|
|||||||||
PREV CLASS NEXT CLASS | FRAMES NO FRAMES | ||||||||
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD |
java.lang.Objectiaik.cms.RecipientInfo
iaik.cms.KeyTransRecipientInfo
public class KeyTransRecipientInfo
This class implements the CMS KeyTransRecipientInfo
type.
The Cryptographic Message Syntax (CMS) (RFC 5652)
specifies the KeyTransRecipientInfo
type as RecipientInfo
choice for collecting all recipient-related information about some
particular recipient a CMS EnvelopedData
or CMS
AuthenticatedData
object shall be sent to when the recipient
has a public key to be used for encrypting the secret content-encryption key:
KeyTransRecipientInfo ::= SEQUENCE { version CMSVersion, -- always set to 0 or 2 rid RecipientIdentifier, keyEncryptionAlgorithm KeyEncryptionAlgorithmIdentifier, encryptedKey EncryptedKey }
EncryptedKey ::= OCTET STRING
RecipientIdentifier ::= CHOICE { issuerAndSerialNumber IssuerAndSerialNumber, subjectKeyIdentifier [0] SubjectKeyIdentifier }
The recipientIdentifier
field specifies the recipient
certificate (and thereby public key) by issuer distinguished name and
issuer-specific serial number or SubjectKeyIdentifier.
The keyEncryptionAlgorithm
identifies the public-key algorithm
used for encrypting the randomly generated content-encryption key with
a recipient-specific public key. The encrypted content-encryption
key (used for encrypting the content) is stored in the encryptedKey
field.
This class provides several constructors and methods for creating a
KeyTransRecipientInfo
object, obtaining the component values,
and encrypting (respectively decrypting) the content-encryption key.
When creating a new KeyTransRecipientInfo you immediately may supply
the
IssuerAndSerialNumber
or SubjectKeyIdentifier
or you may supply
the
certificate of the recipient to let this class create a certifcate
identifier for it, e.g:
// the cert of the recipient: X509Certificate recipientCert = ...; // use RSA for content key encryption: AlgorithmID kea = (AlgorithmID)AlgorithmID.rsaEncryption.clone(); // create a v0 KeyTransRecipientInfo using an IssuerAndSerialNumber to point to the recipient cert: KeyTransRecipientInfo recipient = new KeyTransRecipientInfo(recipientCert, kea);If you want to use a
SubjectKeyIdentifier
for
pointing to the certificate of the recipient, you have to specify the
CertificateIdentifier
type when
creating
the KeyTransRecipientInfo:
KeyTransRecipientInfo recipient = new KeyTransRecipientInfo(recipientCert, CertificateIdentifier.SUBJECT_KEY_IDENTIFIER, kea);The following example shows the typical usage for including a KEKRecipientInfo into a EnvelopedData object, encoding it, decoding it at the recipient side and decrypt the content (we use the stream-based EnvelopedData implementation for this sample):
// the cert of the recipient: X509Certificate recipientCert = ...; // use RSA for content key encryption: AlgorithmID kea = (AlgorithmID)AlgorithmID.rsaEncryption.clone(); // create a v0 KeyTransRecipientInfo using an IssuerAndSerialNumber to point to the recipient cert: KeyTransRecipientInfo recipient = new KeyTransRecipientInfo(recipientCert, kea); // create an EnvelopedData for the content to be encrypted: EnvelopedDataStream envelopedData = new EnvelopedDataStream(is, (AlgorithmID)AlgorithmID.aes256_CBC.clone()); // add the recipient information: envelopedData.addRecipientInfo(recipient); // write the EnvelopedData to a stream thereby performing the content encryption: int blockSize = ...; OutputStream encoded_stream = ...; envelopedData.writeTo(encoded_stream, blockSize); ... // on the recipient side decode the EnvelopedData: InputStream encodedStream = ...; EnvelopedDataStream envelopedData = new EnvelopedData(encodedStream); // Get information about the inherent EncryptedContentInfo: EncryptedContentInfoStream eci = (EncryptedContentInfoStream)enveloped_data.getEncryptedContentInfo(); System.out.println("Content type: "+eci.getContentType().getName()); System.out.println("Content encryption algorithm: "+eci.getContentEncryptionAlgorithm().getName()); // setup the cipher for decryption: envelopedData.setupCipher(recipientPrivateKey, recipientCert); // read the content thereby performing the content decryption: InputStream data_is = enveloped_data.getInputStream(); byte[] buf = new byte[2048]; int r; while ((r = data_is.read(buf)) > 0) { // do something useful }
IssuerAndSerialNumber
,
SubjectKeyID
,
RecipientInfo
Field Summary |
---|
Fields inherited from class iaik.cms.RecipientInfo |
---|
KEK_RECIPIENT_INFO, KEY_AGREE_RECIPIENT_INFO, KEY_TRANSPORT_RECIPIENT_INFO, keyEncryptionAlgorithm_, OTHER_RECIPIENT_INFO, PASSWORD_RECIPIENT_INFO, securityProvider_, version_ |
Constructor Summary | |
---|---|
KeyTransRecipientInfo()
Default Constructor. |
|
KeyTransRecipientInfo(ASN1Object obj)
Creates a KeyTransRecipientInfo from an ASN1Object. |
|
KeyTransRecipientInfo(CertificateIdentifier recipientIdentifier,
AlgorithmID keyEA,
byte[] encryptedKey)
Creates a KeyTransRecipientInfo object for the given
recipient certificate identifier, key-encryption algorithm, and already
encrypted content encryption key. |
|
KeyTransRecipientInfo(CertificateIdentifier recipientIdentifier,
AlgorithmID keyEA,
java.security.PublicKey recipientKey)
Creates a KeyTransRecipientInfo object for the given
recipient certificate identifier, key-encryption algorithm and public
key of the recipient. |
|
KeyTransRecipientInfo(X509Certificate recipientCertificate,
AlgorithmID keyEA)
Creates a version 0 KeyTransRecipientInfo object from the given recipient certificate. |
|
KeyTransRecipientInfo(X509Certificate recipientCertificate,
int ridType,
AlgorithmID keyEA)
Creates a KeyTransRecipientInfo object from the given recipient certificate. |
Method Summary | |
---|---|
void |
decode(ASN1Object obj)
Decodes the given ASN.1 KeyTransRecipientInfo object for parsing
the internal structure. |
javax.crypto.SecretKey |
decryptKey(java.security.Key privateKey,
KeyIdentifier recipientIdentifier,
java.lang.String cekAlgName)
Uses the given private key to decrypt the encrypted content-encryption key. |
void |
encryptKey(javax.crypto.SecretKey cek)
Encrypts the given secret content-encryption key. |
byte[] |
getEncryptedKey()
Returns the encrypted content-encryption key. |
byte[] |
getEncryptedKey(KeyIdentifier recipientIdentifier)
Returns the encrypted content-encryption key for the recipient with the given keyIdentfier. |
KeyIdentifier[] |
getRecipientIdentifiers()
Gets the key identifier belonging to the recipient of this KeyTransRecipientInfo. |
java.security.PublicKey |
getRecipientKey()
Gets the public key of the recipient. |
boolean |
isRecipientInfoFor(KeyIdentifier recipientIdentifier)
Checks if this is a RecipientInfo for the recipient identified by the given key identifier. |
CertificateIdentifier |
isRecipientInfoFor(X509Certificate recipientCertificate)
Checks if this is a RecipientInfo for the given recipient certificate. |
void |
setEncryptedKey(byte[] encryptedKey)
Sets the encrypted content-encryption key. |
ASN1Object |
toASN1Object()
Returns this KeyTransRecipientInfo as ASN1Object. |
java.lang.String |
toString()
Returns a string giving some information about this KeyTransRecipientInfo object. |
Methods inherited from class iaik.cms.RecipientInfo |
---|
createRecipientInfos, decryptKey, decryptKey, decryptKey, getKeyEncryptionAlgorithm, getRecipientInfoType, getSecurityProvider, getVersion, parseRecipientInfo, parseRecipientInfo, parseRecipientInfo, parseRecipientInfo, parseRecipientInfos, parseRecipientInfos, setSecurityProvider |
Methods inherited from class java.lang.Object |
---|
clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait |
Constructor Detail |
---|
public KeyTransRecipientInfo()
KeyTransRecipientInfo
object and sets the version number to 0.
public KeyTransRecipientInfo(CertificateIdentifier recipientIdentifier, AlgorithmID keyEA, byte[] encryptedKey)
KeyTransRecipientInfo
object for the given
recipient certificate identifier, key-encryption algorithm, and already
encrypted content encryption key. The already encrypted secret key
is supplied in a byte array and has been encrypted using the given
key-encryption algorithm.
recipientIdentifier
- the CertificateIdentifier identifying the
recipient certificate (by IssuerAndSerialNumber
or SubjectKeyIdentifier
keyEA
- the ID of the key-encryption algorithm that has been
used for encrypting the content-encryption keyencryptedKey
- the already encrypted secret keypublic KeyTransRecipientInfo(CertificateIdentifier recipientIdentifier, AlgorithmID keyEA, java.security.PublicKey recipientKey)
KeyTransRecipientInfo
object for the given
recipient certificate identifier, key-encryption algorithm and public
key of the recipient.
recipientIdentifier
- the CertificateIdentifier identifying the
recipient certificate (by IssuerAndSerialNumber
or SubjectKeyIdentifier
keyEA
- the ID of the key-encryption algorithm to be used
for encrypting the content-encryption keyrecipientKey
- the public key of the recipient to be used for
encrypting the content-encryption key
java.lang.IllegalArgumentException
- if the supplied recipientIdentifier is not a
SubjectKeyID or IssuerAndSerialNumberpublic KeyTransRecipientInfo(X509Certificate recipientCertificate, AlgorithmID keyEA)
From the given certificate an IssuerAndSerialNumber
is created to be used as recipient identifier
for pointing to the certificate of the recipient.
The public key from the given certificate will be used to encrypt the
symmetric content-encryption key with the given key-encryption algorithm
when calling the encryptKey
method.
recipientCertificate
- the certificate of the recipientkeyEA
- the algorithm for encrypting the symmetric content-encryption keypublic KeyTransRecipientInfo(X509Certificate recipientCertificate, int ridType, AlgorithmID keyEA) throws X509ExtensionException
From the given certificate an IssuerAndSerialNumber
or SubjectKeyIdentifier
(depending on the requested recipient identifier type
) is created to be used as recipient identifier for pointing to the certificate
of the recipient.
The public key from the given certificate will be used to encrypt the
symmetric content-encryption key with the given key-encryption algorithm
when calling the encryptKey
method.
recipientCertificate
- the certificate of the recipientridType
- the type of the recipientIdentifier, either CertificateIdentifier.ISSUER_AND_SERIALNUMBER
or CertificateIdentifier.SUBJECT_KEY_IDENTIFIER
keyEA
- the algorithm for encrypting the symmetric key
X509ExtensionException
- if a SubjectKeyIdentifier shall be used as
recipientIdentifier, but the given cert does contain the SubjectKeyIdentifier
extension or the SubjectKeyIdentifier extension cannot be parsed
java.lang.IllegalArgumentException
- if the request recipientIdentifier type is
not ISSUER_AND_SERIALNUMBER or SUBJECT_KEY_IDENTIFIERpublic KeyTransRecipientInfo(ASN1Object obj) throws CodingException
KeyTransRecipientInfo
from an ASN1Object.
The ASN1Object supplied to this constructor represents an
already exisiting KeyTransRecipientInfo
object that may
have been created by calling toASN1Object
.
obj
- the KeyTransRecipientInfo
as ASN1Object
CodingException
- if the object can not be parsedMethod Detail |
---|
public void decode(ASN1Object obj) throws CodingException
KeyTransRecipientInfo
object for parsing
the internal structure.
This method internally is called when creating a CMS KeyTransRecipientInfo
object from an already existing KeyTransRecipientInfo
object,
supplied as ASN1Object.
obj
- the CMS KeyTransRecipientInfo as ASN1Object
CodingException
- if the object can not be parsedpublic ASN1Object toASN1Object()
KeyTransRecipientInfo
as ASN1Object.
The ASN1Object returned by this method represents the ASN.1 structure of a KeyTransRecipientInfo:
KeyTransRecipientInfo ::= SEQUENCE { version CMSVersion, -- always set to 0 or 2 rid RecipientIdentifier, keyEncryptionAlgorithm KeyEncryptionAlgorithmIdentifier, encryptedKey EncryptedKey }
EncryptedKey ::= OCTET STRING
RecipientIdentifier ::= CHOICE { issuerAndSerialNumber IssuerAndSerialNumber, subjectKeyIdentifier [0] SubjectKeyIdentifier }
KeyTransRecipientInfo
as ASN1Object.public javax.crypto.SecretKey decryptKey(java.security.Key privateKey, KeyIdentifier recipientIdentifier, java.lang.String cekAlgName) throws CMSException, java.security.InvalidKeyException
SecretKey
.
This method implements the same named method of the abstract parent RecipientInfo
class. Since a KeyTransRecipientInfo only represents one single
recipient the supplied recipientIdentifier may be null
.
decryptKey
in class RecipientInfo
privateKey
- the private key of the recipient to be used for decrypting
the encrypted content-encryption key.recipientIdentifier
- an IssuerAndSerialNumber or SubjectKeyIdentifier
identifying the recipient of this KeyTransRecipientInfocekAlgName
- the name of the content encryption key (e.g. "AES") to be set for the
SecretKey object created by this method
CMSException
- if the key-decryption process fails for some reason (e.g. the
key-encryption algorithm used by this KeyTransRecipientInfo
is not implemented, a padding error occurs,...)
java.security.InvalidKeyException
- if the specified private key is not validpublic void encryptKey(javax.crypto.SecretKey cek) throws CMSException
All information (key encryption algorithm, public key of the recipient) has been supplied when creating this KeyTransRecipientInfo object.
encryptKey
in class RecipientInfo
cek
- the symmetric content-encryption key to encrypt
CMSException
- if the key encryption process fails for some
reason (e.g. the key-encryption algortihm used
by this KeyTransRecipientInfo
is not implemented,
the public key of the recipient is Invalid, a padding
error occurs,...)public KeyIdentifier[] getRecipientIdentifiers()
This method implements the same named method of the abstract parent RecipientInfo
class for returning an identifier of the recipient's certificate (and
thereby public key) by issuer distinguished name and issuer-specific serial number, or
SubjectKeyIdentifier. Since only one recipient is represented by a KeyTransRecipientInfo
the KeyIdentifier
array returned by this method only will contain one
single KeyIdentifier
object.
getRecipientIdentifiers
in class RecipientInfo
KeyIdentifier
array holding an identifier of the recipient's certificate
(and thereby public key) by IssuerAndSerialNumber
or SubjectKeyID
public boolean isRecipientInfoFor(KeyIdentifier recipientIdentifier)
isRecipientInfoFor
in class RecipientInfo
recipientIdentifier
- the key identifier belonging to the recipient
we are searching for
true
if this RecipientInfo belongs to the particular
recipient in mind, false
if notpublic CertificateIdentifier isRecipientInfoFor(X509Certificate recipientCertificate)
isRecipientInfoFor
in class RecipientInfo
recipientCertificate
- the certificate of the recipient
null
if notpublic void setEncryptedKey(byte[] encryptedKey)
encryptedKey
- the encrypted content-encryption keypublic byte[] getEncryptedKey()
public java.security.PublicKey getRecipientKey()
null
if
the recipient key is not setpublic byte[] getEncryptedKey(KeyIdentifier recipientIdentifier) throws CMSException
This method implements the same named method of the abstract parent
RecipientInfo
class for asking if this
KeyTransRecipientInfo holds an encrypted key for the recipient identified
by the given key identifier (IssuerAndSerialNumber or SubjectKeyIdentifier).
Since a KeyTransRecipientInfo only represents one single recipient
the supplied recipientIdentifier may be null
.
getEncryptedKey
in class RecipientInfo
recipientIdentifier
- information to be used for getting the right encrypted content
encryption key for the right recipient; may be not required for a
KeyTransRecipientInfo, but for KeyAgreeRecipientInfo
) which may hold encrypted content encryption
keys for more than one recipient; may be null
for only
getting the encrypted content-encryption key included
CMSException
- if this KeyTransRecipientInfo does not belong to the recipient with
the given key identifier is includedpublic java.lang.String toString()
KeyTransRecipientInfo
object.
toString
in class RecipientInfo
|
This Javadoc may contain text parts from text parts from IETF Internet Standard specifications (see copyright note). | ||||||||
PREV CLASS NEXT CLASS | FRAMES NO FRAMES | ||||||||
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD |