CryptoManagerImpl (OpenDJ Public API Javadoc 6.5.6 Documentation)

java.lang.Object
- org.opends.server.crypto.CryptoManagerImpl

All Implemented Interfaces:

ConfigurationChangeListener<CryptoManagerCfg>, CryptoManager
```
public final class CryptoManagerImpl
extends Object
implements ConfigurationChangeListener<CryptoManagerCfg>, CryptoManager
```
This class implements the Directory Server cryptographic framework, which is described in the CrytpoManager design document. CryptoManager implements inter-OpenDJ-instance authentication and authorization using the ADS-based truststore, and secret key distribution. The interface also provides methods for hashing, encryption, and other kinds of cryptographic operations.
Note that it also contains methods for compressing and uncompressing data: while these are not strictly cryptographic operations, there are a lot of similarities and it is conceivable at some point that accelerated compression may be available just as it is for cryptographic operations.
Other components of CryptoManager:

See Also:

CryptoManagerSync, GetSymmetricKeyExtendedOperation

Constructor Summary

Constructors
Constructor and Description
`CryptoManagerImpl(ServerContext serverContext, CryptoManagerCfg config)` Creates a new instance of this crypto manager object from a given configuration, plus some static member initialization.

Method Summary

All Methods Static Methods Instance Methods Concrete Methods
Modifier and Type	Method and Description
`ConfigChangeResult`	`applyConfigurationChange(CryptoManagerCfg cfg)` Applies the configuration changes to this change listener.
`int`	`compress(byte[] src, int srcOff, int srcLen, byte[] dst, int dstOff, int dstLen)` Attempts to compress the data in the provided source array into the given destination array.
`byte[]`	`decrypt(byte[] data)` Decrypts the data in the provided byte array using cipher specified by the key identifier prologue to the data.
`byte[]`	`digest(byte[] data)` Retrieves a byte array containing a message digest based on the provided data, using the preferred digest algorithm.
`byte[]`	`digest(InputStream inputStream)` Retrieves a byte array containing a message digest based on the data read from the provided input stream, using the preferred digest algorithm.
`byte[]`	`digest(String digestAlgorithm, byte[] data)` Retrieves a byte array containing a message digest based on the provided data, using the requested digest algorithm.
`byte[]`	`digest(String digestAlgorithm, InputStream inputStream)` Retrieves a byte array containing a message digest based on the data read from the provided input stream, using the requested digest algorithm.
`byte[]`	`encrypt(byte[] data)` Encrypts the data in the provided byte array using the preferred cipher transformation.
`byte[]`	`encrypt(String cipherTransformation, int keyLengthBits, byte[] data)` Encrypts the data in the provided byte array using the requested cipher algorithm.
`void`	`ensureCipherKeyIsAvailable(String cipherTransformation, int cipherKeyLength)` Ensures that a key exists for the provided cipher transformation and key length.
`CipherInputStream`	`getCipherInputStream(InputStream inputStream)` Returns a CipherInputStream instantiated with a cipher corresponding to the key identifier prologue to the data.
`CipherOutputStream`	`getCipherOutputStream(OutputStream outputStream)` Writes encrypted data to the provided output stream using the preferred cipher transformation.
`CipherOutputStream`	`getCipherOutputStream(String cipherTransformation, int keyLengthBits, OutputStream outputStream)` Writes encrypted data to the provided output stream using the requested cipher transformation.
`static String`	`getInstanceKeyID(byte[] instanceKeyCertificate)` Return the identifier of an instance's instance key.
`Mac`	`getMacEngine(String keyEntryID)` For the specified key entry identifier, instantiate a MAC engine.
`String`	`getMacEngineKeyEntryID()` For the current preferred MAC algorithm and key length, return the identifier of the corresponding key entry.
`String`	`getMacEngineKeyEntryID(String macAlgorithm, int keyLengthBits)` For the specified MAC algorithm and key length, return the identifier of the corresponding key entry.
`MessageDigest`	`getMessageDigest(String digestAlgorithm)` Retrieves a `MessageDigest` object that may be used to generate digests using the specified algorithm.
`MessageDigest`	`getPreferredMessageDigest()` Retrieves a `MessageDigest` object that may be used to generate digests using the preferred digest algorithm.
`String`	`getPreferredMessageDigestAlgorithm()` Retrieves the name of the preferred message digest algorithm.
`SortedSet<String>`	`getSslCertNicknames()` Get the names of the local certificates to use for SSL.
`SortedSet<String>`	`getSslCipherSuites()` Get the set of enabled SSL cipher suites.
`SSLContext`	`getSslContext(String componentName, SortedSet<String> sslCertNicknames)` Create an SSL context that may be used for communication to another ADS component.
`SortedSet<String>`	`getSslProtocols()` Get the set of enabled SSL protocols.
`boolean`	`isConfigurationChangeAcceptable(CryptoManagerCfg cfg, List<LocalizableMessage> unacceptableReasons)` Indicates whether the proposed change to the configuration is acceptable to this change listener.
`boolean`	`isSslEncryption()` Determine whether SSL encryption is enabled.
`CryptoSuite`	`newCryptoSuite(String cipherTransformation, int cipherKeyLength, boolean encrypt)` Return a new `CryptoSuite` for the cipher and key.
`int`	`uncompress(byte[] src, int srcOff, int srcLen, byte[] dst, int dstOff, int dstLen)` Attempts to uncompress the data in the provided source array into the given destination array.

Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

- Constructor Detail
  - CryptoManagerImpl
```
public CryptoManagerImpl(ServerContext serverContext,
                         CryptoManagerCfg config)
                  throws InitializationException
```
    Creates a new instance of this crypto manager object from a given configuration, plus some static member initialization.
    
    Parameters:
    
    serverContext - The server context.
    
    config - The configuration of this crypto manager.
    
    Throws:
    
    InitializationException - If a problem occurs while creating this CryptoManager that is not the result of a problem in the configuration.
- Method Detail
  - isConfigurationChangeAcceptable
```
public boolean isConfigurationChangeAcceptable(CryptoManagerCfg cfg,
                                               List<LocalizableMessage> unacceptableReasons)
```
    Description copied from interface: ConfigurationChangeListener
    
    Indicates whether the proposed change to the configuration is acceptable to this change listener.
    
    Specified by:
    
    isConfigurationChangeAcceptable in interface ConfigurationChangeListener<CryptoManagerCfg>
    
    Parameters:
    
    cfg - The new configuration containing the changes.
    
    unacceptableReasons - A list that can be used to hold messages about why the provided configuration is not acceptable.
    
    Returns:
    
    Returns true if the proposed change is acceptable, or false if it is not.
  - applyConfigurationChange
```
public ConfigChangeResult applyConfigurationChange(CryptoManagerCfg cfg)
```
    Description copied from interface: ConfigurationChangeListener
    
    Applies the configuration changes to this change listener.
    
    Specified by:
    
    applyConfigurationChange in interface ConfigurationChangeListener<CryptoManagerCfg>
    
    Parameters:
    
    cfg - The new configuration containing the changes.
    
    Returns:
    
    Returns information about the result of changing the configuration.
  - getInstanceKeyID
```
public static String getInstanceKeyID(byte[] instanceKeyCertificate)
                               throws CryptoManagerException
```
    Return the identifier of an instance's instance key. An instance-key identifier is a hex string of the MD5 hash of an instance's instance-key public-key certificate.
    
    Parameters:
    
    instanceKeyCertificate - The instance key for which to return an identifier.
    
    Returns:
    
    The identifier of the supplied instance key.
    
    Throws:
    
    CryptoManagerException - If there is a problem computing the identifier from the instance key. TODO: Make package-private if ADSContextHelper can get keyID from ADS TODO: suffix: Issue https://opends.dev.java.net/issues/show_bug.cgi?id=2442
    
    See Also:
    
    getInstanceKeyID()
  - getPreferredMessageDigestAlgorithm
```
public String getPreferredMessageDigestAlgorithm()
```
    Description copied from interface: CryptoManager
    
    Retrieves the name of the preferred message digest algorithm.
    
    Specified by:
    
    getPreferredMessageDigestAlgorithm in interface CryptoManager
    
    Returns:
    
    The name of the preferred message digest algorithm
  - getPreferredMessageDigest
```
public MessageDigest getPreferredMessageDigest()
                                        throws NoSuchAlgorithmException
```
    Description copied from interface: CryptoManager
    
    Retrieves a MessageDigest object that may be used to generate digests using the preferred digest algorithm.
    
    Specified by:
    
    getPreferredMessageDigest in interface CryptoManager
    
    Returns:
    
    A MessageDigest object that may be used to generate digests using the preferred digest algorithm.
    
    Throws:
    
    NoSuchAlgorithmException - If the requested algorithm is not supported or is unavailable.
  - getMessageDigest
```
public MessageDigest getMessageDigest(String digestAlgorithm)
                               throws NoSuchAlgorithmException
```
    Description copied from interface: CryptoManager
    
    Retrieves a MessageDigest object that may be used to generate digests using the specified algorithm.
    
    Specified by:
    
    getMessageDigest in interface CryptoManager
    
    Parameters:
    
    digestAlgorithm - The algorithm to use to generate the message digest.
    
    Returns:
    
    A MessageDigest object that may be used to generate digests using the specified algorithm.
    
    Throws:
    
    NoSuchAlgorithmException - If the requested algorithm is not supported or is unavailable.
  - digest
```
public byte[] digest(byte[] data)
              throws NoSuchAlgorithmException
```
    Description copied from interface: CryptoManager
    
    Retrieves a byte array containing a message digest based on the provided data, using the preferred digest algorithm.
    
    Specified by:
    
    digest in interface CryptoManager
    
    Parameters:
    
    data - The data to be digested.
    
    Returns:
    
    A byte array containing the generated message digest.
    
    Throws:
    
    NoSuchAlgorithmException - If the requested algorithm is not supported or is unavailable.
  - digest
```
public byte[] digest(String digestAlgorithm,
                     byte[] data)
              throws NoSuchAlgorithmException
```
    Description copied from interface: CryptoManager
    
    Retrieves a byte array containing a message digest based on the provided data, using the requested digest algorithm.
    
    Specified by:
    
    digest in interface CryptoManager
    
    Parameters:
    
    digestAlgorithm - The algorithm to use to generate the message digest.
    
    data - The data to be digested.
    
    Returns:
    
    A byte array containing the generated message digest.
    
    Throws:
    
    NoSuchAlgorithmException - If the requested algorithm is not supported or is unavailable.
  - digest
```
public byte[] digest(InputStream inputStream)
              throws IOException,
                     NoSuchAlgorithmException
```
    Description copied from interface: CryptoManager
    
    Retrieves a byte array containing a message digest based on the data read from the provided input stream, using the preferred digest algorithm. Data will be read until the end of the stream is reached.
    
    Specified by:
    
    digest in interface CryptoManager
    
    Parameters:
    
    inputStream - The input stream from which the data is to be read.
    
    Returns:
    
    A byte array containing the generated message digest.
    
    Throws:
    
    IOException - If a problem occurs while reading data from the provided stream.
    
    NoSuchAlgorithmException - If the requested algorithm is not supported or is unavailable.
  - digest
```
public byte[] digest(String digestAlgorithm,
                     InputStream inputStream)
              throws IOException,
                     NoSuchAlgorithmException
```
    Description copied from interface: CryptoManager
    
    Retrieves a byte array containing a message digest based on the data read from the provided input stream, using the requested digest algorithm. Data will be read until the end of the stream is reached.
    
    Specified by:
    
    digest in interface CryptoManager
    
    Parameters:
    
    digestAlgorithm - The algorithm to use to generate the message digest.
    
    inputStream - The input stream from which the data is to be read.
    
    Returns:
    
    A byte array containing the generated message digest.
    
    Throws:
    
    IOException - If a problem occurs while reading data from the provided stream.
    
    NoSuchAlgorithmException - If the requested algorithm is not supported or is unavailable.
  - getMacEngineKeyEntryID
```
public String getMacEngineKeyEntryID()
                              throws CryptoManagerException
```
    Description copied from interface: CryptoManager
    
    For the current preferred MAC algorithm and key length, return the identifier of the corresponding key entry. Note: the result (key identifier) might change across invocations, due to either of the perferred parameters changing, or because the original key was marked compromised and a replacement key generated.
    
    Specified by:
    
    getMacEngineKeyEntryID in interface CryptoManager
    
    Returns:
    
    A String representation of the identifier of a key entry corresponding to the preferred MAC algorithm and key length.
    
    Throws:
    
    CryptoManagerException - In case one or more of the key parameters is invalid, or there is a problem instantiating the key entry in case it does not already exist.
  - getMacEngineKeyEntryID
```
public String getMacEngineKeyEntryID(String macAlgorithm,
                                     int keyLengthBits)
                              throws CryptoManagerException
```
    Description copied from interface: CryptoManager
    
    For the specified MAC algorithm and key length, return the identifier of the corresponding key entry. Note: the result (key identifier) might change across invocations, due to either of the perferred parameters changing, or because the original key was marked compromised and a replacement key generated.
    
    Specified by:
    
    getMacEngineKeyEntryID in interface CryptoManager
    
    Parameters:
    
    macAlgorithm - The algorithm to use for the MAC engine.
    
    keyLengthBits - The key length in bits to use with the specified algorithm.
    
    Returns:
    
    A String representation of the identifier of a key entry corresponding to the specified MAC algorithm and key length.
    
    Throws:
    
    CryptoManagerException - In case one or more of the key parameters is invalid, or there is a problem instantiating the key entry in case it does not already exist.
  - getMacEngine
```
public Mac getMacEngine(String keyEntryID)
                 throws CryptoManagerException
```
    Description copied from interface: CryptoManager
    
    For the specified key entry identifier, instantiate a MAC engine.
    
    Specified by:
    
    getMacEngine in interface CryptoManager
    
    Parameters:
    
    keyEntryID - The identifier of the key entry containing the desired MAC algorithm name and key length.
    
    Returns:
    
    The MAC engine instantiated with the parameters from the referenced key entry, or null if no such entry exists.
    
    Throws:
    
    CryptoManagerException - In case the key entry identifier is invalid or there is a problem instantiating the MAC engine from the parameters in the referenced key entry.
  - encrypt
```
public byte[] encrypt(byte[] data)
               throws GeneralSecurityException,
                      CryptoManagerException
```
    Description copied from interface: CryptoManager
    
    Encrypts the data in the provided byte array using the preferred cipher transformation.
    
    Specified by:
    
    encrypt in interface CryptoManager
    
    Parameters:
    
    data - The plain-text data to be encrypted.
    
    Returns:
    
    A byte array containing the encrypted representation of the provided data.
    
    Throws:
    
    GeneralSecurityException - If a problem occurs while encrypting the data.
    
    CryptoManagerException - If a problem occurs managing the encryption key or producing the cipher.
  - encrypt
```
public byte[] encrypt(String cipherTransformation,
                      int keyLengthBits,
                      byte[] data)
               throws GeneralSecurityException,
                      CryptoManagerException
```
    Description copied from interface: CryptoManager
    
    Encrypts the data in the provided byte array using the requested cipher algorithm.
    
    Specified by:
    
    encrypt in interface CryptoManager
    
    Parameters:
    
    cipherTransformation - The algorithm/mode/padding to use for the cipher.
    
    keyLengthBits - The length in bits of the encryption key this method is to use. Note the specified key length and transformation must be compatible.
    
    data - The plain-text data to be encrypted.
    
    Returns:
    
    A byte array containing the encrypted representation of the provided data.
    
    Throws:
    
    GeneralSecurityException - If a problem occurs while encrypting the data.
    
    CryptoManagerException - If a problem occurs managing the encryption key or producing the cipher.
  - getCipherOutputStream
```
public CipherOutputStream getCipherOutputStream(OutputStream outputStream)
                                         throws CryptoManagerException
```
    Description copied from interface: CryptoManager
    
    Writes encrypted data to the provided output stream using the preferred cipher transformation.
    
    Specified by:
    
    getCipherOutputStream in interface CryptoManager
    
    Parameters:
    
    outputStream - The output stream to be wrapped by the returned cipher output stream.
    
    Returns:
    
    The output stream wrapped with a CipherOutputStream.
    
    Throws:
    
    CryptoManagerException - If a problem occurs managing the encryption key or producing the cipher.
  - getCipherOutputStream
```
public CipherOutputStream getCipherOutputStream(String cipherTransformation,
                                                int keyLengthBits,
                                                OutputStream outputStream)
                                         throws CryptoManagerException
```
    Description copied from interface: CryptoManager
    
    Writes encrypted data to the provided output stream using the requested cipher transformation.
    
    Specified by:
    
    getCipherOutputStream in interface CryptoManager
    
    Parameters:
    
    cipherTransformation - The algorithm/mode/padding to use for the cipher.
    
    keyLengthBits - The length in bits of the encryption key this method will generate. Note the specified key length must be compatible with the transformation.
    
    outputStream - The output stream to be wrapped by the returned cipher output stream.
    
    Returns:
    
    The output stream wrapped with a CipherOutputStream.
    
    Throws:
    
    CryptoManagerException - If a problem occurs managing the encryption key or producing the cipher.
  - ensureCipherKeyIsAvailable
```
public void ensureCipherKeyIsAvailable(String cipherTransformation,
                                       int cipherKeyLength)
                                throws CryptoManagerException
```
    Description copied from interface: CryptoManager
    
    Ensures that a key exists for the provided cipher transformation and key length. If none exists, a new one will be created.
    Newly created keys will be published and propagated to the replication topology.
    
    Specified by:
    
    ensureCipherKeyIsAvailable in interface CryptoManager
    
    Parameters:
    
    cipherTransformation - cipher transformation string specification
    
    cipherKeyLength - length of key in bits
    
    Throws:
    
    CryptoManagerException - If a problem occurs managing the encryption key
  - decrypt
```
public byte[] decrypt(byte[] data)
               throws GeneralSecurityException,
                      CryptoManagerException
```
    Description copied from interface: CryptoManager
    
    Decrypts the data in the provided byte array using cipher specified by the key identifier prologue to the data. cipher.
    
    Specified by:
    
    decrypt in interface CryptoManager
    
    Parameters:
    
    data - The cipher-text data to be decrypted.
    
    Returns:
    
    A byte array containing the clear-text representation of the provided data.
    
    Throws:
    
    GeneralSecurityException - If a problem occurs while encrypting the data.
    
    CryptoManagerException - If a problem occurs reading the key identifier or initialization vector from the data prologue, or using these values to initialize a Cipher.
  - getCipherInputStream
```
public CipherInputStream getCipherInputStream(InputStream inputStream)
                                       throws CryptoManagerException
```
    Description copied from interface: CryptoManager
    
    Returns a CipherInputStream instantiated with a cipher corresponding to the key identifier prologue to the data.
    
    Specified by:
    
    getCipherInputStream in interface CryptoManager
    
    Parameters:
    
    inputStream - The input stream be wrapped with the CipherInputStream.
    
    Returns:
    
    The CiperInputStream instantiated as specified.
    
    Throws:
    
    CryptoManagerException - If there is a problem reading the key ID or initialization vector from the input stream, or using these values to inititalize a Cipher.
  - compress
```
public int compress(byte[] src,
                    int srcOff,
                    int srcLen,
                    byte[] dst,
                    int dstOff,
                    int dstLen)
```
    Description copied from interface: CryptoManager
    
    Attempts to compress the data in the provided source array into the given destination array. If the compressed data will fit into the destination array, then this method will return the number of bytes of compressed data in the array. Otherwise, it will return -1 to indicate that the compression was not successful. Note that if -1 is returned, then the data in the destination array should be considered invalid.
    
    Specified by:
    
    compress in interface CryptoManager
    
    Parameters:
    
    src - The array containing the raw data to compress.
    
    srcOff - The start offset of the source data.
    
    srcLen - The maximum number of source data bytes to compress.
    
    dst - The array into which the compressed data should be written.
    
    dstOff - The start offset of the compressed data.
    
    dstLen - The maximum number of bytes of compressed data.
    
    Returns:
    
    The number of bytes of compressed data, or -1 if it was not possible to actually compress the data.
  - uncompress
```
public int uncompress(byte[] src,
                      int srcOff,
                      int srcLen,
                      byte[] dst,
                      int dstOff,
                      int dstLen)
               throws DataFormatException
```
    Description copied from interface: CryptoManager
    
    Attempts to uncompress the data in the provided source array into the given destination array. If the uncompressed data will fit into the given destination array, then this method will return the number of bytes of uncompressed data written into the destination buffer. Otherwise, it will return a negative value to indicate that the destination buffer was not large enough. The absolute value of that negative return value will indicate the buffer size required to fully decompress the data. Note that if a negative value is returned, then the data in the destination array should be considered invalid.
    
    Specified by:
    
    uncompress in interface CryptoManager
    
    Parameters:
    
    src - The array containing the raw data to compress.
    
    srcOff - The start offset of the source data.
    
    srcLen - The maximum number of source data bytes to compress.
    
    dst - The array into which the compressed data should be written.
    
    dstOff - The start offset of the compressed data.
    
    dstLen - The maximum number of bytes of compressed data.
    
    Returns:
    
    A positive value containing the number of bytes of uncompressed data written into the destination buffer, or a negative value whose absolute value is the size of the destination buffer required to fully decompress the provided data.
    
    Throws:
    
    DataFormatException - If a problem occurs while attempting to uncompress the data.
  - getSslContext
```
public SSLContext getSslContext(String componentName,
                                SortedSet<String> sslCertNicknames)
                         throws ConfigException
```
    Description copied from interface: CryptoManager
    
    Create an SSL context that may be used for communication to another ADS component.
    
    Specified by:
    
    getSslContext in interface CryptoManager
    
    Parameters:
    
    componentName - Name of the component to which is associated this SSL Context.
    
    sslCertNicknames - The names of the local certificates to use, or null if none is specified.
    
    Returns:
    
    A new SSL Context.
    
    Throws:
    
    ConfigException - If the context could not be created.
  - getSslCertNicknames
```
public SortedSet<String> getSslCertNicknames()
```
    Description copied from interface: CryptoManager
    
    Get the names of the local certificates to use for SSL.
    
    Specified by:
    
    getSslCertNicknames in interface CryptoManager
    
    Returns:
    
    The names of the local certificates to use for SSL.
  - isSslEncryption
```
public boolean isSslEncryption()
```
    Description copied from interface: CryptoManager
    
    Determine whether SSL encryption is enabled.
    
    Specified by:
    
    isSslEncryption in interface CryptoManager
    
    Returns:
    
    true if SSL encryption is enabled.
  - getSslProtocols
```
public SortedSet<String> getSslProtocols()
```
    Description copied from interface: CryptoManager
    
    Get the set of enabled SSL protocols.
    
    Specified by:
    
    getSslProtocols in interface CryptoManager
    
    Returns:
    
    The set of enabled SSL protocols.
  - getSslCipherSuites
```
public SortedSet<String> getSslCipherSuites()
```
    Description copied from interface: CryptoManager
    
    Get the set of enabled SSL cipher suites.
    
    Specified by:
    
    getSslCipherSuites in interface CryptoManager
    
    Returns:
    
    The set of enabled SSL cipher suites.
  - newCryptoSuite
```
public CryptoSuite newCryptoSuite(String cipherTransformation,
                                  int cipherKeyLength,
                                  boolean encrypt)
```
    Description copied from interface: CryptoManager
    
    Return a new CryptoSuite for the cipher and key.
    
    Specified by:
    
    newCryptoSuite in interface CryptoManager
    
    Parameters:
    
    cipherTransformation - cipher transformation string specification
    
    cipherKeyLength - length of key in bits
    
    encrypt - true if the user of the crypto suite needs encryption
    
    Returns:
    
    a new CryptoSuite for the cipher and key

Class CryptoManagerImpl

Constructor Summary

Method Summary

Methods inherited from class java.lang.Object

Constructor Detail

CryptoManagerImpl

Method Detail

isConfigurationChangeAcceptable

applyConfigurationChange

getInstanceKeyID

getPreferredMessageDigestAlgorithm

getPreferredMessageDigest

getMessageDigest

digest

digest

digest

digest

getMacEngineKeyEntryID

getMacEngineKeyEntryID

getMacEngine

encrypt

encrypt

getCipherOutputStream

getCipherOutputStream

ensureCipherKeyIsAvailable

decrypt

getCipherInputStream

compress

uncompress

getSslContext

getSslCertNicknames

isSslEncryption

getSslProtocols

getSslCipherSuites

newCryptoSuite