Top Description Fields Constructors Methods
org.bouncycastle.openpgp.operator

public abstract Class PBEKeyEncryptionMethodGenerator

extends Object
implements PGPKeyEncryptionMethodGenerator
Class Inheritance
All Implemented Interfaces
org.bouncycastle.openpgp.operator.PGPKeyEncryptionMethodGenerator
Known Direct Subclasses
org.bouncycastle.openpgp.operator.bc.BcPBEKeyEncryptionMethodGenerator, org.bouncycastle.openpgp.operator.jcajce.JcePBEKeyEncryptionMethodGenerator
Imports
java.security.SecureRandom, org.bouncycastle.bcpg.AEADUtils, .ContainedPacket, .S2K, .SymmetricKeyAlgorithmTags, .SymmetricKeyEncSessionPacket, org.bouncycastle.openpgp.PGPException, org.bouncycastle.util.Arrays
PGP style PBE encryption method.

A pass phrase is used to generate an encryption key using the PGP string-to-key method.

Note that the iteration count provided to this method is a single byte as described by the S2K algorithm, and the actual iteration count ranges exponentially from 0x01 == 1088 to 0xFF == 65,011,712.

Field Summary

Modifier and TypeField and Description
private char[]
passPhrase

private SecureRandom
random

private S2K
s2k

private int
s2kCount

private PGPDigestCalculator
s2kDigestCalculator

private int
wrapAlg

Constructor Summary

AccessConstructor and Description
protected
PBEKeyEncryptionMethodGenerator(char[]
the pass phrase to encrypt with.
passPhrase, PGPDigestCalculator
a digest calculator to use in the string-to-key function.
s2kDigestCalculator)

Construct a PBE key generator using the default iteration count (0x60 == 65536 iterations).

protected
PBEKeyEncryptionMethodGenerator(char[]
passphrase
passPhrase, S2K.Argon2Params
argon2 parameters
params)

Construct a PBE key generator using Argon2 as S2K mechanism.

protected
PBEKeyEncryptionMethodGenerator(char[]
the pass phrase to encrypt with.
passPhrase, PGPDigestCalculator
a digest calculator to use in the string-to-key function.
s2kDigestCalculator, int
a single byte S2K iteration count specifier, which is translated to an actual iteration count by the S2K class.
s2kCount)

Construct a PBE key generator using a specific iteration level.

Method Summary

Modifier and TypeMethod and Description
protected abstract byte[]
encryptSessionInfo(int encAlgorithm, byte[] key, byte[] sessionInfo)

public ContainedPacket

Returns:

a packet encoding the provided information and the configuration of this instance.
generate(PGPDataEncryptorBuilder dataEncryptorBuilder, byte[]
session data generated by the encrypted data generator.
sessionKey)

Implements org.bouncycastle.openpgp.operator.PGPKeyEncryptionMethodGenerator.generate.

Generates a version 4 Symmetric-Key-Encrypted-Session-Key (SKESK) packet, encoding the encrypted session-key for this method.

protected abstract byte[]
generateV6KEK(int kekAlgorithm, byte[] ikm, byte[] info)

protected abstract byte[]
getEskAndTag(int kekAlgorithm, int aeadAlgorithm, byte[] sessionKey, byte[] key, byte[] iv, byte[] info)

public byte[]

Returns:

the bytes of the generated key.
getKey(int
the encryption algorithm to generate the key for.
encAlgorithm)

Generate a key for a symmetric encryption algorithm using the PBE configuration in this method.

public int

Returns:

the PBE method's wrapping algorithm, defaultWrapAlg is setSessionKeyWrapperAlgorithm was not called.
getSessionKeyWrapperAlgorithm(int
the default wrapping algorithm if none was set.
defaultWrapAlg)

Return the key wrapping algorithm this PBE key method is associated with.

public PBEKeyEncryptionMethodGenerator

Returns:

the current generator.
setSecureRandom(SecureRandom random)

Sets a user defined source of randomness.

public PBEKeyEncryptionMethodGenerator

Returns:

the current generator.
setSessionKeyWrapperAlgorithm(int wrapAlg)

Set a specific algorithm to be used where this PBE method generator is used to wrap a session key for encrypting data, rather than providing the encryption key for the data.

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

passPhraseback to summary
private char[] passPhrase
randomback to summary
private SecureRandom random
s2kback to summary
private S2K s2k
s2kCountback to summary
private int s2kCount
s2kDigestCalculatorback to summary
private PGPDigestCalculator s2kDigestCalculator
wrapAlgback to summary
private int wrapAlg

Constructor Detail

PBEKeyEncryptionMethodGeneratorback to summary
protected PBEKeyEncryptionMethodGenerator(char[] passPhrase, PGPDigestCalculator s2kDigestCalculator)

Construct a PBE key generator using the default iteration count (0x60 == 65536 iterations).

Parameters
passPhrase:char[]

the pass phrase to encrypt with.

s2kDigestCalculator:PGPDigestCalculator

a digest calculator to use in the string-to-key function.

PBEKeyEncryptionMethodGeneratorback to summary
protected PBEKeyEncryptionMethodGenerator(char[] passPhrase, S2K.Argon2Params params)

Construct a PBE key generator using Argon2 as S2K mechanism.

Parameters
passPhrase:char[]

passphrase

params:S2K.Argon2Params

argon2 parameters

PBEKeyEncryptionMethodGeneratorback to summary
protected PBEKeyEncryptionMethodGenerator(char[] passPhrase, PGPDigestCalculator s2kDigestCalculator, int s2kCount)

Construct a PBE key generator using a specific iteration level.

Parameters
passPhrase:char[]

the pass phrase to encrypt with.

s2kDigestCalculator:PGPDigestCalculator

a digest calculator to use in the string-to-key function.

s2kCount:int

a single byte S2K iteration count specifier, which is translated to an actual iteration count by the S2K class.

Method Detail

encryptSessionInfoback to summary
protected abstract byte[] encryptSessionInfo(int encAlgorithm, byte[] key, byte[] sessionInfo) throws PGPException
generateback to summary
public ContainedPacket generate(PGPDataEncryptorBuilder dataEncryptorBuilder, byte[] sessionKey) throws PGPException

Implements org.bouncycastle.openpgp.operator.PGPKeyEncryptionMethodGenerator.generate.

Generates a version 4 Symmetric-Key-Encrypted-Session-Key (SKESK) packet, encoding the encrypted session-key for this method. SKESKv4 packets are used by Symmetrically-Encrypted-Integrity-Protected-Data (SEIPD) packets of version 1, or by (deprecated) Symmetrically-Encrypted-Data (SED) packets.

Generates a version 5 Symmetric-Key-Encrypted-Session-Key (SKESK) packet, encoding the encrypted session-key for this method. SKESKv5 packets are used with OCB-Encrypted Data (OED) packets only. AEAD algorithm ID (MUST be org.bouncycastle.bcpg.AEADAlgorithmTags#OCB)

Generates a version 6 Symmetric-Key-Encrypted-Session-Key (SKESK) packet, encoding the encrypted session-key for this method. SKESKv6 packets are used with Symmetrically-Encrypted Integrity-Protected Data (SEIPD) packets of version 2 only. A SKESKv6 packet MUST NOT precede a SEIPDv1, OED or SED packet.

Parameters
sessionKey:byte[]

session data generated by the encrypted data generator.

Returns:ContainedPacket

a packet encoding the provided information and the configuration of this instance.

Exceptions
PGPException:
if an error occurs constructing the packet.
See Also
RFC9580 - Symmetric-Key Encrypted Session-Key Packet version 4, LibrePGP - Symmetric-Key Encrypted Session-Key Packet version 5, RFC9580 - Symmetric-Key Encrypted Session-Key Packet version 6
generateV6KEKback to summary
protected abstract byte[] generateV6KEK(int kekAlgorithm, byte[] ikm, byte[] info) throws PGPException
getEskAndTagback to summary
protected abstract byte[] getEskAndTag(int kekAlgorithm, int aeadAlgorithm, byte[] sessionKey, byte[] key, byte[] iv, byte[] info) throws PGPException
getKeyback to summary
public byte[] getKey(int encAlgorithm) throws PGPException

Generate a key for a symmetric encryption algorithm using the PBE configuration in this method.

Parameters
encAlgorithm:int

the encryption algorithm to generate the key for.

Returns:byte[]

the bytes of the generated key.

Exceptions
PGPException:
if an error occurs performing the string-to-key generation.
getSessionKeyWrapperAlgorithmback to summary
public int getSessionKeyWrapperAlgorithm(int defaultWrapAlg)

Return the key wrapping algorithm this PBE key method is associated with.

Parameters
defaultWrapAlg:int

the default wrapping algorithm if none was set.

Returns:int

the PBE method's wrapping algorithm, defaultWrapAlg is setSessionKeyWrapperAlgorithm was not called.

setSecureRandomback to summary
public PBEKeyEncryptionMethodGenerator setSecureRandom(SecureRandom random)

Sets a user defined source of randomness.

If no SecureRandom is configured, a default SecureRandom will be used.

Returns:PBEKeyEncryptionMethodGenerator

the current generator.

setSessionKeyWrapperAlgorithmback to summary
public PBEKeyEncryptionMethodGenerator setSessionKeyWrapperAlgorithm(int wrapAlg)

Set a specific algorithm to be used where this PBE method generator is used to wrap a session key for encrypting data, rather than providing the encryption key for the data.

The default wrapping algorithm is the same algorithm as the one specified for data encryption with the PGPEncryptedDataGenerator used.

Returns:PBEKeyEncryptionMethodGenerator

the current generator.