Package org.forgerock.json.jose.jwe.handlers.encryption

Class RSAEncryptionHandler

java.lang.Object
org.forgerock.json.jose.jwe.handlers.encryption.RSAEncryptionHandler
All Implemented Interfaces:
EncryptionHandler
public final class RSAEncryptionHandler extends Object implements EncryptionHandler
Abstract base class for implementations of the RSAES-PKCS1-v1_5 and RSA-OAEP encryption schemes.
See Also:

  • Constructor Summary

    Constructors
    Constructor
    Description
    RSAEncryptionHandler(EncryptionMethod encryptionMethod, JweAlgorithm jweAlgorithm)
    Constructs a new RSAEncryptionHandler instance.

  • Method Summary

    Modifier and Type
    Method
    Description
    byte[]
    decryptCiphertext(Key contentEncryptionKey, byte[] initialisationVector, byte[] ciphertext, byte[] authenticationTag, byte[] additionalAuthenticatedData)
    Decrypts the ciphertext with the Content Encryption Key, using the initialisation vector and additional authenticated data, following the steps defined by the EncryptionHandler JweAlgorithm.
    Key
    decryptContentEncryptionKey(Key key, byte[] encryptedContentEncryptionKey)
    Decrypts the JWE Encrypted Key to produce the Content Encryption Key (CEK).
    JweEncryption
    encryptPlaintext(Key contentEncryptionKey, byte[] initialisationVector, byte[] plaintext, byte[] additionalAuthenticatedData)
    Encrypts the plaintext with the Content Encryption Key, using the initialisation vector and additional authenticated data, following the steps defined by the EncryptionHandler JweAlgorithm.
    byte[]
    generateInitialisationVector()
    Generates a random JWE Initialisation Vector of the correct size for the encryption algorithm.
    byte[]
    generateJWEEncryptedKey(Key key, Key contentEncryptionKey)
    Generates the JWE Encrypted Key by encrypting the Content Encryption Key (CEK) using the JweAlgorithm RSAES_PCKCS1_V1_5.
    Key
    getContentEncryptionKey()
    Creates a Content Encryption Key (CEK) by generating a random key value with a length equal to the EncryptionMethod A128CBC_HS256 key size.

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Constructor Details

    • RSAEncryptionHandler

      public RSAEncryptionHandler(EncryptionMethod encryptionMethod, JweAlgorithm jweAlgorithm)
      Constructs a new RSAEncryptionHandler instance.
      Parameters:
      encryptionMethod - the content encryption method. Must not be null.
      jweAlgorithm - the JWE algorithm. Must not be null. Must be an RSA encryption algorithm.

  • Method Details

    • getContentEncryptionKey

      public Key getContentEncryptionKey()
      Creates a Content Encryption Key (CEK) by generating a random key value with a length equal to the EncryptionMethod A128CBC_HS256 key size.

      See point 2 in Section 5.1 of the JWE Specification.

      Specified by:
      getContentEncryptionKey in interface EncryptionHandler
      Returns:
      The Content Encryption Key or null if the shared key should be used directly.

    • generateJWEEncryptedKey

      public byte[] generateJWEEncryptedKey(Key key, Key contentEncryptionKey)
      Generates the JWE Encrypted Key by encrypting the Content Encryption Key (CEK) using the JweAlgorithm RSAES_PCKCS1_V1_5.

      See point 4 in Section 5.1 of the JWE Specification.

      Specified by:
      generateJWEEncryptedKey in interface EncryptionHandler
      Parameters:
      key - The key to use to encrypt the Content Encryption Key, if the EncryptionHandler JweAlgorithm requires.
      contentEncryptionKey - The Content Encryption Key (CEK).
      Returns:
      A byte array of the JWE Encrypted Key.

    • generateInitialisationVector

      public byte[] generateInitialisationVector()
      Generates a random JWE Initialisation Vector of the correct size for the encryption algorithm.

      See points 9 in Section 5.1 of the JWE Specification.

      Specified by:
      generateInitialisationVector in interface EncryptionHandler
      Returns:
      The Initialisation Vector.

    • encryptPlaintext

      public JweEncryption encryptPlaintext(Key contentEncryptionKey, byte[] initialisationVector, byte[] plaintext, byte[] additionalAuthenticatedData)
      Encrypts the plaintext with the Content Encryption Key, using the initialisation vector and additional authenticated data, following the steps defined by the EncryptionHandler JweAlgorithm.

      See points 15, 16 in Section 5.1 of the JWE Specification.

      Specified by:
      encryptPlaintext in interface EncryptionHandler
      Parameters:
      contentEncryptionKey - The Content Encryption Key.
      initialisationVector - The Initialisation Vector.
      plaintext - The plaintext to encrypt.
      additionalAuthenticatedData - An array of bytes representing the additional authenticated data.
      Returns:
      The JweEncryption object containing the ciphertext and authentication tag.

    • decryptContentEncryptionKey

      public Key decryptContentEncryptionKey(Key key, byte[] encryptedContentEncryptionKey)
      Decrypts the JWE Encrypted Key to produce the Content Encryption Key (CEK).

      See points 10 in Section 5.2 of the JWE Specification.

      Specified by:
      decryptContentEncryptionKey in interface EncryptionHandler
      Parameters:
      key - The private key pair to the public key that encrypted the JWT.
      encryptedContentEncryptionKey - The encrypted Content Encryption Key.
      Returns:
      The decrypted Content Encryption Key.

    • decryptCiphertext

      public byte[] decryptCiphertext(Key contentEncryptionKey, byte[] initialisationVector, byte[] ciphertext, byte[] authenticationTag, byte[] additionalAuthenticatedData)
      Decrypts the ciphertext with the Content Encryption Key, using the initialisation vector and additional authenticated data, following the steps defined by the EncryptionHandler JweAlgorithm.

      See points 14, 15 in Section 5.2 of the JWE Specification.

      Specified by:
      decryptCiphertext in interface EncryptionHandler
      Parameters:
      contentEncryptionKey - The Content Encryption Key.
      initialisationVector - The Initialisation Vector.
      ciphertext - The ciphertext to decrypt.
      authenticationTag - The authentication tag.
      additionalAuthenticatedData - An array of bytes representing the additional authenticated data.
      Returns:
      An array of bytes representing the decrypted ciphertext.