28
28
import static com .amazonaws .encryptionsdk .internal .Utils .assertNonNull ;
29
29
30
30
/*
31
- This is a copy-paste of the DefaultCryptoMaterialsManager implementation
32
- from the final commit of the V2 ESDK: 1870a082358d59e32c60d74116d6f43c0efa466b
33
- ESDK V3 implicitly changed the contract between CMMs and the ESDK.
34
- After V3, DecryptMaterials has an `encryptionContext` attribute,
35
- and CMMs are expected to set this attribute.
36
- The V3 commit modified this DefaultCMM's `decryptMaterials` implementation
37
- to set encryptionContext on returned DecryptionMaterials objects.
38
- However, there are custom implementations of the legacy native CMM
39
- that do not set encryptionContext.
40
- This CMM is used to explicitly assert that the V2 implementation of
41
- the DefaultCMM is compatible with V3 logic,
42
- which implicitly asserts that custom implementations of V2-compatible CMMs
43
- are also compatible with V3 logic.
44
- */
31
+ This is a copy-paste of the DefaultCryptoMaterialsManager implementation
32
+ from the final commit of the V2 ESDK: 1870a082358d59e32c60d74116d6f43c0efa466b
33
+ ESDK V3 implicitly changed the contract between CMMs and the ESDK.
34
+ After V3, DecryptMaterials has an `encryptionContext` attribute,
35
+ and CMMs are expected to set this attribute.
36
+ The V3 commit modified this DefaultCMM's `decryptMaterials` implementation
37
+ to set encryptionContext on returned DecryptionMaterials objects.
38
+ However, there are custom implementations of the legacy native CMM
39
+ that do not set encryptionContext.
40
+ This CMM is used to explicitly assert that the V2 implementation of
41
+ the DefaultCMM is compatible with V3 logic,
42
+ which implicitly asserts that custom implementations of V2-compatible CMMs
43
+ are also compatible with V3 logic.
44
+ */
45
45
public class V2DefaultCryptoMaterialsManager implements CryptoMaterialsManager {
46
46
private final MasterKeyProvider <?> mkp ;
47
47
48
48
private final CryptoAlgorithm DEFAULT_CRYPTO_ALGORITHM =
49
- CryptoAlgorithm .ALG_AES_256_GCM_IV12_TAG16_HKDF_SHA384_ECDSA_P384 ;
49
+ CryptoAlgorithm .ALG_AES_256_GCM_IV12_TAG16_HKDF_SHA384_ECDSA_P384 ;
50
50
51
- /** @param mkp The master key provider to delegate to */
51
+ /**
52
+ * @param mkp The master key provider to delegate to
53
+ */
52
54
public V2DefaultCryptoMaterialsManager (MasterKeyProvider <?> mkp ) {
53
55
assertNonNull (mkp , "mkp" );
54
56
this .mkp = mkp ;
@@ -73,7 +75,7 @@ public EncryptionMaterials getMaterialsForEncrypt(EncryptionMaterialsRequest req
73
75
trailingKeys = generateTrailingSigKeyPair (algo );
74
76
if (context .containsKey (Constants .EC_PUBLIC_KEY_FIELD )) {
75
77
throw new IllegalArgumentException (
76
- "EncryptionContext contains reserved field " + Constants .EC_PUBLIC_KEY_FIELD );
78
+ "EncryptionContext contains reserved field " + Constants .EC_PUBLIC_KEY_FIELD );
77
79
}
78
80
// make mutable
79
81
context = new HashMap <>(context );
@@ -95,8 +97,8 @@ public EncryptionMaterials getMaterialsForEncrypt(EncryptionMaterialsRequest req
95
97
96
98
@ SuppressWarnings ("unchecked" )
97
99
final List <MasterKey > mks =
98
- (List <MasterKey >)
99
- assertNonNull (mkp , "provider" ).getMasterKeysForEncryption (mkRequestBuilder .build ());
100
+ (List <MasterKey >)
101
+ assertNonNull (mkp , "provider" ).getMasterKeysForEncryption (mkRequestBuilder .build ());
100
102
101
103
if (mks .isEmpty ()) {
102
104
throw new IllegalArgumentException ("No master keys provided" );
@@ -114,20 +116,20 @@ public EncryptionMaterials getMaterialsForEncrypt(EncryptionMaterialsRequest req
114
116
115
117
//noinspection unchecked
116
118
return EncryptionMaterials .newBuilder ()
117
- .setAlgorithm (algo )
118
- .setCleartextDataKey (dataKey .getKey ())
119
- .setEncryptedDataKeys (keyBlobs )
120
- .setEncryptionContext (context )
121
- .setTrailingSignatureKey (trailingKeys == null ? null : trailingKeys .getPrivate ())
122
- .setMasterKeys (mks )
123
- .build ();
119
+ .setAlgorithm (algo )
120
+ .setCleartextDataKey (dataKey .getKey ())
121
+ .setEncryptedDataKeys (keyBlobs )
122
+ .setEncryptionContext (context )
123
+ .setTrailingSignatureKey (trailingKeys == null ? null : trailingKeys .getPrivate ())
124
+ .setMasterKeys (mks )
125
+ .build ();
124
126
}
125
127
126
128
@ Override
127
129
public DecryptionMaterials decryptMaterials (DecryptionMaterialsRequest request ) {
128
130
DataKey <?> dataKey =
129
- mkp .decryptDataKey (
130
- request .getAlgorithm (), request .getEncryptedDataKeys (), request .getEncryptionContext ());
131
+ mkp .decryptDataKey (
132
+ request .getAlgorithm (), request .getEncryptedDataKeys (), request .getEncryptionContext ());
131
133
132
134
if (dataKey == null ) {
133
135
throw new CannotUnwrapDataKeyException ("Could not decrypt any data keys" );
@@ -151,9 +153,9 @@ public DecryptionMaterials decryptMaterials(DecryptionMaterialsRequest request)
151
153
}
152
154
153
155
return DecryptionMaterials .newBuilder ()
154
- .setDataKey (dataKey )
155
- .setTrailingSignatureKey (pubKey )
156
- .build ();
156
+ .setDataKey (dataKey )
157
+ .setTrailingSignatureKey (pubKey )
158
+ .build ();
157
159
}
158
160
159
161
private PublicKey deserializeTrailingKeyFromEc (CryptoAlgorithm algo , String pubKey ) {
@@ -162,11 +164,11 @@ private PublicKey deserializeTrailingKeyFromEc(CryptoAlgorithm algo, String pubK
162
164
163
165
private static String serializeTrailingKeyForEc (CryptoAlgorithm algo , KeyPair trailingKeys ) {
164
166
return TrailingSignatureAlgorithm .forCryptoAlgorithm (algo )
165
- .serializePublicKey (trailingKeys .getPublic ());
167
+ .serializePublicKey (trailingKeys .getPublic ());
166
168
}
167
169
168
170
private static KeyPair generateTrailingSigKeyPair (CryptoAlgorithm algo )
169
- throws GeneralSecurityException {
171
+ throws GeneralSecurityException {
170
172
return TrailingSignatureAlgorithm .forCryptoAlgorithm (algo ).generateKey ();
171
173
}
172
174
}
0 commit comments