KDF objects are instantiated with the getInstance family of
methods.
The class has two derive methods, deriveKey and deriveData.
The deriveKey method accepts an algorithm name and returns a
SecretKey object with the specified algorithm. The deriveData
method returns a byte array of raw data.
API Usage Example:
KDF kdfHkdf = KDF.getInstance("HKDF-SHA256"); AlgorithmParameterSpec derivationSpec = HKDFParameterSpec.ofExtract() .addIKM(ikm) .addSalt(salt).thenExpand(info, 32); SecretKey sKey = kdfHkdf.deriveKey("AES", derivationSpec);
getInstance
methods, the implementation delays the selection of the provider until the
deriveKey or deriveData method is called. This is called
delayed provider selection. The primary reason this is done is to
ensure that the selected provider can handle the key material that is passed
to those methods - for example, the key material may reside on a hardware
device that only a specific KDF provider can utilize. The getInstance method returns a KDF object as long as there exists
at least one registered security provider that implements the algorithm
and supports the optional parameters. The delayed provider selection
process traverses the list of registered security providers, starting with
the most preferred Provider. The first provider that supports the
specified algorithm, optional parameters, and key material is selected.
If the getProviderName or getParameters method is called
before the deriveKey or deriveData methods, the first
provider supporting the KDF algorithm and optional
KDFParameters is chosen. This provider may not support the key
material that is subsequently passed to the deriveKey or
deriveData methods. Therefore, it is recommended not to call the
getProviderName or getParameters methods until after a key
derivation operation. Once a provider is selected, it cannot be changed.
KDFParameters, SecretKey
| Modifier and Type | Class and Description |
|---|---|
| private static record |
| Modifier and Type | Field and Description |
|---|---|
| private final String | |
| private final KDF. | |
| private final KDFParameters | |
| private final Object | |
| private static final Debug | |
| private final Iterator | |
| private static final boolean | |
| private KDF. |
| Access | Constructor and Description |
|---|---|
| private | |
| private |
| Modifier and Type | Method and Description |
|---|---|
| private static boolean | |
| private Object | chooseProvider(String algorithm, AlgorithmParameterSpec derivationSpec)
Selects the provider which supports the passed |
| public byte[] | Returns: the derived key in its raw bytesthe object describing the inputs to the derivation function derivationSpec)Derives a key, returns raw data as a byte array. |
| public SecretKey | Returns: the derived keythe algorithm of the resultant alg, AlgorithmParameterSpec SecretKey object.
See the SecretKey Algorithms section in the
Java Security Standard Algorithm Names Specification
for information about standard secret key algorithm names.the object describing the inputs to the derivation function derivationSpec)Derives a key, returned as a |
| public String | Returns: the algorithm name of thisKDF objectReturns the algorithm name of this |
| public static KDF | Returns: aKDF objectthe key derivation algorithm to use. See the algorithm)KDF section
in the
Java Security Standard Algorithm Names Specification for
information about standard KDF algorithm names.Returns a |
| public static KDF | Returns: aKDF objectthe key derivation algorithm to use. See the algorithm, String KDF section
in the
Java Security Standard Algorithm Names Specification for
information about standard KDF algorithm names.the provider to use for this key derivation provider)Returns a |
| public static KDF | Returns: aKDF objectthe key derivation algorithm to use. See the algorithm, Provider KDF section
in the
Java Security Standard Algorithm Names Specification for
information about standard KDF algorithm names.the provider to use for this key derivation provider)Returns a |
| public static KDF | Returns: aKDF objectthe key derivation algorithm to use. See the algorithm, KDFParameters KDF section
in the
Java Security Standard Algorithm Names Specification for
information about standard KDF algorithm names.the kdfParameters)KDFParameters used to configure the derivation
algorithm or null if no parameters are providedReturns a |
| public static KDF | Returns: aKDF objectthe key derivation algorithm to use. See the algorithm, KDFParameters KDF section
in the
Java Security Standard Algorithm Names Specification for
information about standard KDF algorithm names.the kdfParameters, String KDFParameters used to configure the derivation
algorithm or null if no parameters are providedthe provider to use for this key derivation provider)Returns a |
| public static KDF | Returns: aKDF objectthe key derivation algorithm to use. See the algorithm, KDFParameters KDF section
in the
Java Security Standard Algorithm Names Specification for
information about standard KDF algorithm names.the kdfParameters, Provider KDFParameters used to configure the derivation
algorithm or null if no parameters are providedthe provider to use for this key derivation provider)Returns a |
| private static KDF. | |
| public KDFParameters | Returns: the parameters used with thisKDF object, or
nullReturns the |
| public String | |
| private static KDF | |
| private void | |
| private void |
| algorithm | back to summary |
|---|---|
| private final String algorithm | |
| candidate | back to summary |
|---|---|
| private final KDF. | |
| kdfParameters | back to summary |
|---|---|
| private final KDFParameters kdfParameters | |
| lock | back to summary |
|---|---|
| private final Object lock | |
| pdebug | back to summary |
|---|---|
| private static final Debug pdebug | |
| serviceIterator | back to summary |
|---|---|
| private final Iterator<Provider. | |
| skipDebug | back to summary |
|---|---|
| private static final boolean skipDebug | |
| theOne | back to summary |
|---|---|
| private KDF. | |
| KDF | back to summary |
|---|---|
| private KDF(KDF. | |
| KDF | back to summary |
|---|---|
| private KDF(KDF. | |
| checkSpiNonNull | back to summary |
|---|---|
| private static boolean checkSpiNonNull(KDF. | |
| chooseProvider | back to summary |
|---|---|
| private Object chooseProvider(String algorithm, AlgorithmParameterSpec derivationSpec) throws InvalidAlgorithmParameterException, NoSuchAlgorithmException Selects the provider which supports the passed If the spi has already been set, it will just return the result. | |
| deriveData | back to summary |
|---|---|
| public byte[] deriveData(AlgorithmParameterSpec derivationSpec) throws InvalidAlgorithmParameterException Derives a key, returns raw data as a byte array.
| |
| deriveKey | back to summary |
|---|---|
| public SecretKey deriveKey(String alg, AlgorithmParameterSpec derivationSpec) throws InvalidAlgorithmParameterException, NoSuchAlgorithmException Derives a key, returned as a
| |
| getAlgorithm | back to summary |
|---|---|
| public String getAlgorithm() Returns the algorithm name of this
| |
| getInstance | back to summary |
|---|---|
| public static KDF getInstance(String algorithm) throws NoSuchAlgorithmException Returns a Implementation Note The JDK Reference Implementation additionally uses the
| |
| getInstance | back to summary |
|---|---|
| public static KDF getInstance(String algorithm, String provider) throws NoSuchAlgorithmException, NoSuchProviderException Returns a
| |
| getInstance | back to summary |
|---|---|
| public static KDF getInstance(String algorithm, Provider provider) throws NoSuchAlgorithmException Returns a
| |
| getInstance | back to summary |
|---|---|
| public static KDF getInstance(String algorithm, KDFParameters kdfParameters) throws NoSuchAlgorithmException, InvalidAlgorithmParameterException Returns a Implementation Note The JDK Reference Implementation additionally uses the
| |
| getInstance | back to summary |
|---|---|
| public static KDF getInstance(String algorithm, KDFParameters kdfParameters, String provider) throws NoSuchAlgorithmException, NoSuchProviderException, InvalidAlgorithmParameterException Returns a
| |
| getInstance | back to summary |
|---|---|
| public static KDF getInstance(String algorithm, KDFParameters kdfParameters, Provider provider) throws NoSuchAlgorithmException, InvalidAlgorithmParameterException Returns a
| |
| getNext | back to summary |
|---|---|
| private static KDF. | |
| getParameters | back to summary |
|---|---|
| public KDFParameters getParameters() Returns the
The returned parameters may be the same that were used to initialize
this
| |
| getProviderName | back to summary |
|---|---|
| public String getProviderName() Returns the name of the provider.
| |
| handleException | back to summary |
|---|---|
| private static KDF handleException(NoSuchAlgorithmException e) throws NoSuchAlgorithmException, InvalidAlgorithmParameterException | |
| rethrow | back to summary |
|---|---|
| private void rethrow(InvalidAlgorithmParameterException e) throws InvalidAlgorithmParameterException | |
| useFirstSpi | back to summary |
|---|---|
| private void useFirstSpi() Use the firstSpi as the chosen KDFSpi and set the fields accordingly | |
| Modifier and Type | Field and Description |
|---|---|
| private final Provider | provider
Record Component accessed by provider(). |
| private final KDFSpi |
| Access | Constructor and Description |
|---|---|
| private |
| Modifier and Type | Method and Description |
|---|---|
| public final boolean | equals(Object o)
Implements abstract java. Indicates whether some other object is "equal to" this one. |
| public final int | |
| public Provider | |
| public KDFSpi | |
| public final String | toString()
Implements abstract java. Returns a string representation of the record. |
| provider | back to summary |
|---|---|
| private final Provider provider Record Component accessed by provider(). | |
| spi | back to summary |
|---|---|
| private final KDFSpi spi Record Component accessed by spi(). | |
| Delegate | back to summary |
|---|---|
| private Delegate(KDFSpi spi, Provider provider) | |
| equals | back to summary |
|---|---|
| public final boolean equals(Object o) Implements abstract java. Doc from java. Indicates whether some other object is "equal to" this one. In addition
to the general contract of
R copy = new R(r.c1(), r.c2(), ..., r.cn());
then it must be the case that r.equals(copy).
| |
| hashCode | back to summary |
|---|---|
| public final int hashCode() Implements abstract java. Doc from java. Returns a hash code value for the record.
Obeys the general contract of | |
| provider | back to summary |
|---|---|
| public Provider provider() Record Component getter of provider. | |
| spi | back to summary |
|---|---|
| public KDFSpi spi() Record Component getter of spi. | |
| toString | back to summary |
|---|---|
| public final String toString() Implements abstract java. Doc from java. Returns a string representation of the record.
In accordance with the general contract of In addition to this general contract, record classes must further participate in the invariant that any two records which are equal must produce equal strings. This invariant is necessarily relaxed in the rare case where corresponding equal component values might fail to produce equal strings for themselves. | |