Class JceKeyAgreeRecipient

java.lang.Object
org.bouncycastle.cms.AbstractRecipient
org.bouncycastle.cms.AbstractKeyAgreeRecipient
org.bouncycastle.cms.jcajce.JceKeyAgreeRecipient
All Implemented Interfaces:
KeyAgreeRecipient, Recipient
Direct Known Subclasses:
JceKeyAgreeAuthenticatedRecipient, JceKeyAgreeAuthEnvelopedRecipient, JceKeyAgreeEnvelopedRecipient
public abstract class JceKeyAgreeRecipient extends AbstractKeyAgreeRecipient

  • Field Details

  • Constructor Details

    • JceKeyAgreeRecipient

      public JceKeyAgreeRecipient(PrivateKey recipientKey)

  • Method Details

    • setProvider

      public JceKeyAgreeRecipient setProvider(Provider provider)
      Set the provider to use for key recovery and content processing.
      Parameters:
      provider - provider to use.
      Returns:
      this recipient.

    • setProvider

      public JceKeyAgreeRecipient setProvider(String providerName)
      Set the provider to use for key recovery and content processing.
      Parameters:
      providerName - the name of the provider to use.
      Returns:
      this recipient.

    • setUnwrappingProvider

      public JceKeyAgreeRecipient setUnwrappingProvider(Provider provider)
      Set the provider to use for unwrapping the content session key.
      Parameters:
      provider - provider to use.
      Returns:
      this recipient.

    • setUnwrappingProvider

      public JceKeyAgreeRecipient setUnwrappingProvider(String providerName)
      Set the provider to use for unwrapping the content session key.
      Parameters:
      providerName - the name of the provider to use.
      Returns:
      this recipient.

    • setContentProvider

      public JceKeyAgreeRecipient setContentProvider(Provider provider)
      Set the provider to use for content processing. If providerName is null a "no provider" search will be used to satisfy getInstance calls.
      Parameters:
      provider - the provider to use.
      Returns:
      this recipient.

    • setContentProvider

      public JceKeyAgreeRecipient setContentProvider(String providerName)
      Set the provider to use for content processing. If providerName is null a "no provider" search will be used to satisfy getInstance calls.
      Parameters:
      providerName - the name of the provider to use.
      Returns:
      this recipient.

    • setPrivateKeyAlgorithmIdentifier

      public JceKeyAgreeRecipient setPrivateKeyAlgorithmIdentifier(org.bouncycastle.asn1.x509.AlgorithmIdentifier privKeyAlgID)
      Set the algorithm identifier for the private key. You'll want to use this if you are dealing with a HSM and it is not possible to get the encoding of the private key.
      Parameters:
      privKeyAlgID - the algorithm identifier for the private key.
      Returns:
      this recipient.

    • setAllowedContentAlgorithms

      public JceKeyAgreeRecipient setAllowedContentAlgorithms(Set<org.bouncycastle.asn1.ASN1ObjectIdentifier> allowedContentAlgorithms)
      Set the content-encryption algorithms this recipient is willing to unwrap a key for. When set, an attempt to recover content protected under any other algorithm is rejected, mitigating an attacker substituting a weaker content-encryption algorithm into the recipient info.
      Parameters:
      allowedContentAlgorithms - the set of permitted content-encryption algorithm OIDs.
      Returns:
      this recipient.

    • setMinimumTagSize

      public JceKeyAgreeRecipient setMinimumTagSize(int tagSizeInBits)
      Set the minimum AEAD authentication tag size (in bits) this recipient will accept. When set, an attempt to recover AuthEnvelopedData whose content algorithm carries a shorter tag is rejected, mitigating an attacker downgrading the tag to a weaker length.
      Parameters:
      tagSizeInBits - the minimum acceptable AEAD tag size, in bits.
      Returns:
      this recipient.

    • unwrapSessionKey

      protected Key unwrapSessionKey(org.bouncycastle.asn1.ASN1ObjectIdentifier wrapAlg, SecretKey agreedKey, org.bouncycastle.asn1.ASN1ObjectIdentifier contentEncryptionAlgorithm, byte[] encryptedContentEncryptionKey) throws CMSException, InvalidKeyException, NoSuchAlgorithmException
      Throws:
      CMSException
      InvalidKeyException
      NoSuchAlgorithmException

    • extractSecretKey

      protected Key extractSecretKey(org.bouncycastle.asn1.x509.AlgorithmIdentifier keyEncryptionAlgorithm, org.bouncycastle.asn1.x509.AlgorithmIdentifier contentEncryptionAlgorithm, org.bouncycastle.asn1.x509.SubjectPublicKeyInfo senderKey, org.bouncycastle.asn1.ASN1OctetString userKeyingMaterial, byte[] encryptedContentEncryptionKey) throws CMSException
      Throws:
      CMSException

    • getPrivateKeyAlgorithmIdentifier

      public org.bouncycastle.asn1.x509.AlgorithmIdentifier getPrivateKeyAlgorithmIdentifier()