[utilities COMMIT] in /java-support/trunk/src: main/java/net/shibboleth/utilities/java/support/security/DataSealer.ja...

[noreply at shibboleth.net]

Author: scantor
Date: Thu Feb 26 18:21:05 2015
New Revision: 766

URL: http://svn.shibboleth.net/view/utilities?rev=766&view=rev
Log:
IDP-616 - expose the key alias used to decrypt data

Modified:
    java-support/trunk/src/main/java/net/shibboleth/utilities/java/support/security/DataSealer.java
    java-support/trunk/src/test/java/net/shibboleth/utilities/java/support/security/DataSealerTest.java

Modified: java-support/trunk/src/main/java/net/shibboleth/utilities/java/support/security/DataSealer.java
URL: http://svn.shibboleth.net/view/utilities/java-support/trunk/src/main/java/net/shibboleth/utilities/java/support/security/DataSealer.java?rev=766&r1=765&r2=766&view=diff
==============================================================================
--- java-support/trunk/src/main/java/net/shibboleth/utilities/java/support/security/DataSealer.java (original)
+++ java-support/trunk/src/main/java/net/shibboleth/utilities/java/support/security/DataSealer.java Thu Feb 26 18:21:05 2015
@@ -29,6 +29,7 @@
 import java.util.zip.GZIPOutputStream;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.crypto.SecretKey;
 
 import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
@@ -118,10 +119,27 @@
      * Decrypts and verifies an encrypted bundle created with {@link #wrap(String, long)}.
      * 
      * @param wrapped the encoded blob
+     * 
      * @return the decrypted data, if it's unexpired
      * @throws DataSealerException if the data cannot be unwrapped and verified
      */
     @Nonnull public String unwrap(@Nonnull @NotEmpty final String wrapped) throws DataSealerException {
+
+        return unwrap(wrapped, null);
+    }
+    
+    /**
+     * Decrypts and verifies an encrypted bundle created with {@link #wrap(String, long)}, optionally
+     * returning the label of the key used to encrypt the data.
+     * 
+     * @param wrapped the encoded blob
+     * @param keyUsed a buffer to receive the alias of the key used to encrypt the data
+     * 
+     * @return the decrypted data, if it's unexpired
+     * @throws DataSealerException if the data cannot be unwrapped and verified
+     */
+    @Nonnull public String unwrap(@Nonnull @NotEmpty final String wrapped, @Nullable final StringBuffer keyUsed)
+            throws DataSealerException {
 
         try {
             final byte[] in = Base64Support.decode(wrapped);
@@ -132,7 +150,10 @@
             // Extract alias of key, and load if necessary.
             final String keyAlias = inputDataStream.readUTF();
             log.trace("Data was encrypted by key named '{}'", keyAlias);
-            final SecretKey keyUsed = keyStrategy.getKey(keyAlias);
+            if (keyUsed != null) {
+                keyUsed.append(keyAlias);
+            }
+            final SecretKey key = keyStrategy.getKey(keyAlias);
             
             final GCMBlockCipher cipher = new GCMBlockCipher(new AESEngine());
             
@@ -142,7 +163,7 @@
             inputDataStream.readFully(iv);
 
             final AEADParameters aeadParams =
-                    new AEADParameters(new KeyParameter(keyUsed.getEncoded()), 128, iv, keyAlias.getBytes());
+                    new AEADParameters(new KeyParameter(key.getEncoded()), 128, iv, keyAlias.getBytes());
             cipher.init(false, aeadParams);
 
             // Data can't be any bigger than the original minus IV.

Modified: java-support/trunk/src/test/java/net/shibboleth/utilities/java/support/security/DataSealerTest.java
URL: http://svn.shibboleth.net/view/utilities/java-support/trunk/src/test/java/net/shibboleth/utilities/java/support/security/DataSealerTest.java?rev=766&r1=765&r2=766&view=diff
==============================================================================
--- java-support/trunk/src/test/java/net/shibboleth/utilities/java/support/security/DataSealerTest.java (original)
+++ java-support/trunk/src/test/java/net/shibboleth/utilities/java/support/security/DataSealerTest.java Thu Feb 26 18:21:05 2015
@@ -99,17 +99,23 @@
     @Test public void encodeDecode() throws DataSealerException, ComponentInitializationException {
         final DataSealer sealer = createDataSealer();
 
-        String encoded = sealer.wrap(THE_DATA, System.currentTimeMillis() + 50000);
-        Assert.assertEquals(sealer.unwrap(encoded), THE_DATA);
+        final String encoded = sealer.wrap(THE_DATA, System.currentTimeMillis() + 50000);
+        final StringBuffer alias = new StringBuffer(); 
+        Assert.assertEquals(sealer.unwrap(encoded, alias), THE_DATA);
+        Assert.assertEquals(alias.toString(), "secret1");
     }
 
     @Test public void encodeDecodeSecondKey() throws DataSealerException, ComponentInitializationException {
         final DataSealer sealer = createDataSealer();
         final DataSealer sealer2 = createDataSealer2();
 
-        String encoded = sealer.wrap(THE_DATA, System.currentTimeMillis() + 50000);
-        Assert.assertEquals(sealer.unwrap(encoded), THE_DATA);
-        Assert.assertEquals(sealer2.unwrap(encoded), THE_DATA);

[... 11 lines stripped ...]