Class JceCMSContentEncryptorBuilder

java.lang.Object
org.bouncycastle.cms.jcajce.JceCMSContentEncryptorBuilder
public class JceCMSContentEncryptorBuilder extends Object
Builder for the content encryptor used in CMS EnvelopedData, AuthEnvelopedData and EncryptedData structures — i.e. it encrypts the actual transmitted (or stored) content.

The no-arg build() call generates a fresh content-encryption key internally, which is the right behaviour for EnvelopedData where the CEK is freshly drawn per message and wrapped per recipient. Callers that already have a key — e.g. building an EncryptedData blob over a long-lived locally-stored key (no recipients, no intermediate key wrap), or feeding in a CEK supplied by an external key-management service such as AWS KMS / Nitro Enclaves — should use build(byte[]) or build(SecretKey) instead.

  • Constructor Details

    • JceCMSContentEncryptorBuilder

      public JceCMSContentEncryptorBuilder(org.bouncycastle.asn1.ASN1ObjectIdentifier encryptionOID)

    • JceCMSContentEncryptorBuilder

      public JceCMSContentEncryptorBuilder(org.bouncycastle.asn1.ASN1ObjectIdentifier encryptionOID, int keySize)

    • JceCMSContentEncryptorBuilder

      public JceCMSContentEncryptorBuilder(org.bouncycastle.asn1.x509.AlgorithmIdentifier encryptionAlgId)
      Constructor for a content encryptor builder based on an algorithm identifier and its contained parameters.
      Parameters:
      encryptionAlgId - the full algorithm identifier for the encryption.

  • Method Details

    • setEnableSha256HKdf

      public JceCMSContentEncryptorBuilder setEnableSha256HKdf(boolean useSha256Hkdf)

    • setProvider

      public JceCMSContentEncryptorBuilder setProvider(Provider provider)
      Set the provider to use for content encryption.
      Parameters:
      provider - the provider object to use for cipher and default parameters creation.
      Returns:
      the current builder instance.

    • setProvider

      public JceCMSContentEncryptorBuilder setProvider(String providerName)
      Set the provider to use for content encryption (by name)
      Parameters:
      providerName - the name of the provider to use for cipher and default parameters creation.
      Returns:
      the current builder instance.

    • setSecureRandom

      public JceCMSContentEncryptorBuilder setSecureRandom(SecureRandom random)
      Provide a specified source of randomness to be used for session key and IV/nonce generation.
      Parameters:
      random - the secure random to use.
      Returns:
      the current builder instance.

    • setAlgorithmParameters

      public JceCMSContentEncryptorBuilder setAlgorithmParameters(AlgorithmParameters algorithmParameters)
      Provide a set of algorithm parameters for the content encryption cipher to use.
      Parameters:
      algorithmParameters - algorithmParameters for content encryption.
      Returns:
      the current builder instance.

    • build

      public OutputEncryptor build() throws CMSException
      Build the OutputEncryptor with an internally generated key.
      Returns:
      an OutputEncryptor configured to use an internal key.
      Throws:
      CMSException

    • build

      public OutputEncryptor build(byte[] rawEncKey) throws CMSException
      Build the OutputEncryptor using a pre-generated key given as a raw encoding.
      Parameters:
      rawEncKey - a raw byte encoding of the key to be used for encryption.
      Returns:
      an OutputEncryptor configured to use rawEncKey.
      Throws:
      CMSException

    • build

      public OutputEncryptor build(SecretKey encKey) throws CMSException
      Build the OutputEncryptor using a pre-generated key.
      Parameters:
      encKey - a pre-generated key to be used for encryption.
      Returns:
      an OutputEncryptor configured to use encKey.
      Throws:
      CMSException