Top Fields Constructors Methods
org.keycloak.jose.jwe.enc

public abstract Class AesGcmEncryptionProvider

extends Object
implements JWEEncryptionProvider
Class Inheritance
All Implemented Interfaces
org.keycloak.jose.jwe.enc.JWEEncryptionProvider
Known Direct Subclasses
org.keycloak.jose.jwe.enc.AesGcmJWEEncryptionProvider
Imports
java.nio.charset.StandardCharsets, java.security.GeneralSecurityException, .InvalidKeyException, .Key, .NoSuchAlgorithmException, javax.crypto.Cipher, javax.crypto.spec.GCMParameterSpec, .SecretKeySpec, org.keycloak.common.crypto.CryptoIntegration, org.keycloak.jose.jwe.JWE, .JWEKeyStorage, .JWEUtils

Field Summary

Modifier and TypeField and Description
private static final int
AUTH_TAG_SIZE_BYTE

private static final int
IV_SIZE_BYTE

Constructor Summary

AccessConstructor and Description
public
AesGcmEncryptionProvider()

Method Summary

Modifier and TypeMethod and Description
private byte[]
decryptBytes(byte[] encryptedBytes, byte[] ivBytes, Key aesKey, byte[] aad)

public void
deserializeCEK(JWEKeyStorage keyStorage)

Implements org.keycloak.jose.jwe.enc.JWEEncryptionProvider.deserializeCEK.

This method is supposed to deserialize keys.
public void
encodeJwe(JWE jwe)

Implements org.keycloak.jose.jwe.enc.JWEEncryptionProvider.encodeJwe.

This method usually has 3 outputs: - generated initialization vector - encrypted content - authenticationTag for MAC validation It is supposed to call JWE#setEncryptedContentInfo(byte[], byte[], byte[]) after it's finished
private byte[]
encryptBytes(byte[] contentBytes, byte[] ivBytes, Key aesKey, byte[] aad)

private byte[]
getAeadDecryptedTargetContent(JWE jwe)

private byte[]
getAuthenticationTag(byte[] cipherBytes)

private byte[]
getEncryptedContent(byte[] cipherBytes)

protected abstract int
getExpectedAesKeyLength()

public byte[]
serializeCEK(JWEKeyStorage keyStorage)

Implements org.keycloak.jose.jwe.enc.JWEEncryptionProvider.serializeCEK.

This method requires that decoded CEK keys are present in the keyStorage.decodedCEK map before it's called
public void
verifyAndDecodeJwe(JWE jwe)

Implements org.keycloak.jose.jwe.enc.JWEEncryptionProvider.verifyAndDecodeJwe.

This method is supposed to verify checksums and decrypt content.
Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

AUTH_TAG_SIZE_BYTEback to summary
private static final int AUTH_TAG_SIZE_BYTE
IV_SIZE_BYTEback to summary
private static final int IV_SIZE_BYTE

Constructor Detail

AesGcmEncryptionProviderback to summary
public AesGcmEncryptionProvider()

Method Detail

decryptBytesback to summary
private byte[] decryptBytes(byte[] encryptedBytes, byte[] ivBytes, Key aesKey, byte[] aad) throws GeneralSecurityException
deserializeCEKback to summary
public void deserializeCEK(JWEKeyStorage keyStorage)

Implements org.keycloak.jose.jwe.enc.JWEEncryptionProvider.deserializeCEK.

Doc from org.keycloak.jose.jwe.enc.JWEEncryptionProvider.deserializeCEK.

This method is supposed to deserialize keys. It requires that JWEKeyStorage#getCekBytes() is set. After keys are deserialized, this method needs to call JWEKeyStorage#setCEKKey(Key, JWEKeyStorage.KeyUse) according to all uses, which this encryption algorithm requires.

Annotations
@Override
encodeJweback to summary
public void encodeJwe(JWE jwe) throws Exception

Implements org.keycloak.jose.jwe.enc.JWEEncryptionProvider.encodeJwe.

Doc from org.keycloak.jose.jwe.enc.JWEEncryptionProvider.encodeJwe.

This method usually has 3 outputs: - generated initialization vector - encrypted content - authenticationTag for MAC validation It is supposed to call JWE#setEncryptedContentInfo(byte[], byte[], byte[]) after it's finished

Annotations
@Override
encryptBytesback to summary
private byte[] encryptBytes(byte[] contentBytes, byte[] ivBytes, Key aesKey, byte[] aad) throws GeneralSecurityException
getAeadDecryptedTargetContentback to summary
private byte[] getAeadDecryptedTargetContent(JWE jwe)
getAuthenticationTagback to summary
private byte[] getAuthenticationTag(byte[] cipherBytes)
getEncryptedContentback to summary
private byte[] getEncryptedContent(byte[] cipherBytes) throws NoSuchAlgorithmException, InvalidKeyException
getExpectedAesKeyLengthback to summary
protected abstract int getExpectedAesKeyLength()
serializeCEKback to summary
public byte[] serializeCEK(JWEKeyStorage keyStorage)

Implements org.keycloak.jose.jwe.enc.JWEEncryptionProvider.serializeCEK.

Doc from org.keycloak.jose.jwe.enc.JWEEncryptionProvider.serializeCEK.

This method requires that decoded CEK keys are present in the keyStorage.decodedCEK map before it's called

Annotations
@Override
verifyAndDecodeJweback to summary
public void verifyAndDecodeJwe(JWE jwe) throws Exception

Implements org.keycloak.jose.jwe.enc.JWEEncryptionProvider.verifyAndDecodeJwe.

Doc from org.keycloak.jose.jwe.enc.JWEEncryptionProvider.verifyAndDecodeJwe.

This method is supposed to verify checksums and decrypt content. Then it needs to call JWE#content(byte[]) after it's finished

Annotations
@Override