ExternalKeyProxy implements KeyProxy { @Override public boolean matchesCanary(final EncryptionKeyCanary canary) { return matchesCanary(encryptionKeyMetadata, canary); } ExternalKeyProxy(final EncryptionKeyMetadata encryptionKeyMetadata, final EncryptionProvider encryptionProvider); @Override Key getKey(); @Override boolean matchesCanary(final EncryptionKeyCanary canary); @Override List<Byte> getSalt();  }
@Test public void matchesCanary_shouldReturnTrue_IfTheCanaryDecryptsToTheCanaryValue() throws Exception { when(encryptionKeyCanary.getEncryptedCanaryValue()).thenReturn("value".getBytes(UTF_8)); when(encryptionKeyCanary.getNonce()).thenReturn("nonce".getBytes(UTF_8)); when(encryptionKeyMetadata.getEncryptionKeyName()).thenReturn("name"); when(encryptionProvider.decrypt(any(), any(), any())).thenReturn(EncryptionKeyCanaryMapper.CANARY_VALUE); subject = new ExternalKeyProxy(encryptionKeyMetadata, encryptionProvider); assertTrue(subject.matchesCanary(encryptionKeyCanary)); final ArgumentCaptor<EncryptionKey> argument = ArgumentCaptor.forClass(EncryptionKey.class); verify(encryptionProvider).decrypt(argument.capture(), eq("value".getBytes(UTF_8)), eq("nonce".getBytes(UTF_8))); assertEquals(encryptionProvider, argument.getValue().getProvider()); assertEquals("name", argument.getValue().getEncryptionKeyName()); }
@Test public void matchesCanary_shouldReturnFalse_IfTheCanaryDoesNotDecryptToTheCanaryValue() throws Exception { when(encryptionProvider.decrypt(any(), any(), any())).thenReturn("garbage"); subject = new ExternalKeyProxy(encryptionKeyMetadata, encryptionProvider); assertFalse(subject.matchesCanary(encryptionKeyCanary)); }
@Test public void matchesCanary_shouldReturnTrue_IfTheCanaryDecryptsToTheDeprecatedCanaryValue() throws Exception { when(encryptionProvider.decrypt(any(), any(), any())).thenReturn(EncryptionKeyCanaryMapper.DEPRECATED_CANARY_VALUE); subject = new ExternalKeyProxy(encryptionKeyMetadata, encryptionProvider); assertTrue(subject.matchesCanary(encryptionKeyCanary)); }
@Test public void matchesCanary_shouldReturnFalse_IfTheInternalKeyWasWrong() throws Exception { when(encryptionProvider.decrypt(any(), any(), any())).thenThrow(AEADBadTagException.class); subject = new ExternalKeyProxy(encryptionKeyMetadata, encryptionProvider); assertFalse(subject.matchesCanary(encryptionKeyCanary)); }
@Test public void matchesCanary_shouldReturnFalseIfInputDataCouldNotBeProccessed_AndC_DecryptReturns_0x40() throws Exception { when(encryptionProvider.decrypt(any(), any(), any())).thenThrow(new IllegalBlockSizeException("returns 0x40")); subject = new ExternalKeyProxy(encryptionKeyMetadata, encryptionProvider); assertFalse(subject.matchesCanary(encryptionKeyCanary)); }
@Test public void matchesCanary_shouldThrowIncorrectKeyException_IfHSMKeyWasWrong() throws Exception { when(encryptionProvider.decrypt(any(), any(), any())).thenThrow(new IllegalBlockSizeException("something bad happened")); subject = new ExternalKeyProxy(encryptionKeyMetadata, encryptionProvider); try { subject.matchesCanary(encryptionKeyCanary); fail("Expected IncorrectKeyException, got none"); } catch (final IncorrectKeyException e) { } catch (final RuntimeException e) { fail("Wrong exception. Expected IncorrectKeyException but got " + e.getClass().toString()); } }
@Test public void matchesCanary_shouldThrowIncorrectKeyException_IfExceptionIsThrown() throws Exception { when(encryptionProvider.decrypt(any(), any(), any())).thenThrow(new Exception("something bad happened")); subject = new ExternalKeyProxy(encryptionKeyMetadata, encryptionProvider); try { subject.matchesCanary(encryptionKeyCanary); fail("Expected IncorrectKeyException, got none"); } catch (final IncorrectKeyException e) { } catch (final RuntimeException e) { fail("Wrong exception. Expected IncorrectKeyException but got " + e.getClass().toString()); } }