@@ -101,9 +101,8 @@ public void authenticatedEncryption_CustomerManagedKey() throws NoSuchAlgorithmE
101
101
* MAC. Instead we use AES/CTR, an unauthenticated encryption algorithm. If {@link CryptoMode#StrictAuthenticatedEncryption}
102
102
* is enabled, ranged GETs will not be allowed since they do not use authenticated encryption..
103
103
*/
104
- // snippet-start:[s3.java1.s3_encrypt.strict_authenticated_encryption]
104
+
105
105
public void authenticatedEncryption_RangeGet_CustomerManagedKey () throws NoSuchAlgorithmException {
106
- // snippet-start:[s3.java1.s3_encrypt.strict_authenticated_encryption_build]
107
106
SecretKey secretKey = KeyGenerator .getInstance ("AES" ).generateKey ();
108
107
AmazonS3Encryption s3Encryption = AmazonS3EncryptionClientBuilder
109
108
.standard ()
@@ -113,14 +112,13 @@ public void authenticatedEncryption_RangeGet_CustomerManagedKey() throws NoSuchA
113
112
.build ();
114
113
115
114
AmazonS3 s3NonEncrypt = AmazonS3ClientBuilder .defaultClient ();
116
- // snippet-end:[s3.java1.s3_encrypt.strict_authenticated_encryption_build]
117
115
118
116
s3Encryption .putObject (BUCKET_NAME , ENCRYPTED_KEY , "some contents" );
119
117
s3NonEncrypt .putObject (BUCKET_NAME , NON_ENCRYPTED_KEY , "some other contents" );
120
118
System .out .println (s3Encryption .getObjectAsString (BUCKET_NAME , ENCRYPTED_KEY ));
121
119
System .out .println (s3Encryption .getObjectAsString (BUCKET_NAME , NON_ENCRYPTED_KEY ));
122
120
}
123
- // snippet-end:[s3.java1.s3_encrypt.strict_authenticated_encryption]
121
+
124
122
125
123
/**
126
124
* Same as {@link #authenticatedEncryption_CustomerManagedKey()} except uses an asymmetric key pair and
@@ -148,7 +146,9 @@ public void authenticatedEncryption_CustomerManagedAsymmetricKey() throws NoSuch
148
146
* {@link #authenticatedEncryption_CustomerManagedKey()} is that attempting to retrieve an object non
149
147
* encrypted with AES/GCM will thrown an exception instead of falling back to encryption only or plaintext GET.
150
148
*/
149
+ // snippet-start:[s3.java1.s3_encrypt.strict_authenticated_encryption]
151
150
public void strictAuthenticatedEncryption_CustomerManagedKey () throws NoSuchAlgorithmException {
151
+ // snippet-start:[s3.java1.s3_encrypt.strict_authenticated_encryption_build]
152
152
SecretKey secretKey = KeyGenerator .getInstance ("AES" ).generateKey ();
153
153
AmazonS3Encryption s3Encryption = AmazonS3EncryptionClientBuilder
154
154
.standard ()
@@ -158,6 +158,7 @@ public void strictAuthenticatedEncryption_CustomerManagedKey() throws NoSuchAlgo
158
158
.build ();
159
159
160
160
AmazonS3 s3NonEncrypt = AmazonS3ClientBuilder .defaultClient ();
161
+ // snippet-end:[s3.java1.s3_encrypt.strict_authenticated_encryption_build]
161
162
162
163
s3Encryption .putObject (BUCKET_NAME , ENCRYPTED_KEY , "some contents" );
163
164
s3NonEncrypt .putObject (BUCKET_NAME , NON_ENCRYPTED_KEY , "some other contents" );
@@ -169,6 +170,7 @@ public void strictAuthenticatedEncryption_CustomerManagedKey() throws NoSuchAlgo
169
170
System .err .println (NON_ENCRYPTED_KEY + " was not encrypted with AES/GCM" );
170
171
}
171
172
}
173
+ // snippet-end:[s3.java1.s3_encrypt.strict_authenticated_encryption]
172
174
173
175
/**
174
176
* Strict authenticated encryption mode does not support ranged GETs. This is because we must use AES/CTR for ranged
@@ -292,7 +294,9 @@ public void encryptionOnly_KmsManagedKey() throws NoSuchAlgorithmException {
292
294
/**
293
295
* This uses the V2 metadata schema with a key wrap algorithm of 'kms' and a CEK algorithm of AES/GCM/NoPadding.
294
296
*/
297
+ // snippet-start:[s3.java1.s3_encrypt.kms_authenticated_encryption]
295
298
public void authenticatedEncryption_KmsManagedKey () throws NoSuchAlgorithmException {
299
+ // snippet-start:[s3.java1.s3_encrypt.kms_authenticated_encryption_builder]
296
300
AmazonS3Encryption s3Encryption = AmazonS3EncryptionClientBuilder
297
301
.standard ()
298
302
.withRegion (Regions .US_WEST_2 )
@@ -302,20 +306,24 @@ public void authenticatedEncryption_KmsManagedKey() throws NoSuchAlgorithmExcept
302
306
.build ();
303
307
304
308
AmazonS3 s3NonEncrypt = AmazonS3ClientBuilder .defaultClient ();
309
+ // snippet-end:[s3.java1.s3_encrypt.kms_authenticated_encryption_builder]
305
310
311
+ // snippet-start:[s3.java1.s3_encrypt.kms_authenticated_encryption_put_object]
306
312
s3Encryption .putObject (BUCKET_NAME , ENCRYPTED_KEY , "some contents" );
307
313
s3NonEncrypt .putObject (BUCKET_NAME , NON_ENCRYPTED_KEY , "some other contents" );
308
314
System .out .println (s3Encryption .getObjectAsString (BUCKET_NAME , ENCRYPTED_KEY ));
309
315
System .out .println (s3Encryption .getObjectAsString (BUCKET_NAME , NON_ENCRYPTED_KEY ));
316
+ // snippet-end:[s3.java1.s3_encrypt.kms_authenticated_encryption_put_object]
310
317
}
318
+ // snippet-end:[s3.java1.s3_encrypt.kms_authenticated_encryption]
311
319
312
320
/**
313
321
* Same as authenticatedEncryption_KmsManagedKey except throws an exception when trying to get objects not encrypted with
314
322
* AES/GCM.
315
323
*/
316
- // snippet-start:[s3.java1.s3_encrypt.kms_authenticated_encryption ]
324
+ // snippet-start:[s3.java1.s3_encrypt.kms_authenticated_encryption_strict ]
317
325
public void strictAuthenticatedEncryption_KmsManagedKey () throws NoSuchAlgorithmException {
318
- // snippet-start:[s3.java1.s3_encrypt.kms_authenticated_encryption_builder ]
326
+ // snippet-start:[s3.java1.s3_encrypt.kms_authenticated_encryption_strict_builder ]
319
327
AmazonS3Encryption s3Encryption = AmazonS3EncryptionClientBuilder
320
328
.standard ()
321
329
.withRegion (Regions .US_WEST_2 )
@@ -325,23 +333,23 @@ public void strictAuthenticatedEncryption_KmsManagedKey() throws NoSuchAlgorithm
325
333
.build ();
326
334
327
335
AmazonS3 s3NonEncrypt = AmazonS3ClientBuilder .defaultClient ();
328
- // snippet-end:[s3.java1.s3_encrypt.kms_authenticated_encryption_builder ]
336
+ // snippet-end:[s3.java1.s3_encrypt.kms_authenticated_encryption_strict_builder ]
329
337
330
- // snippet-start:[s3.java1.s3_encrypt.kms_authenticated_encryption_put_object ]
338
+ // snippet-start:[s3.java1.s3_encrypt.kms_authenticated_encryption_strict_put_object ]
331
339
s3Encryption .putObject (BUCKET_NAME , ENCRYPTED_KEY , "some contents" );
332
340
s3NonEncrypt .putObject (BUCKET_NAME , NON_ENCRYPTED_KEY , "some other contents" );
333
- // snippet-end:[s3.java1.s3_encrypt.kms_authenticated_encryption_put_object ]
334
- // snippet-start:[s3.java1.s3_encrypt.kms_authenticated_encryption_exception ]
341
+ // snippet-end:[s3.java1.s3_encrypt.kms_authenticated_encryption_strict_put_object ]
342
+ // snippet-start:[s3.java1.s3_encrypt.kms_authenticated_encryption_strict_exception ]
335
343
try {
336
344
s3Encryption .getObjectAsString (BUCKET_NAME , NON_ENCRYPTED_KEY );
337
345
} catch (SecurityException e ) {
338
346
// Strict authenticated encryption will throw an exception if an object is not encrypted with AES/GCM
339
347
System .err .println (NON_ENCRYPTED_KEY + " was not encrypted with AES/GCM" );
340
348
}
341
349
342
- // snippet-end:[s3.java1.s3_encrypt.kms_authenticated_encryption_exception ]
350
+ // snippet-end:[s3.java1.s3_encrypt.kms_authenticated_encryption_strict_exception ]
343
351
}
344
- // snippet-end:[s3.java1.s3_encrypt.kms_authenticated_encryption ]
352
+ // snippet-end:[s3.java1.s3_encrypt.kms_authenticated_encryption_strict ]
345
353
346
354
}
347
355
// snippet-end:[s3.java1.s3_encrypt.complete]
0 commit comments