1 // Copyright 2023 Google Inc. 2 // 3 // Licensed under the Apache License, Version 2.0 (the "License"); 4 // you may not use this file except in compliance with the License. 5 // You may obtain a copy of the License at 6 // 7 // http://www.apache.org/licenses/LICENSE-2.0 8 // 9 // Unless required by applicable law or agreed to in writing, software 10 // distributed under the License is distributed on an "AS IS" BASIS, 11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 // See the License for the specific language governing permissions and 13 // limitations under the License. 14 // 15 //////////////////////////////////////////////////////////////////////////////// 16 17 package com.google.crypto.tink.aead; 18 19 import com.google.crypto.tink.Key; 20 import com.google.crypto.tink.internal.OutputPrefixUtil; 21 import com.google.crypto.tink.util.Bytes; 22 import java.security.GeneralSecurityException; 23 import java.util.Objects; 24 import javax.annotation.Nullable; 25 26 /** 27 * Describes an EnvelopeAead backed by a KMS. 28 * 29 * <p>Usage of this key type is not recommended. Instead, we recommend to implement the idea of this 30 * class manually: 31 * 32 * <ol> 33 * <li>Create an remote {@link com.google.crypto.tink.Aead} object for your KMS with an 34 * appropriate Tink extension (typically using a subclass of {@link 35 * com.google.crypto.tink.KmsClient}). 36 * <li>Create an envelope AEAD with {@link com.google.crypto.tink.aead.KmsEnvelopeAead#create}. 37 * </ol> 38 * 39 * See {@link LegacyKmsEnvelopeParameters} for known issues. 40 */ 41 public class LegacyKmsEnvelopeAeadKey extends AeadKey { 42 private final LegacyKmsEnvelopeAeadParameters parameters; 43 private final Bytes outputPrefix; 44 @Nullable private final Integer idRequirement; 45 LegacyKmsEnvelopeAeadKey( LegacyKmsEnvelopeAeadParameters parameters, Bytes outputPrefix, @Nullable Integer idRequirement)46 private LegacyKmsEnvelopeAeadKey( 47 LegacyKmsEnvelopeAeadParameters parameters, 48 Bytes outputPrefix, 49 @Nullable Integer idRequirement) { 50 this.parameters = parameters; 51 this.outputPrefix = outputPrefix; 52 this.idRequirement = idRequirement; 53 } 54 create( LegacyKmsEnvelopeAeadParameters parameters, @Nullable Integer idRequirement)55 public static LegacyKmsEnvelopeAeadKey create( 56 LegacyKmsEnvelopeAeadParameters parameters, @Nullable Integer idRequirement) 57 throws GeneralSecurityException { 58 Bytes outputPrefix; 59 if (parameters.getVariant() == LegacyKmsEnvelopeAeadParameters.Variant.NO_PREFIX) { 60 if (idRequirement != null) { 61 throw new GeneralSecurityException( 62 "For given Variant NO_PREFIX the value of idRequirement must be null"); 63 } 64 outputPrefix = OutputPrefixUtil.EMPTY_PREFIX; 65 } else if (parameters.getVariant() == LegacyKmsEnvelopeAeadParameters.Variant.TINK) { 66 if (idRequirement == null) { 67 throw new GeneralSecurityException( 68 "For given Variant TINK the value of idRequirement must be non-null"); 69 } 70 outputPrefix = OutputPrefixUtil.getTinkOutputPrefix(idRequirement); 71 } else { 72 throw new GeneralSecurityException("Unknown Variant: " + parameters.getVariant()); 73 } 74 return new LegacyKmsEnvelopeAeadKey(parameters, outputPrefix, idRequirement); 75 } 76 create(LegacyKmsEnvelopeAeadParameters parameters)77 public static LegacyKmsEnvelopeAeadKey create(LegacyKmsEnvelopeAeadParameters parameters) 78 throws GeneralSecurityException { 79 return create(parameters, null); 80 } 81 82 @Override getOutputPrefix()83 public Bytes getOutputPrefix() { 84 return this.outputPrefix; 85 } 86 87 @Override getParameters()88 public LegacyKmsEnvelopeAeadParameters getParameters() { 89 return parameters; 90 } 91 92 @Override getIdRequirementOrNull()93 public Integer getIdRequirementOrNull() { 94 return idRequirement; 95 } 96 97 @Override equalsKey(Key o)98 public boolean equalsKey(Key o) { 99 if (!(o instanceof LegacyKmsEnvelopeAeadKey)) { 100 return false; 101 } 102 LegacyKmsEnvelopeAeadKey that = (LegacyKmsEnvelopeAeadKey) o; 103 return that.parameters.equals(parameters) && Objects.equals(that.idRequirement, idRequirement); 104 } 105 } 106