KeyProviderCryptoExtension extends
    KeyProviderExtension<KeyProviderCryptoExtension.CryptoExtension> { public EncryptedKeyVersion reencryptEncryptedKey(EncryptedKeyVersion ekv) throws IOException, GeneralSecurityException { return getExtension().reencryptEncryptedKey(ekv); } protected  KeyProviderCryptoExtension(KeyProvider keyProvider,
      CryptoExtension extension); void warmUpEncryptedKeys(String... keyNames); EncryptedKeyVersion generateEncryptedKey(String encryptionKeyName); KeyVersion decryptEncryptedKey(EncryptedKeyVersion encryptedKey); EncryptedKeyVersion reencryptEncryptedKey(EncryptedKeyVersion ekv); void drain(String keyName); void reencryptEncryptedKeys(List<EncryptedKeyVersion> ekvs); static KeyProviderCryptoExtension createKeyProviderCryptoExtension(
      KeyProvider keyProvider); @Override void close(); static final String EEK; static final String EK; }
@Test public void testReencryptEncryptedKey() throws Exception { final KeyProviderCryptoExtension.EncryptedKeyVersion ek1 = kpExt.generateEncryptedKey(encryptionKey.getName()); final KeyVersion k1 = kpExt.decryptEncryptedKey(ek1); assertEquals(KeyProviderCryptoExtension.EK, k1.getVersionName()); assertEquals(encryptionKey.getMaterial().length, k1.getMaterial().length); kpExt.rollNewVersion(ek1.getEncryptionKeyName()); final KeyProviderCryptoExtension.EncryptedKeyVersion ek2 = kpExt.reencryptEncryptedKey(ek1); assertEquals("Version name of EEK should be EEK", KeyProviderCryptoExtension.EEK, ek2.getEncryptedKeyVersion().getVersionName()); assertEquals("Name of EEK should be encryption key name", ENCRYPTION_KEY_NAME, ek2.getEncryptionKeyName()); assertNotNull("Expected encrypted key material", ek2.getEncryptedKeyVersion().getMaterial()); assertEquals("Length of encryption key material and EEK material should " + "be the same", encryptionKey.getMaterial().length, ek2.getEncryptedKeyVersion().getMaterial().length); if (Arrays.equals(ek2.getEncryptedKeyVersion().getMaterial(), ek1.getEncryptedKeyVersion().getMaterial())) { fail("Re-encrypted EEK should have different material"); } final KeyVersion k2 = kpExt.decryptEncryptedKey(ek2); assertEquals(KeyProviderCryptoExtension.EK, k2.getVersionName()); assertEquals(encryptionKey.getMaterial().length, k2.getMaterial().length); final KeyProviderCryptoExtension.EncryptedKeyVersion ek2a = kpExt.reencryptEncryptedKey(ek1); assertEquals("Version name of EEK should be EEK", KeyProviderCryptoExtension.EEK, ek2a.getEncryptedKeyVersion().getVersionName()); assertEquals("Name of EEK should be encryption key name", ENCRYPTION_KEY_NAME, ek2a.getEncryptionKeyName()); assertNotNull("Expected encrypted key material", ek2a.getEncryptedKeyVersion().getMaterial()); assertEquals("Length of encryption key material and EEK material should " + "be the same", encryptionKey.getMaterial().length, ek2a.getEncryptedKeyVersion().getMaterial().length); if (Arrays.equals(ek2a.getEncryptedKeyVersion().getMaterial(), ek1.getEncryptedKeyVersion().getMaterial())) { fail("Re-encrypted EEK should have different material"); } assertArrayEquals(ek2.getEncryptedKeyVersion().getMaterial(), ek2a.getEncryptedKeyVersion().getMaterial()); final KeyProviderCryptoExtension.EncryptedKeyVersion ek3 = kpExt.reencryptEncryptedKey(ek2); assertEquals("Version name of EEK should be EEK", KeyProviderCryptoExtension.EEK, ek3.getEncryptedKeyVersion().getVersionName()); assertEquals("Name of EEK should be encryption key name", ENCRYPTION_KEY_NAME, ek3.getEncryptionKeyName()); assertNotNull("Expected encrypted key material", ek3.getEncryptedKeyVersion().getMaterial()); assertEquals("Length of encryption key material and EEK material should " + "be the same", encryptionKey.getMaterial().length, ek3.getEncryptedKeyVersion().getMaterial().length); if (Arrays.equals(ek3.getEncryptedKeyVersion().getMaterial(), ek1.getEncryptedKeyVersion().getMaterial())) { fail("Re-encrypted EEK should have different material"); } assertArrayEquals(ek2.getEncryptedKeyVersion().getMaterial(), ek3.getEncryptedKeyVersion().getMaterial()); }