19
19
import com .amazonaws .encryptionsdk .model .DecryptionMaterials ;
20
20
import com .amazonaws .encryptionsdk .model .EncryptionMaterials ;
21
21
import com .amazonaws .encryptionsdk .model .KeyBlob ;
22
+ import org .junit .Before ;
22
23
import org .junit .Test ;
23
24
import org .junit .runner .RunWith ;
24
25
import org .mockito .ArgumentCaptor ;
25
- import org .mockito .Captor ;
26
26
import org .mockito .Mock ;
27
27
import org .mockito .junit .MockitoJUnitRunner ;
28
28
33
33
import java .util .Collections ;
34
34
import java .util .List ;
35
35
import java .util .Map ;
36
- import java .util .function .Function ;
37
36
38
37
import static org .junit .Assert .assertArrayEquals ;
39
38
import static org .junit .Assert .assertEquals ;
@@ -47,30 +46,50 @@ public class RawKeyringTest {
47
46
48
47
static final String KEYNAME = "testKeyname" ;
49
48
static final String KEYNAMESPACE = "testKeynamespace" ;
50
- private static final CryptoAlgorithm ALGORITHM = CryptoAlgorithm .ALG_AES_192_GCM_IV12_TAG16_HKDF_SHA384_ECDSA_P384 ;
49
+ static final CryptoAlgorithm ALGORITHM = CryptoAlgorithm .ALG_AES_192_GCM_IV12_TAG16_HKDF_SHA384_ECDSA_P384 ;
51
50
static final SecretKey DATA_KEY = new SecretKeySpec (new byte []{10 , 11 , 12 }, ALGORITHM .getDataKeyAlgo ());
51
+ static final Map <String , String > ENCRYPTION_CONTEXT = Collections .singletonMap ("myKey" , "myValue" );
52
52
private static final EncryptedDataKey ENCRYPTED_DATA_KEY = new KeyBlob ("keyProviderId" , new byte []{1 , 2 , 3 }, new byte []{4 , 5 , 6 });
53
- private static final Map < String , String > ENCRYPTION_CONTEXT = Collections . singletonMap ( "myKey " , "myValue" );
53
+ private static final EncryptedDataKey INVALID_DATA_KEY = new KeyBlob ( "invalidProviderId " , new byte []{ 1 , 2 , 3 }, new byte []{ 4 , 5 , 6 } );
54
54
private static final KeyringTraceEntry ENCRYPTED_DATA_KEY_TRACE = new KeyringTraceEntry (KEYNAMESPACE , KEYNAME , Collections .singleton (KeyringTraceFlag .ENCRYPTED_DATA_KEY ));
55
55
private static final KeyringTraceEntry DECRYPTED_DATA_KEY_TRACE = new KeyringTraceEntry (KEYNAMESPACE , KEYNAME , Collections .singleton (KeyringTraceFlag .DECRYPTED_DATA_KEY ));
56
56
private static final KeyringTraceEntry GENERATED_DATA_KEY_TRACE = new KeyringTraceEntry (KEYNAMESPACE , KEYNAME , Collections .singleton (KeyringTraceFlag .GENERATED_DATA_KEY ));
57
57
@ Mock
58
58
private JceKeyCipher jceKeyCipher ;
59
- @ Captor
60
- private ArgumentCaptor <byte []> dataKeyCaptor ;
59
+ private Keyring keyring ;
61
60
62
- @ Test
63
- public void testEncryptDecryptExistingDataKey () throws GeneralSecurityException {
64
- Keyring keyring = newRawKeyring (jceKeyCipher , (edk ) -> true , ENCRYPTED_DATA_KEY_TRACE , DECRYPTED_DATA_KEY_TRACE );
61
+ @ Before
62
+ public void setup () throws Exception {
63
+ when (jceKeyCipher .encryptKey (DATA_KEY .getEncoded (), KEYNAME , KEYNAMESPACE , ENCRYPTION_CONTEXT )).thenReturn (ENCRYPTED_DATA_KEY );
64
+ when (jceKeyCipher .decryptKey (ENCRYPTED_DATA_KEY , KEYNAME , ENCRYPTION_CONTEXT )).thenReturn (DATA_KEY .getEncoded ());
65
+
66
+ keyring = new RawKeyring (KEYNAMESPACE , KEYNAME , jceKeyCipher ) {
67
+ @ Override
68
+ boolean validToDecrypt (EncryptedDataKey encryptedDataKey ) {
69
+ return !encryptedDataKey .getProviderId ().equals (INVALID_DATA_KEY .getProviderId ());
70
+ }
71
+
72
+ @ Override
73
+ void traceOnEncrypt (KeyringTrace keyringTrace ) {
74
+ keyringTrace .add (KEYNAMESPACE , KEYNAME , ENCRYPTED_DATA_KEY_TRACE .getFlags ().toArray (new KeyringTraceFlag []{}));
75
+ }
65
76
77
+ @ Override
78
+ void traceOnDecrypt (KeyringTrace keyringTrace ) {
79
+ keyringTrace .add (KEYNAMESPACE , KEYNAME , DECRYPTED_DATA_KEY_TRACE .getFlags ().toArray (new KeyringTraceFlag []{}));
80
+ }
81
+ };
82
+ }
83
+
84
+ @ Test
85
+ public void testEncryptDecryptExistingDataKey () {
66
86
EncryptionMaterials encryptionMaterials = EncryptionMaterials .newBuilder ()
67
87
.setAlgorithm (ALGORITHM )
68
88
.setCleartextDataKey (DATA_KEY )
69
89
.setKeyringTrace (new KeyringTrace ())
70
90
.setEncryptionContext (ENCRYPTION_CONTEXT )
71
91
.build ();
72
92
73
- when (jceKeyCipher .encryptKey (DATA_KEY .getEncoded (), KEYNAME , KEYNAMESPACE , ENCRYPTION_CONTEXT )).thenReturn (ENCRYPTED_DATA_KEY );
74
93
keyring .onEncrypt (encryptionMaterials );
75
94
76
95
assertEquals (1 , encryptionMaterials .getEncryptedDataKeys ().size ());
@@ -84,23 +103,21 @@ public void testEncryptDecryptExistingDataKey() throws GeneralSecurityException
84
103
.setKeyringTrace (new KeyringTrace ())
85
104
.build ();
86
105
87
- when (jceKeyCipher .decryptKey (encryptionMaterials .getEncryptedDataKeys ().get (0 ), KEYNAME , ENCRYPTION_CONTEXT )).thenReturn (DATA_KEY .getEncoded ());
88
- keyring .onDecrypt (decryptionMaterials , encryptionMaterials .getEncryptedDataKeys ());
106
+ keyring .onDecrypt (decryptionMaterials , Collections .singletonList (ENCRYPTED_DATA_KEY ));
89
107
90
108
assertEquals (DATA_KEY , decryptionMaterials .getCleartextDataKey ());
91
109
assertEquals (DECRYPTED_DATA_KEY_TRACE , decryptionMaterials .getKeyringTrace ().getEntries ().get (0 ));
92
110
}
93
111
94
112
@ Test
95
113
public void testEncryptNullDataKey () {
96
- Keyring keyring = newRawKeyring (jceKeyCipher , (edk ) -> true , ENCRYPTED_DATA_KEY_TRACE , null );
97
-
98
114
EncryptionMaterials encryptionMaterials = EncryptionMaterials .newBuilder ()
99
115
.setAlgorithm (ALGORITHM )
100
116
.setKeyringTrace (new KeyringTrace ())
101
117
.setEncryptionContext (ENCRYPTION_CONTEXT )
102
118
.build ();
103
119
120
+ ArgumentCaptor <byte []> dataKeyCaptor = ArgumentCaptor .forClass (byte [].class );
104
121
when (jceKeyCipher .encryptKey (dataKeyCaptor .capture (), eq (KEYNAME ), eq (KEYNAMESPACE ), eq (ENCRYPTION_CONTEXT ))).thenReturn (ENCRYPTED_DATA_KEY );
105
122
keyring .onEncrypt (encryptionMaterials );
106
123
@@ -116,8 +133,6 @@ public void testEncryptNullDataKey() {
116
133
117
134
@ Test (expected = IllegalArgumentException .class )
118
135
public void testEncryptBadDataKeyAlgorithm () {
119
- Keyring keyring = newRawKeyring (jceKeyCipher , (edk ) -> true , null , null );
120
-
121
136
EncryptionMaterials encryptionMaterials = EncryptionMaterials .newBuilder ()
122
137
.setAlgorithm (ALGORITHM )
123
138
.setCleartextDataKey (new SecretKeySpec (DATA_KEY .getEncoded (), "OtherAlgorithm" ))
@@ -130,8 +145,6 @@ public void testEncryptBadDataKeyAlgorithm() {
130
145
131
146
@ Test
132
147
public void testDecryptAlreadyDecryptedDataKey () {
133
- Keyring keyring = newRawKeyring (jceKeyCipher , (edk ) -> true , null , null );
134
-
135
148
DecryptionMaterials decryptionMaterials = DecryptionMaterials .newBuilder ()
136
149
.setAlgorithm (ALGORITHM )
137
150
.setCleartextDataKey (DATA_KEY )
@@ -147,36 +160,28 @@ public void testDecryptAlreadyDecryptedDataKey() {
147
160
148
161
@ Test
149
162
public void testDecryptNoValidDataKey () {
150
- Keyring keyring = newRawKeyring (jceKeyCipher , (edk ) -> false , null , null );
151
-
152
163
DecryptionMaterials decryptionMaterials = DecryptionMaterials .newBuilder ()
153
164
.setAlgorithm (ALGORITHM )
154
165
.setEncryptionContext (ENCRYPTION_CONTEXT )
155
166
.setKeyringTrace (new KeyringTrace ())
156
167
.build ();
157
168
158
- keyring .onDecrypt (decryptionMaterials , Collections .singletonList (ENCRYPTED_DATA_KEY ));
169
+ keyring .onDecrypt (decryptionMaterials , Collections .singletonList (INVALID_DATA_KEY ));
159
170
160
171
assertNull (decryptionMaterials .getCleartextDataKey ());
161
172
assertEquals (0 , decryptionMaterials .getKeyringTrace ().getEntries ().size ());
162
173
}
163
174
164
175
@ Test
165
- public void testDecryptMultipleKeysOneInvalid () throws GeneralSecurityException {
166
- final EncryptedDataKey BAD_DATA_KEY = new KeyBlob ("badProviderId" , new byte []{1 , 2 , 3 }, new byte []{4 , 5 , 6 });
167
-
168
- Keyring keyring = newRawKeyring (jceKeyCipher , (edk ) -> !edk .getProviderId ().equals (BAD_DATA_KEY .getProviderId ()), null , DECRYPTED_DATA_KEY_TRACE );
169
-
176
+ public void testDecryptMultipleKeysOneInvalid () {
170
177
DecryptionMaterials decryptionMaterials = DecryptionMaterials .newBuilder ()
171
178
.setAlgorithm (ALGORITHM )
172
179
.setEncryptionContext (ENCRYPTION_CONTEXT )
173
180
.setKeyringTrace (new KeyringTrace ())
174
181
.build ();
175
182
176
- when (jceKeyCipher .decryptKey (ENCRYPTED_DATA_KEY , KEYNAME , ENCRYPTION_CONTEXT )).thenReturn (DATA_KEY .getEncoded ());
177
-
178
183
final List <EncryptedDataKey > edks = new ArrayList <>();
179
- edks .add (BAD_DATA_KEY );
184
+ edks .add (INVALID_DATA_KEY );
180
185
edks .add (ENCRYPTED_DATA_KEY );
181
186
182
187
keyring .onDecrypt (decryptionMaterials , edks );
@@ -187,9 +192,7 @@ public void testDecryptMultipleKeysOneInvalid() throws GeneralSecurityException
187
192
188
193
@ Test
189
194
public void testDecryptMultipleKeysOneException () throws GeneralSecurityException {
190
- final EncryptedDataKey BAD_DATA_KEY = new KeyBlob ("badProviderId" , new byte []{1 , 2 , 3 }, new byte []{4 , 5 , 6 });
191
-
192
- Keyring keyring = newRawKeyring (jceKeyCipher , (edk ) -> true , null , DECRYPTED_DATA_KEY_TRACE );
195
+ final EncryptedDataKey BAD_DATA_KEY = new KeyBlob ("exceptionProvider" , new byte []{1 , 2 , 3 }, new byte []{4 , 5 , 6 });
193
196
194
197
DecryptionMaterials decryptionMaterials = DecryptionMaterials .newBuilder ()
195
198
.setAlgorithm (ALGORITHM )
@@ -199,7 +202,6 @@ public void testDecryptMultipleKeysOneException() throws GeneralSecurityExceptio
199
202
200
203
when (jceKeyCipher .decryptKey (BAD_DATA_KEY , KEYNAME , ENCRYPTION_CONTEXT ))
201
204
.thenThrow (new GeneralSecurityException ("could not decrypt key" ));
202
- when (jceKeyCipher .decryptKey (ENCRYPTED_DATA_KEY , KEYNAME , ENCRYPTION_CONTEXT )).thenReturn (DATA_KEY .getEncoded ());
203
205
204
206
final List <EncryptedDataKey > edks = new ArrayList <>();
205
207
edks .add (BAD_DATA_KEY );
@@ -211,32 +213,6 @@ public void testDecryptMultipleKeysOneException() throws GeneralSecurityExceptio
211
213
assertEquals (DECRYPTED_DATA_KEY_TRACE , decryptionMaterials .getKeyringTrace ().getEntries ().get (0 ));
212
214
}
213
215
214
- private Keyring newRawKeyring (JceKeyCipher jceKeyCipher , Function <EncryptedDataKey , Boolean > validToDecrypt ,
215
- KeyringTraceEntry encryptTraceEntry , KeyringTraceEntry decryptTraceEntry ) {
216
- return new RawKeyring (KEYNAMESPACE , KEYNAME , jceKeyCipher ) {
217
- @ Override
218
- boolean validToDecrypt (EncryptedDataKey encryptedDataKey ) {
219
- return validToDecrypt .apply (encryptedDataKey );
220
- }
221
-
222
- @ Override
223
- void traceOnEncrypt (KeyringTrace keyringTrace ) {
224
- if (encryptTraceEntry != null ) {
225
- keyringTrace .add (encryptTraceEntry .getKeyNamespace (), encryptTraceEntry .getKeyName (),
226
- encryptTraceEntry .getFlags ().toArray (new KeyringTraceFlag []{}));
227
- }
228
- }
229
-
230
- @ Override
231
- void traceOnDecrypt (KeyringTrace keyringTrace ) {
232
- if (decryptTraceEntry != null ) {
233
- keyringTrace .add (decryptTraceEntry .getKeyNamespace (), decryptTraceEntry .getKeyName (),
234
- decryptTraceEntry .getFlags ().toArray (new KeyringTraceFlag []{}));
235
- }
236
- }
237
- };
238
- }
239
-
240
216
private void assertEncryptedDataKeyEquals (EncryptedDataKey expected , EncryptedDataKey actual ) {
241
217
assertEquals (expected .getProviderId (), actual .getProviderId ());
242
218
assertArrayEquals (expected .getProviderInformation (), actual .getProviderInformation ());
0 commit comments