Package anbxj

Class Crypto_EncryptionEngine

java.lang.Object
anbxj.Crypto_EncryptionEngine
public class Crypto_EncryptionEngine extends Object
Cryptographic engine

  • Constructor Details

    • Crypto_EncryptionEngine

      public Crypto_EncryptionEngine(String keypath, String myAlias, Crypto_Config config)
      Constructs an encryption engine that uses keystores located at keypath for the principal identified by myAlias.
      Parameters:
      keypath - the directory containing the keystore files
      myAlias - the alias of the local principal
      config - the cryptographic configuration

    • Crypto_EncryptionEngine

      public Crypto_EncryptionEngine(Crypto_KeyStoreBuilder_Map ksbd)
      Constructor for Crypto_EncryptionEngine.
      Parameters:
      ksbd - The Crypto_KeyStoreBuilder_Map.

    • Crypto_EncryptionEngine

      public Crypto_EncryptionEngine(Crypto_KeyStoreBuilder_Map ksbd, Crypto_Config config)
      Constructor for Crypto_EncryptionEngine.
      Parameters:
      ksbd - The Crypto_KeyStoreBuilder_Map.
      config - The Crypto_Config.

    • Crypto_EncryptionEngine

      public Crypto_EncryptionEngine(Crypto_Config config)
      Constructor for Crypto_EncryptionEngine.
      Parameters:
      config - The Crypto_Config.

  • Method Details

    • getSignatureAlgorithm

      public String getSignatureAlgorithm()
      Returns the signature algorithm name currently configured in the cryptographic engine.

      This algorithm is used as the default for digital signature operations when no algorithm is explicitly specified. It is typically set via the protocol's configuration file (e.g., messageDigestSignatureAlgorithm property) and may be combined with the key's algorithm to form a complete signature algorithm name (e.g., "SHA256withRSA").

      Returns:
      the message digest part of the signature algorithm (e.g., "SHA256"), as defined in the active Crypto_Config.

    • getCryptoConfig

      public Crypto_Config getCryptoConfig()
      Get the crypto configuration
      Returns:
      the cryptographic configuration

    • writeObject

      public static void writeObject(Object obj, String filename)
      Writes an object to a file.
      Parameters:
      obj - The object to write.
      filename - The filename to save the object.

    • readObject

      public static Object readObject(String filename)
      Reads an object from a file.
      Parameters:
      filename - The filename to read the object from.
      Returns:
      The read object.

    • getKeyPair

      public Crypto_KeyPair getKeyPair()
      Generates a key pair.
      Returns:
      The generated key pair.

    • getKeyPair_PublicKey

      public PublicKey getKeyPair_PublicKey(Crypto_KeyPair pair)
      Gets the public key from a key pair.
      Parameters:
      pair - The key pair.
      Returns:
      The public key.

    • checkDigest

      public boolean checkDigest(Object obj, Crypto_ByteArray digest)
      Checks if a given digest matches the calculated digest of an object.
      Parameters:
      obj - The object to check the digest.
      digest - The digest to compare.
      Returns:
      True if the digests match, false otherwise.

    • makeDigest

      public Crypto_ByteArray makeDigest(Object obj)
      Calculates the digest of an object.
      Parameters:
      obj - The object to calculate the digest.
      Returns:
      The calculated digest.

    • makeHmacValue

      public Crypto_ByteArray makeHmacValue(Object obj, SecretKey key)
      Calculates the HMAC value of an object using a secret key.
      Parameters:
      obj - The object to calculate the HMAC value.
      key - The secret key for HMAC.
      Returns:
      The calculated HMAC value.

    • makeHmacRnd

      public Crypto_HmacPair makeHmacRnd(Object obj, SecretKey sk)
      Creates an HMAC pair using a secret key as a randomiser.
      Parameters:
      obj - The object to generate the HMAC pair.
      sk - The secret key for HMAC.
      Returns:
      The generated HMAC pair.

    • makeHmac

      public Crypto_HmacPair makeHmac(Object obj, String alias)
      Creates an HMAC pair using a specified alias.
      Parameters:
      obj - The object to generate the HMAC pair.
      alias - The alias for key generation.
      Returns:
      The generated HMAC pair.

    • checkHmacPair

      public boolean checkHmacPair(Object obj, Crypto_HmacPair hmac)
      Verifies the integrity of an HMAC pair.
      Parameters:
      obj - The object used to compute the original HMAC pair.
      hmac - The HMAC pair to verify.
      Returns:
      True if verification is successful, false otherwise.

    • checkHmacPairRnd

      public boolean checkHmacPairRnd(Object obj, Crypto_HmacPair hmac, SecretKey sk)
      Verifies the integrity of an HMAC pair using a secret key as a randomizer.
      Parameters:
      obj - The object used to compute the original HMAC pair.
      hmac - The HMAC pair to verify.
      sk - The secret key used for randomization.
      Returns:
      True if verification is successful, false otherwise.

    • checkHmacValue

      public boolean checkHmacValue(Object obj, Crypto_ByteArray hmac, SecretKey sk)
      Verifies the integrity of an HMAC value.
      Parameters:
      obj - The object used to compute the original HMAC.
      hmac - The HMAC value to verify.
      sk - The secret key for HMAC.
      Returns:
      True if verification is successful, false otherwise.

    • getSymmetricKeyPBE

      public SecretKey getSymmetricKeyPBE(String password, String salt)
      Generates a symmetric key using a password and salt.
      Parameters:
      password - The password for key generation.
      salt - The salt for key generation.
      Returns:
      The generated symmetric key.

    • getSymmetricKey

      public SecretKey getSymmetricKey(Crypto_KeyMode km)
      Generates a symmetric key
      Parameters:
      km - The key mode for the key generation
      Returns:
      The generated symmetric key.

    • getSymmetricKey

      public SecretKey getSymmetricKey()
      Generates a symmetric key.
      Returns:
      The generated symmetric key.

    • getHmacKey

      public SecretKey getHmacKey()
      Generates a secret key for HMAC.
      Returns:
      The generated HMAC key.

    • decrypt

      public Object decrypt(Crypto_SealedPair sc, Crypto_KeyStoreType pk)
      Decrypts a sealed pair using the provided key store type.
      Parameters:
      sc - The sealed pair to decrypt.
      pk - The key store type to obtain the private key for decryption.
      Returns:
      The decrypted object.

    • decrypt

      public Object decrypt(Crypto_SealedPair sc, Crypto_KeyPair pair)
      Decrypts a sealed pair using the provided key pair.
      Parameters:
      sc - The sealed pair to decrypt.
      pair - The key pair to obtain the private key for decryption.
      Returns:
      The decrypted object.

    • decryptAsymPK

      public Object decryptAsymPK(SealedObject so, PrivateKey privateKey)
      Decrypts a sealed object using the provided private key.
      Parameters:
      so - The sealed object to decrypt.
      privateKey - The private key to use for decryption.
      Returns:
      The decrypted object.

    • decrypt

      public Object decrypt(SealedObject so, SecretKey symmetricKey)
      Decrypts a sealed object using the provided symmetric key.
      Parameters:
      so - The sealed object to decrypt.
      symmetricKey - The symmetric key to use for decryption.
      Returns:
      The decrypted object.

    • encrypt

      public Crypto_SealedPair encrypt(Object object, String alias, Crypto_KeyStoreType pk)
      Encrypts an object with the specified alias and key store type.
      Parameters:
      object - The object to encrypt.
      alias - The alias to identify the public key.
      pk - The key store type to obtain the public key for encryption.
      Returns:
      The sealed pair containing the encrypted object and key.

    • encrypt

      public Crypto_SealedPair encrypt(Object object, PublicKey publicKey)
      Encrypts an object with the provided public key.
      Parameters:
      object - The object to encrypt.
      publicKey - The public key to use for encryption.
      Returns:
      The sealed pair containing the encrypted object and key.

    • encryptCompare

      public Crypto_SealedPair encryptCompare(Object object, String alias, Crypto_KeyStoreType pk)
      Encrypts an object with a symmetric key, and also computes a digest for comparison.
      Parameters:
      object - The object to encrypt.
      alias - The alias to identify the public key.
      pk - The key store type to obtain the public key for encryption.
      Returns:
      The sealed pair containing the encrypted object, key, and digest.

    • encrypt

      public SealedObject encrypt(Object object, SecretKey symmetricKey)
      Encrypts an object with the provided symmetric key and returns the sealed object.
      Parameters:
      object - The object to encrypt.
      symmetricKey - The symmetric key to use for encryption.
      Returns:
      The sealed object.

    • getKeyStoreSettings_Map

      public Crypto_KeyStoreSettings_Map getKeyStoreSettings_Map()
      Retrieves the key store settings map.
      Returns:
      The key store settings map.

    • getLocaleCertificate

      public Certificate getLocaleCertificate(Crypto_KeyStoreType kst)
      Retrieves the local certificate for a specified key store type.
      Parameters:
      kst - The key store type.
      Returns:
      The local certificate for the specified key store type.

    • getLocaleCertificates

      public Map<Crypto_KeyStoreType,Certificate> getLocaleCertificates()
      Retrieves a map of local certificates for different key store types.
      Returns:
      A map containing local certificates for various key store types.

    • getMyAlias

      public String getMyAlias(Crypto_KeyStoreType kst)
      Retrieves the alias associated with a key store type.
      Parameters:
      kst - The key store type.
      Returns:
      The alias associated with the specified key store type.

    • getNonce

      public Crypto_ByteArray getNonce()
      Generates and retrieves a nonce (number used once).
      Returns:
      A Crypto_ByteArray containing the generated nonce.

    • getTimeStamp

      public Instant getTimeStamp()
      Retrieves the current timestamp as an Instant.
      Returns:
      The current timestamp.

    • getRemoteCertificate

      public Certificate getRemoteCertificate(String alias, Crypto_KeyStoreType pk)
      Retrieves the remote certificate associated with a specified alias and key store type.
      Parameters:
      alias - The alias for the remote certificate.
      pk - The key store type.
      Returns:
      The remote certificate for the specified alias and key store type.

    • getRemoteCertificates

      public Map<Crypto_KeyStoreType,Certificate> getRemoteCertificates(String alias)
      Retrieves a map of remote certificates associated with a specified alias.
      Parameters:
      alias - The alias for which remote certificates are retrieved.
      Returns:
      A map containing remote certificates for various key store types.

    • containsAlias

      public boolean containsAlias(String alias)
      Checks if the key store builder contains a specific alias.
      Parameters:
      alias - The alias to check for existence.
      Returns:
      true if the alias exists; otherwise, false.

    • sign

      public SignedObject sign(Object object, Crypto_KeyStoreType sk)
      Signs an object using the private key associated with the specified key store type.
      Parameters:
      object - The object to sign.
      sk - The key store type.
      Returns:
      The SignedObject containing the signed object.

    • sign

      public SignedObject sign(Object object, Crypto_KeyPair kp)
      Signs an object using the private key from the provided key pair.
      Parameters:
      object - The object to sign.
      kp - The key pair containing the private key.
      Returns:
      The SignedObject containing the signed object.

    • getPublicKey

      public PublicKey getPublicKey(String alias, Crypto_KeyStoreType pk)
      Retrieves the public key associated with the specified alias and key store type.
      Parameters:
      alias - The alias for the remote public key.
      pk - The key store type.
      Returns:
      The remote public key for the specified alias and key store type.

    • verify

      public Object verify(SignedObject so, String alias, Crypto_KeyStoreType sk)
      Verifies a SignedObject using the public key associated with the specified alias and key store type.
      Parameters:
      so - The SignedObject to verify.
      alias - The alias for the remote public key.
      sk - The key store type.
      Returns:
      The verified object or null if verification fails.

    • verify

      public Object verify(SignedObject so, PublicKey publicKey)
      Verifies a SignedObject using the provided public key.
      Parameters:
      so - The SignedObject to verify.
      publicKey - The public key used for verification.
      Returns:
      The verified object or null if verification fails.

    • getKeyEx_KeyPair

      public KeyPair getKeyEx_KeyPair()
      Generates a key pair for key exchange based on the configured key agreement algorithm.
      Returns:
      KeyPair object containing public and private keys.

    • getKeyEx_PublicKey

      public PublicKey getKeyEx_PublicKey(KeyPair keyPair)
      Retrieves the public key from a key pair generated for key exchange.
      Parameters:
      keyPair - The KeyPair containing public and private keys.
      Returns:
      PublicKey object representing the public key.

    • getKeyEx_SecretKey

      public SecretKey getKeyEx_SecretKey(PublicKey publicKey, KeyPair keyPair)
      Retrieves the secret key for key exchange based on the public and private keys.
      Parameters:
      publicKey - The PublicKey of the other party.
      keyPair - The KeyPair containing the private key.
      Returns:
      SecretKey object representing the shared secret key.

    • getTSA_CertPath

      public CertPath getTSA_CertPath()
      Gets the TSA CertPath.
      Returns:
      The CertPath representing the TSA CertPath.

    • setTSA_CertPath

      public void setTSA_CertPath()
      Sets the TSA CertPath by retrieving it from the KeyStoreBuilder.

    • setTSA_CertPath

      public void setTSA_CertPath(CertPath tSA_CertPath)
      Sets the TSA CertPath.
      Parameters:
      tSA_CertPath - The CertPath to set as the TSA CertPath.

    • getInfo

      public static void getInfo()
      Displays information about available providers and algorithms.

    • xor

      public Crypto_ByteArray xor(Crypto_ByteArray x1, Crypto_ByteArray x2)
      Performs bitwise XOR on two Crypto_ByteArrays and returns the result.
      Parameters:
      x1 - The first Crypto_ByteArray.
      x2 - The second Crypto_ByteArray.
      Returns:
      A new Crypto_ByteArray representing the result of the XOR operation.

    • verifyRaw

      public boolean verifyRaw(byte[] data, byte[] signature, String alias) throws GeneralSecurityException
      Verifies a raw signature against the given data using the public key associated with the specified alias (from the signature keystore).
      Parameters:
      data - the original data bytes (must not be null)
      signature - the signature bytes to verify (must not be null)
      alias - the alias of the signer (must not be null)
      Returns:
      true if the signature is valid, false otherwise
      Throws:
      GeneralSecurityException - if the verification operation fails
      NullPointerException - if any argument is null

    • verifyRaw

      public boolean verifyRaw(byte[] data, byte[] signature, PublicKey publicKey) throws GeneralSecurityException
      Verifies a raw signature against the given data using the provided public key.
      Parameters:
      data - the original data bytes (must not be null)
      signature - the signature bytes to verify (must not be null)
      publicKey - the public key to verify the signature (must not be null)
      Returns:
      true if the signature is valid, false otherwise
      Throws:
      GeneralSecurityException - if the verification operation fails
      NullPointerException - if any argument is null

    • unsealRaw

      public byte[] unsealRaw(AnBx_WireFormats.SealedMessage sealedMsg) throws GeneralSecurityException
      Unseals (decrypts) a AnBx_WireFormats.SealedMessage using the local private key (from the encryption keystore Crypto_KeyStoreType.pk()).
      1. Decrypts the symmetric key using the local private key.
      2. Decrypts the message symmetrically with the recovered key.
      Parameters:
      sealedMsg - the sealed message wrapper (must not be null)
      Returns:
      the decrypted plaintext bytes
      Throws:
      GeneralSecurityException - if decryption fails (e.g., corrupted ciphertext)
      NullPointerException - if sealedMsg is null

    • encryptRaw

      public byte[] encryptRaw(byte[] plaintext, SecretKey key) throws GeneralSecurityException
      Encrypts the given plaintext using the provided symmetric key.

      The cipher transformation and parameters (including IV) are determined automatically from the key's algorithm and the configuration. The IV (if any) is prepended to the ciphertext as:

      1. 1 byte - IV length (0-255)
      2. IV bytes
      3. actual ciphertext
      If the cipher does not use an IV, the length byte is 0 and no IV bytes follow.
      Parameters:
      plaintext - the raw bytes to encrypt (must not be null)
      key - the symmetric encryption key (must not be null)
      Returns:
      the combined IV + ciphertext bytes
      Throws:
      GeneralSecurityException - if encryption fails
      NullPointerException - if any argument is null

    • decryptRaw

      public byte[] decryptRaw(byte[] ciphertext, SecretKey key) throws GeneralSecurityException
      Decrypts the given ciphertext (produced by encryptRaw(byte[], SecretKey)) using the provided symmetric key.

      The format expected is:

      1. 1 byte - IV length (0-255)
      2. IV bytes (if length > 0)
      3. actual ciphertext
      The IV is extracted and used to initialise the cipher for decryption.
      Parameters:
      ciphertext - the combined IV + ciphertext bytes (must not be null)
      key - the symmetric decryption key (must not be null)
      Returns:
      the decrypted plaintext bytes
      Throws:
      GeneralSecurityException - if decryption fails (e.g., wrong key, corrupted data)
      NullPointerException - if any argument is null

    • hmacRaw

      public byte[] hmacRaw(byte[] data, SecretKey key) throws GeneralSecurityException
      Computes an HMAC (keyed-hash message authentication code) over the given data using the provided secret key.

      The HMAC algorithm is taken from the cryptographic configuration (hMacAlgorithm). This method is intended for raw byte-based HMAC operations in typed Protobuf mode.

      Parameters:
      data - the data to authenticate (must not be null)
      key - the HMAC secret key (must not be null)
      Returns:
      the HMAC value (raw bytes)
      Throws:
      GeneralSecurityException - if HMAC computation fails
      NullPointerException - if any argument is null