/// <exception cref="System.IO.IOException"/>
/// <exception cref="GeneralSecurityException"/>
public virtual KeyProvider.KeyVersion DecryptEncryptedKey(KeyProviderCryptoExtension.EncryptedKeyVersion
encryptedKeyVersion)
{
// Fetch the encryption key material
string encryptionKeyVersionName = encryptedKeyVersion.GetEncryptionKeyVersionName
();
KeyProvider.KeyVersion encryptionKey = keyProvider.GetKeyVersion(encryptionKeyVersionName
);
Preconditions.CheckNotNull(encryptionKey, "KeyVersion name '%s' does not exist",
encryptionKeyVersionName);
Preconditions.CheckArgument(encryptedKeyVersion.GetEncryptedKeyVersion().GetVersionName
().Equals(KeyProviderCryptoExtension.Eek), "encryptedKey version name must be '%s', is '%s'"
, KeyProviderCryptoExtension.Eek, encryptedKeyVersion.GetEncryptedKeyVersion().GetVersionName
());
// Encryption key IV is determined from encrypted key's IV
byte[] encryptionIV = KeyProviderCryptoExtension.EncryptedKeyVersion.DeriveIV(encryptedKeyVersion
.GetEncryptedKeyIv());
CryptoCodec cc = CryptoCodec.GetInstance(keyProvider.GetConf());
Decryptor decryptor = cc.CreateDecryptor();
decryptor.Init(encryptionKey.GetMaterial(), encryptionIV);
KeyProvider.KeyVersion encryptedKV = encryptedKeyVersion.GetEncryptedKeyVersion();
int keyLen = encryptedKV.GetMaterial().Length;
ByteBuffer bbIn = ByteBuffer.AllocateDirect(keyLen);
ByteBuffer bbOut = ByteBuffer.AllocateDirect(keyLen);
bbIn.Put(encryptedKV.GetMaterial());
bbIn.Flip();
decryptor.Decrypt(bbIn, bbOut);
bbOut.Flip();
byte[] decryptedKey = new byte[keyLen];
bbOut.Get(decryptedKey);
return(new KeyProvider.KeyVersion(encryptionKey.GetName(), Ek, decryptedKey));
}
public virtual void TestEncryptDecrypt()
{
// Get an EEK
KeyProviderCryptoExtension.EncryptedKeyVersion eek = kpExt.GenerateEncryptedKey(encryptionKey
.GetName());
byte[] encryptedKeyIv = eek.GetEncryptedKeyIv();
byte[] encryptedKeyMaterial = eek.GetEncryptedKeyVersion().GetMaterial();
// Decrypt it manually
Cipher cipher = Cipher.GetInstance("AES/CTR/NoPadding");
cipher.Init(Cipher.DecryptMode, new SecretKeySpec(encryptionKey.GetMaterial
(), "AES"), new IvParameterSpec(KeyProviderCryptoExtension.EncryptedKeyVersion.DeriveIV
(encryptedKeyIv)));
byte[] manualMaterial = cipher.DoFinal(encryptedKeyMaterial);
// Test the createForDecryption factory method
KeyProviderCryptoExtension.EncryptedKeyVersion eek2 = KeyProviderCryptoExtension.EncryptedKeyVersion
.CreateForDecryption(eek.GetEncryptionKeyName(), eek.GetEncryptionKeyVersionName
(), eek.GetEncryptedKeyIv(), eek.GetEncryptedKeyVersion().GetMaterial());
// Decrypt it with the API
KeyProvider.KeyVersion decryptedKey = kpExt.DecryptEncryptedKey(eek2);
byte[] apiMaterial = decryptedKey.GetMaterial();
Assert.AssertArrayEquals("Wrong key material from decryptEncryptedKey", manualMaterial
, apiMaterial);
}