Class CryptographicEngine

java.lang.Object

com.sath.idhub.util.CryptographicEngine

public class CryptographicEngine
extends Object

Common cryptographic engine for managing Envelope Encryption across services. Uses native Java JCE classes (AES/GCM/NoPadding).

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final record	CryptographicEngine.CryptoResult
static final record	CryptographicEngine.WrappedKeyResult

Constructor Summary

Constructors

Constructor	Description
CryptographicEngine()

Method Summary

Modifier and Type	Method	Description
static String	decryptData(String cipherTextBase64, byte[] rawDek, String ivBase64)	Decrypts encrypted database records using the active Tenant DEK.
static CryptographicEngine.CryptoResult	encryptData(String plainText, byte[] rawDek)	Encrypts plain-text configuration strings using the active Tenant DEK.
static byte[]	generateDEK()	Generates a random, high-entropy 256-bit AES key for a new tenant (DEK).
static byte[]	unwrapDEK(String encryptedDekBase64, byte[] masterKek, String ivBase64)	Decrypts (unwraps) the Tenant DEK using the Master KEK.
static CryptographicEngine.WrappedKeyResult	wrapDEK(byte[] rawDek, byte[] masterKek)	Encrypts (wraps) the Tenant DEK using the Master KEK.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

CryptographicEngine

public CryptographicEngine()

Method Details

generateDEK

public static byte[] generateDEK()
                          throws NoSuchAlgorithmException

Generates a random, high-entropy 256-bit AES key for a new tenant (DEK).

Throws:

NoSuchAlgorithmException

wrapDEK

public static CryptographicEngine.WrappedKeyResult wrapDEK(byte[] rawDek,
 byte[] masterKek)
                                                    throws NoSuchPaddingException,
NoSuchAlgorithmException,
InvalidAlgorithmParameterException,
InvalidKeyException,
IllegalBlockSizeException,
BadPaddingException

Encrypts (wraps) the Tenant DEK using the Master KEK.

Throws:

NoSuchPaddingException

NoSuchAlgorithmException

InvalidAlgorithmParameterException

InvalidKeyException

IllegalBlockSizeException

BadPaddingException

unwrapDEK

public static byte[] unwrapDEK(String encryptedDekBase64,
 byte[] masterKek,
 String ivBase64)
                        throws NoSuchPaddingException,
NoSuchAlgorithmException,
InvalidAlgorithmParameterException,
InvalidKeyException,
IllegalBlockSizeException,
BadPaddingException

Decrypts (unwraps) the Tenant DEK using the Master KEK.

Throws:

NoSuchPaddingException

NoSuchAlgorithmException

InvalidAlgorithmParameterException

InvalidKeyException

IllegalBlockSizeException

BadPaddingException

encryptData

public static CryptographicEngine.CryptoResult encryptData(String plainText,
 byte[] rawDek)
                                                    throws NoSuchPaddingException,
NoSuchAlgorithmException,
InvalidAlgorithmParameterException,
InvalidKeyException,
IllegalBlockSizeException,
BadPaddingException

Encrypts plain-text configuration strings using the active Tenant DEK.

Throws:

NoSuchPaddingException

NoSuchAlgorithmException

InvalidAlgorithmParameterException

InvalidKeyException

IllegalBlockSizeException

BadPaddingException

decryptData

public static String decryptData(String cipherTextBase64,
 byte[] rawDek,
 String ivBase64)
                          throws NoSuchPaddingException,
NoSuchAlgorithmException,
InvalidAlgorithmParameterException,
InvalidKeyException,
IllegalBlockSizeException,
BadPaddingException

Decrypts encrypted database records using the active Tenant DEK.

Throws:

NoSuchPaddingException

NoSuchAlgorithmException

InvalidAlgorithmParameterException

InvalidKeyException

IllegalBlockSizeException

BadPaddingException