KeyProviderCryptoExtension extends
    KeyProviderExtension<KeyProviderCryptoExtension.CryptoExtension> { public void reencryptEncryptedKeys(List<EncryptedKeyVersion> ekvs) throws IOException, GeneralSecurityException { getExtension().reencryptEncryptedKeys(ekvs); } protected  KeyProviderCryptoExtension(KeyProvider keyProvider,
      CryptoExtension extension); void warmUpEncryptedKeys(String... keyNames); EncryptedKeyVersion generateEncryptedKey(String encryptionKeyName); KeyVersion decryptEncryptedKey(EncryptedKeyVersion encryptedKey); EncryptedKeyVersion reencryptEncryptedKey(EncryptedKeyVersion ekv); void drain(String keyName); void reencryptEncryptedKeys(List<EncryptedKeyVersion> ekvs); static KeyProviderCryptoExtension createKeyProviderCryptoExtension(
      KeyProvider keyProvider); @Override void close(); static final String EEK; static final String EK; }
@Test public void testReencryptEncryptedKeys() throws Exception { List<EncryptedKeyVersion> ekvs = new ArrayList<>(4); ekvs.add(kpExt.generateEncryptedKey(encryptionKey.getName())); ekvs.add(kpExt.generateEncryptedKey(encryptionKey.getName())); kpExt.rollNewVersion(ekvs.get(0).getEncryptionKeyName()); ekvs.add(kpExt.generateEncryptedKey(encryptionKey.getName())); kpExt.rollNewVersion(ekvs.get(0).getEncryptionKeyName()); ekvs.add(kpExt.generateEncryptedKey(encryptionKey.getName())); List<EncryptedKeyVersion> ekvsOrig = new ArrayList<>(ekvs.size()); for (EncryptedKeyVersion ekv : ekvs) { ekvsOrig.add(new EncryptedKeyVersion(ekv.getEncryptionKeyName(), ekv.getEncryptionKeyVersionName(), ekv.getEncryptedKeyIv(), ekv.getEncryptedKeyVersion())); } kpExt.reencryptEncryptedKeys(ekvs); for (int i = 0; i < ekvs.size(); ++i) { final EncryptedKeyVersion ekv = ekvs.get(i); final EncryptedKeyVersion orig = ekvsOrig.get(i); assertEquals("Version name should be EEK", KeyProviderCryptoExtension.EEK, ekv.getEncryptedKeyVersion().getVersionName()); assertEquals("Encryption key name should be " + ENCRYPTION_KEY_NAME, ENCRYPTION_KEY_NAME, ekv.getEncryptionKeyName()); assertNotNull("Expected encrypted key material", ekv.getEncryptedKeyVersion().getMaterial()); assertEquals("Length of encryption key material and EEK material should " + "be the same", encryptionKey.getMaterial().length, ekv.getEncryptedKeyVersion().getMaterial().length); assertFalse( "Encrypted key material should not equal encryption key material", Arrays.equals(ekv.getEncryptedKeyVersion().getMaterial(), encryptionKey.getMaterial())); if (i < 3) { assertFalse("Re-encrypted EEK should have different material", Arrays.equals(ekv.getEncryptedKeyVersion().getMaterial(), orig.getEncryptedKeyVersion().getMaterial())); } else { assertTrue("Re-encrypted EEK should have same material", Arrays.equals(ekv.getEncryptedKeyVersion().getMaterial(), orig.getEncryptedKeyVersion().getMaterial())); } final KeyVersion kv = kpExt.decryptEncryptedKey(ekv); assertEquals(KeyProviderCryptoExtension.EK, kv.getVersionName()); KeyVersion kv1 = kpExt.decryptEncryptedKey(ekv); assertArrayEquals(kv.getMaterial(), kv1.getMaterial()); final KeyVersion origKv = kpExt.decryptEncryptedKey(orig); assertTrue("Returned EEK and original EEK should both decrypt to the " + "same kv.", Arrays.equals(origKv.getMaterial(), kv.getMaterial())); } }