com.google.crypto.tink

Class KeysetHandle

java.lang.Object

com.google.crypto.tink.KeysetHandle

public final class KeysetHandle
extends Object

A KeysetHandle provides abstracted access to Keyset, to limit the exposure of actual protocol buffers that hold sensitive key material.

This class allows reading and writing encrypted keysets. Users that want to read or write can use the restricted API CleartextKeysetHandle. Users can also load keysets that don't contain any secret key material with NoSecretKeysetHandle.

Since:

1.0.0

Method Summary

Modifier and Type	Method and Description
static void	assertEnoughEncryptedKeyMaterial(EncryptedKeyset keyset) Validates that an encrypted keyset contains enough key material to build a keyset on.
static void	assertEnoughKeyMaterial(Keyset keyset) Validates that an keyset handle contains enough key material to build a keyset on.
static KeysetHandle	generateNew(KeyTemplate keyTemplate)
KeysetInfo	getKeysetInfo()
KeysetHandle	getPublicKeysetHandle() If the managed keyset contains private keys, returns a KeysetHandle of the public keys.
static KeysetHandle	read(KeysetReader reader, Aead masterKey) Tries to create a KeysetHandle from an encrypted keyset obtained via reader.
String	toString() Extracts and returns the string representation of the KeysetInfo of the managed keyset.
void	write(KeysetWriter keysetWriter, Aead masterKey) Serializes, encrypts with masterKey and writes the keyset to outputStream.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Method Detail

getKeysetInfo

public KeysetInfo getKeysetInfo()

Returns:

the KeysetInfo that doesn't contain actual key material.

generateNew

public static final KeysetHandle generateNew(KeyTemplate keyTemplate)
                                      throws GeneralSecurityException

Returns:

a new KeysetHandle that contains a single fresh key generated according to keyTemplate.

Throws:

GeneralSecurityException

read

public static final KeysetHandle read(KeysetReader reader,
                                      Aead masterKey)
                               throws GeneralSecurityException,
                                      IOException

Tries to create a KeysetHandle from an encrypted keyset obtained via reader.

Users that need to load cleartext keysets can use CleartextKeysetHandle.

Returns:

a new KeysetHandle from encryptedKeysetProto that was encrypted with masterKey

Throws:

GeneralSecurityException - if cannot decrypt the keyset or it doesn't contain encrypted key material

IOException

write

public void write(KeysetWriter keysetWriter,
                  Aead masterKey)
           throws GeneralSecurityException,
                  IOException

Serializes, encrypts with masterKey and writes the keyset to outputStream.

Throws:

GeneralSecurityException

IOException

getPublicKeysetHandle

public KeysetHandle getPublicKeysetHandle()
                                   throws GeneralSecurityException

If the managed keyset contains private keys, returns a KeysetHandle of the public keys.

Throws:

GenernalSecurityException - if the managed keyset is null or if it contains any non-private keys.

GeneralSecurityException

toString

public String toString()

Extracts and returns the string representation of the KeysetInfo of the managed keyset.

Overrides:

toString in class Object

assertEnoughKeyMaterial

public static void assertEnoughKeyMaterial(Keyset keyset)
                                    throws GeneralSecurityException

Validates that an keyset handle contains enough key material to build a keyset on.

Throws:

GeneralSecurityException

assertEnoughEncryptedKeyMaterial

public static void assertEnoughEncryptedKeyMaterial(EncryptedKeyset keyset)
                                             throws GeneralSecurityException

Validates that an encrypted keyset contains enough key material to build a keyset on.

Throws:

GeneralSecurityException