Class JceKEKRecipient

java.lang.Object
org.bouncycastle.cms.AbstractRecipient
org.bouncycastle.cms.jcajce.JceKEKRecipient
All Implemented Interfaces:
KEKRecipient, Recipient
Direct Known Subclasses:
JceKEKAuthenticatedRecipient, JceKEKAuthEnvelopedRecipient, JceKEKEnvelopedRecipient
public abstract class JceKEKRecipient extends AbstractRecipient implements KEKRecipient

  • Field Details

  • Constructor Details

    • JceKEKRecipient

      public JceKEKRecipient(SecretKey recipientKey)

  • Method Details

    • setProvider

      public JceKEKRecipient setProvider(Provider provider)
      Set the provider to use for key recovery and content processing.
      Parameters:
      provider - provider to use.
      Returns:
      this recipient.

    • setProvider

      public JceKEKRecipient setProvider(String providerName)
      Set the provider to use for key recovery and content processing.
      Parameters:
      providerName - the name of the provider to use.
      Returns:
      this recipient.

    • setContentProvider

      public JceKEKRecipient setContentProvider(Provider provider)
      Set the provider to use for content processing.
      Parameters:
      provider - the provider to use.
      Returns:
      this recipient.

    • setContentProvider

      public JceKEKRecipient setContentProvider(String providerName)
      Set the provider to use for content processing.
      Parameters:
      providerName - the name of the provider to use.
      Returns:
      this recipient.

    • setKeySizeValidation

      public JceKEKRecipient setKeySizeValidation(boolean doValidate)
      Set validation of retrieved key sizes against the algorithm parameters for the encrypted key where possible - default is off.

      This setting will not have any affect if the encryption algorithm in the recipient does not specify a particular key size, or if the unwrapper is a HSM and the byte encoding of the unwrapped secret key is not available.

      Parameters:
      doValidate - true if unwrapped key's should be validated against the content encryption algorithm, false otherwise.
      Returns:
      this recipient.

    • setAllowedContentAlgorithms

      public JceKEKRecipient setAllowedContentAlgorithms(Set<org.bouncycastle.asn1.ASN1ObjectIdentifier> allowedContentAlgorithms)
      Set the content-encryption algorithms this recipient is willing to unwrap a key for. When set, an attempt to recover content protected under any other algorithm is rejected, mitigating an attacker substituting a weaker content-encryption algorithm into the recipient info.
      Parameters:
      allowedContentAlgorithms - the set of permitted content-encryption algorithm OIDs.
      Returns:
      this recipient.

    • setMinimumTagSize

      public JceKEKRecipient setMinimumTagSize(int tagSizeInBits)
      Set the minimum AEAD authentication tag size (in bits) this recipient will accept. When set, an attempt to recover AuthEnvelopedData whose content algorithm carries a shorter tag is rejected, mitigating an attacker downgrading the tag to a weaker length.
      Parameters:
      tagSizeInBits - the minimum acceptable AEAD tag size, in bits.
      Returns:
      this recipient.

    • extractSecretKey

      protected Key extractSecretKey(org.bouncycastle.asn1.x509.AlgorithmIdentifier keyEncryptionAlgorithm, org.bouncycastle.asn1.x509.AlgorithmIdentifier encryptedKeyAlgorithm, byte[] encryptedContentEncryptionKey) throws CMSException
      Throws:
      CMSException