de.adorsys.datasafe.encrypiton.impl.pathencryption

Class IntegrityPreservingUriEncryption

java.lang.Object

de.adorsys.datasafe.encrypiton.impl.pathencryption.IntegrityPreservingUriEncryption

All Implemented Interfaces:

SymmetricPathEncryptionService

Direct Known Subclasses:

IntegrityPreservingUriEncryptionRuntimeDelegatable

public class IntegrityPreservingUriEncryption
extends Object
implements SymmetricPathEncryptionService

Path encryption service that maintains URI segments integrity. It means that path/to/file is encrypted to cipher(path)/cipher(to)/cipher(file) and each invocation of example: cipher(path) will yield same string, but cipher(path)/cipher(path) will not yield same segments - it will be more like abc/cde and not like abc/abc. Additionally each segment is authenticated against its parent path hash, so attacker can't move a/file to b/file without being detected.

Constructor Summary

Constructors

Constructor and Description
IntegrityPreservingUriEncryption(PathEncryptorDecryptor pathEncryptorDecryptor)

Method Summary

Modifier and Type	Method and Description
Uri	decrypt(AuthPathEncryptionSecretKey pathEncryptionSecretKey, Uri bucketPath) Decrypts each URI segment separately and composes them back in same order.
protected String	decryptorAndDecoder(PathSegmentWithSecretKeyWith keyAndSegment, PathEncryptorDecryptor pathEncryptorDecryptor)
Uri	encrypt(AuthPathEncryptionSecretKey pathEncryptionSecretKey, Uri bucketPath) Encrypts each URI segment separately and composes them back in same order.
protected String	encryptorAndEncoder(PathSegmentWithSecretKeyWith keyAndSegment, PathEncryptorDecryptor pathEncryptorDecryptor)
protected MessageDigest	getDigest() Parent path authentication digest.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

IntegrityPreservingUriEncryption

@Inject
public IntegrityPreservingUriEncryption(PathEncryptorDecryptor pathEncryptorDecryptor)

Method Detail

encrypt

public Uri encrypt(AuthPathEncryptionSecretKey pathEncryptionSecretKey,
                   Uri bucketPath)

Encrypts each URI segment separately and composes them back in same order.

Specified by:

encrypt in interface SymmetricPathEncryptionService

decrypt

public Uri decrypt(AuthPathEncryptionSecretKey pathEncryptionSecretKey,
                   Uri bucketPath)

Decrypts each URI segment separately and composes them back in same order.

Specified by:

decrypt in interface SymmetricPathEncryptionService

getDigest

protected MessageDigest getDigest()

Parent path authentication digest. a/b/c - each path segment on encryption will be authenticated: for a - will be authenticated against `` for b - will be authenticated against `/encrypted(a)` for c - will be authenticated against `/encrypted(a)/encrypted(b)`

decryptorAndDecoder

protected String decryptorAndDecoder(PathSegmentWithSecretKeyWith keyAndSegment,
                                     PathEncryptorDecryptor pathEncryptorDecryptor)

encryptorAndEncoder

protected String encryptorAndEncoder(PathSegmentWithSecretKeyWith keyAndSegment,
                                     PathEncryptorDecryptor pathEncryptorDecryptor)