security.SecureRandom random)

setKeySizeProvider

public JcePKCSPBEOutputEncryptorBuilder setKeySizeProvider(SecretKeySizeProvider keySizeProvider)

Set the lookup provider of AlgorithmIdentifier returning key_size_in_bits used to handle PKCS5 decryption.

Parameters:

keySizeProvider - a provider of integer secret key sizes.

Returns:

the current builder.

setPRF

public JcePKCSPBEOutputEncryptorBuilder setPRF(org.bouncycastle.asn1.x509.AlgorithmIdentifier prf)

Set the PRF to use for key generation. By default this is HmacSHA1.

Parameters:

prf - algorithm id for PRF.

Returns:

the current builder.

Throws:

java.lang.IllegalStateException - if this builder was intialised with a PBKDFDef

setIterationCount

public JcePKCSPBEOutputEncryptorBuilder setIterationCount(int iterationCount)

Set the iteration count for the PBE calculation.

Parameters:

iterationCount - the iteration count to apply to the key creation.

Returns:

the current builder.

Throws:

java.lang.IllegalStateException - if this builder was intialised with a PBKDFDef

build

public OutputEncryptor build(char[] password)
                      throws OperatorCreationException

Bind the builder to a password and return a configured OutputEncryptor. Its algorithm identifier carries the freshly generated salt / iteration count / IV in the wire format appropriate to the chosen scheme.

Parameters:

password - the password used to derive the encryption key.

Returns:

a configured output encryptor.

Throws:

OperatorCreationException - if a JCE Cipher or SecretKeyFactory cannot be created for the requested scheme.