Class BcCMSContentEncryptorBuilder

java.lang.Object
org.bouncycastle.cms.bc.BcCMSContentEncryptorBuilder
public class BcCMSContentEncryptorBuilder extends Object
Lightweight builder for the content encryptor used in CMS EnvelopedData, AuthEnvelopedData and EncryptedData structures — i.e. it encrypts the actual transmitted (or stored) content.

The no-arg build() call generates a fresh content-encryption key internally, which is the right behaviour for EnvelopedData where the CEK is freshly drawn per message and wrapped per recipient. Callers that already have a key — e.g. building an EncryptedData blob over a long-lived locally-stored key (no recipients, no intermediate key wrap) — should use build(byte[]) or build(KeyParameter) instead.

  • Constructor Details

    • BcCMSContentEncryptorBuilder

      public BcCMSContentEncryptorBuilder(org.bouncycastle.asn1.ASN1ObjectIdentifier encryptionOID)

    • BcCMSContentEncryptorBuilder

      public BcCMSContentEncryptorBuilder(org.bouncycastle.asn1.ASN1ObjectIdentifier encryptionOID, int keySize)

  • Method Details

    • setSecureRandom

      public BcCMSContentEncryptorBuilder setSecureRandom(SecureRandom random)

    • build

      public OutputEncryptor build() throws CMSException
      Build the OutputEncryptor with an internally generated key.
      Returns:
      an OutputEncryptor configured to use an internal key.
      Throws:
      CMSException

    • build

      public OutputEncryptor build(byte[] rawEncKey) throws CMSException
      Build the OutputEncryptor using a pre-generated key.
      Parameters:
      rawEncKey - a raw byte encoding of the key to be used for encryption.
      Returns:
      an OutputEncryptor configured to use rawEncKey.
      Throws:
      CMSException

    • build

      public OutputEncryptor build(org.bouncycastle.crypto.params.KeyParameter encKey) throws CMSException
      Build the OutputEncryptor using a pre-generated key in lightweight KeyParameter form. The lightweight peer of JceCMSContentEncryptorBuilder.build(SecretKey); useful when the caller already holds a KeyParameter (e.g. derived via HKDFBytesGenerator or returned by another BC lightweight key agreement) and would otherwise round-trip the key through byte[] for no reason.
      Parameters:
      encKey - the pre-generated key to use for content encryption.
      Returns:
      an OutputEncryptor configured to use encKey.
      Throws:
      CMSException