@Test public void testRekey() throws Exception { BasicEncryptionTransformFactory factory = new BasicEncryptionTransformFactory(); factory.setCryptoProvider(provider); factory.setMasterEncryptionKey(oldKey); ByteArrayOutputStream out = new ByteArrayOutputStream(); Map<String, String> metadata = new HashMap<String, String>(); metadata.put("name1", "value1"); metadata.put("name2", "value2"); BasicEncryptionOutputTransform outTransform = factory .getOutputTransform(out, metadata); InputStream classin = this.getClass().getClassLoader() .getResourceAsStream("uncompressed.txt"); ByteArrayOutputStream classByteStream = new ByteArrayOutputStream(); byte[] buffer = new byte[4096]; int c = 0; while ((c = classin.read(buffer)) != -1) { classByteStream.write(buffer, 0, c); } byte[] uncompressedData = classByteStream.toByteArray(); classin.close(); OutputStream encryptedStream = outTransform.getEncodedOutputStream(); encryptedStream.write(uncompressedData); encryptedStream.close(); byte[] encryptedObject = out.toByteArray(); Map<String, String> objectMetadata = outTransform.getEncodedMetadata(); factory.setMasterEncryptionKey(masterKey); Map<String, String> objectMetadata2 = factory.rekey(objectMetadata); assertNotEquals("Master key ID should have changed", objectMetadata.get(TransformConstants.META_ENCRYPTION_KEY_ID), objectMetadata2.get(TransformConstants.META_ENCRYPTION_KEY_ID)); assertNotEquals("Encrypted object key should have changed", objectMetadata.get(TransformConstants.META_ENCRYPTION_OBJECT_KEY), objectMetadata2.get(TransformConstants.META_ENCRYPTION_OBJECT_KEY)); ByteArrayInputStream encodedInput = new ByteArrayInputStream(encryptedObject); InputTransform inTransform = factory.getInputTransform( outTransform.getTransformConfig(), encodedInput, objectMetadata2); InputStream inStream = inTransform.getDecodedInputStream(); ByteArrayOutputStream decodedOut = new ByteArrayOutputStream(); while ((c = inStream.read(buffer)) != -1) { decodedOut.write(buffer, 0, c); } byte[] decodedData = decodedOut.toByteArray(); assertArrayEquals("Decrypted output incorrect", uncompressedData, decodedData); }
@Override public Map<String, String> rekey(Map<String, String> metadata) throws TransformException { String oldKeyId = metadata .get(TransformConstants.META_ENCRYPTION_KEY_ID); if (oldKeyId == null) { throw new TransformException( "Metadata does not contain a master key ID"); } if (oldKeyId.equals(masterEncryptionKeyFingerprint)) { logger.info("Object is already using the current master key"); throw new DoesNotNeedRekeyException( "Object is already using the current master key"); } if (!masterDecryptionKeys.containsKey(oldKeyId)) { throw new TransformException("Master key with fingerprint " + oldKeyId + " not found"); } KeyPair oldKey = masterDecryptionKeys.get(oldKeyId); String encodedKey = metadata.get(TransformConstants.META_ENCRYPTION_OBJECT_KEY); if(encodedKey == null) { throw new TransformException("Encrypted object key not found"); } String algorithm = getEncryptionAlgorithm(); SecretKey objectKey = KeyUtils.decryptKey(encodedKey, algorithm, provider, oldKey.getPrivate()); String newKey; try { newKey = KeyUtils.encryptKey(objectKey, provider, masterEncryptionKey.getPublic()); } catch (GeneralSecurityException e) { throw new TransformException("Could not re-encrypt key: " + e, e); } Map<String, String> newMetadata = new HashMap<String, String>(); newMetadata.putAll(metadata); newMetadata.remove(TransformConstants.META_ENCRYPTION_META_SIG); newMetadata.put(TransformConstants.META_ENCRYPTION_OBJECT_KEY, newKey); newMetadata.put(TransformConstants.META_ENCRYPTION_KEY_ID, masterEncryptionKeyFingerprint); String signature = KeyUtils.signMetadata(newMetadata, (RSAPrivateKey) masterEncryptionKey.getPrivate(), provider); newMetadata.put(TransformConstants.META_ENCRYPTION_META_SIG, signature); return newMetadata; }
BasicEncryptionTransformFactory extends
        EncryptionTransformFactory<BasicEncryptionOutputTransform, BasicEncryptionInputTransform> { @Override public Map<String, String> rekey(Map<String, String> metadata) throws TransformException { String oldKeyId = metadata .get(TransformConstants.META_ENCRYPTION_KEY_ID); if (oldKeyId == null) { throw new TransformException( "Metadata does not contain a master key ID"); } if (oldKeyId.equals(masterEncryptionKeyFingerprint)) { logger.info("Object is already using the current master key"); throw new DoesNotNeedRekeyException( "Object is already using the current master key"); } if (!masterDecryptionKeys.containsKey(oldKeyId)) { throw new TransformException("Master key with fingerprint " + oldKeyId + " not found"); } KeyPair oldKey = masterDecryptionKeys.get(oldKeyId); String encodedKey = metadata.get(TransformConstants.META_ENCRYPTION_OBJECT_KEY); if(encodedKey == null) { throw new TransformException("Encrypted object key not found"); } String algorithm = getEncryptionAlgorithm(); SecretKey objectKey = KeyUtils.decryptKey(encodedKey, algorithm, provider, oldKey.getPrivate()); String newKey; try { newKey = KeyUtils.encryptKey(objectKey, provider, masterEncryptionKey.getPublic()); } catch (GeneralSecurityException e) { throw new TransformException("Could not re-encrypt key: " + e, e); } Map<String, String> newMetadata = new HashMap<String, String>(); newMetadata.putAll(metadata); newMetadata.remove(TransformConstants.META_ENCRYPTION_META_SIG); newMetadata.put(TransformConstants.META_ENCRYPTION_OBJECT_KEY, newKey); newMetadata.put(TransformConstants.META_ENCRYPTION_KEY_ID, masterEncryptionKeyFingerprint); String signature = KeyUtils.signMetadata(newMetadata, (RSAPrivateKey) masterEncryptionKey.getPrivate(), provider); newMetadata.put(TransformConstants.META_ENCRYPTION_META_SIG, signature); return newMetadata; } }
BasicEncryptionTransformFactory extends
        EncryptionTransformFactory<BasicEncryptionOutputTransform, BasicEncryptionInputTransform> { @Override public Map<String, String> rekey(Map<String, String> metadata) throws TransformException { String oldKeyId = metadata .get(TransformConstants.META_ENCRYPTION_KEY_ID); if (oldKeyId == null) { throw new TransformException( "Metadata does not contain a master key ID"); } if (oldKeyId.equals(masterEncryptionKeyFingerprint)) { logger.info("Object is already using the current master key"); throw new DoesNotNeedRekeyException( "Object is already using the current master key"); } if (!masterDecryptionKeys.containsKey(oldKeyId)) { throw new TransformException("Master key with fingerprint " + oldKeyId + " not found"); } KeyPair oldKey = masterDecryptionKeys.get(oldKeyId); String encodedKey = metadata.get(TransformConstants.META_ENCRYPTION_OBJECT_KEY); if(encodedKey == null) { throw new TransformException("Encrypted object key not found"); } String algorithm = getEncryptionAlgorithm(); SecretKey objectKey = KeyUtils.decryptKey(encodedKey, algorithm, provider, oldKey.getPrivate()); String newKey; try { newKey = KeyUtils.encryptKey(objectKey, provider, masterEncryptionKey.getPublic()); } catch (GeneralSecurityException e) { throw new TransformException("Could not re-encrypt key: " + e, e); } Map<String, String> newMetadata = new HashMap<String, String>(); newMetadata.putAll(metadata); newMetadata.remove(TransformConstants.META_ENCRYPTION_META_SIG); newMetadata.put(TransformConstants.META_ENCRYPTION_OBJECT_KEY, newKey); newMetadata.put(TransformConstants.META_ENCRYPTION_KEY_ID, masterEncryptionKeyFingerprint); String signature = KeyUtils.signMetadata(newMetadata, (RSAPrivateKey) masterEncryptionKey.getPrivate(), provider); newMetadata.put(TransformConstants.META_ENCRYPTION_META_SIG, signature); return newMetadata; } BasicEncryptionTransformFactory();  BasicEncryptionTransformFactory(KeyPair masterEncryptionKey, 
            Set<KeyPair> masterDecryptionKeys);  BasicEncryptionTransformFactory(KeyPair masterEncryptionKey, 
            Set<KeyPair> masterDecryptionKeys, Provider provider); }
BasicEncryptionTransformFactory extends
        EncryptionTransformFactory<BasicEncryptionOutputTransform, BasicEncryptionInputTransform> { @Override public Map<String, String> rekey(Map<String, String> metadata) throws TransformException { String oldKeyId = metadata .get(TransformConstants.META_ENCRYPTION_KEY_ID); if (oldKeyId == null) { throw new TransformException( "Metadata does not contain a master key ID"); } if (oldKeyId.equals(masterEncryptionKeyFingerprint)) { logger.info("Object is already using the current master key"); throw new DoesNotNeedRekeyException( "Object is already using the current master key"); } if (!masterDecryptionKeys.containsKey(oldKeyId)) { throw new TransformException("Master key with fingerprint " + oldKeyId + " not found"); } KeyPair oldKey = masterDecryptionKeys.get(oldKeyId); String encodedKey = metadata.get(TransformConstants.META_ENCRYPTION_OBJECT_KEY); if(encodedKey == null) { throw new TransformException("Encrypted object key not found"); } String algorithm = getEncryptionAlgorithm(); SecretKey objectKey = KeyUtils.decryptKey(encodedKey, algorithm, provider, oldKey.getPrivate()); String newKey; try { newKey = KeyUtils.encryptKey(objectKey, provider, masterEncryptionKey.getPublic()); } catch (GeneralSecurityException e) { throw new TransformException("Could not re-encrypt key: " + e, e); } Map<String, String> newMetadata = new HashMap<String, String>(); newMetadata.putAll(metadata); newMetadata.remove(TransformConstants.META_ENCRYPTION_META_SIG); newMetadata.put(TransformConstants.META_ENCRYPTION_OBJECT_KEY, newKey); newMetadata.put(TransformConstants.META_ENCRYPTION_KEY_ID, masterEncryptionKeyFingerprint); String signature = KeyUtils.signMetadata(newMetadata, (RSAPrivateKey) masterEncryptionKey.getPrivate(), provider); newMetadata.put(TransformConstants.META_ENCRYPTION_META_SIG, signature); return newMetadata; } BasicEncryptionTransformFactory();  BasicEncryptionTransformFactory(KeyPair masterEncryptionKey, 
            Set<KeyPair> masterDecryptionKeys);  BasicEncryptionTransformFactory(KeyPair masterEncryptionKey, 
            Set<KeyPair> masterDecryptionKeys, Provider provider); void setMasterEncryptionKey(KeyPair pair); void addMasterDecryptionKey(KeyPair pair); @Override Map<String, String> rekey(Map<String, String> metadata); @Override BasicEncryptionOutputTransform getOutputTransform(
            OutputStream streamToEncodeTo, Map<String, String> metadataToEncode); @Override BasicEncryptionOutputTransform getOutputTransform(
            InputStream streamToEncode, Map<String, String> metadataToEncode); @Override BasicEncryptionInputTransform getInputTransform(
            String transformConfig, InputStream streamToDecode,
            Map<String, String> metadata); }
BasicEncryptionTransformFactory extends
        EncryptionTransformFactory<BasicEncryptionOutputTransform, BasicEncryptionInputTransform> { @Override public Map<String, String> rekey(Map<String, String> metadata) throws TransformException { String oldKeyId = metadata .get(TransformConstants.META_ENCRYPTION_KEY_ID); if (oldKeyId == null) { throw new TransformException( "Metadata does not contain a master key ID"); } if (oldKeyId.equals(masterEncryptionKeyFingerprint)) { logger.info("Object is already using the current master key"); throw new DoesNotNeedRekeyException( "Object is already using the current master key"); } if (!masterDecryptionKeys.containsKey(oldKeyId)) { throw new TransformException("Master key with fingerprint " + oldKeyId + " not found"); } KeyPair oldKey = masterDecryptionKeys.get(oldKeyId); String encodedKey = metadata.get(TransformConstants.META_ENCRYPTION_OBJECT_KEY); if(encodedKey == null) { throw new TransformException("Encrypted object key not found"); } String algorithm = getEncryptionAlgorithm(); SecretKey objectKey = KeyUtils.decryptKey(encodedKey, algorithm, provider, oldKey.getPrivate()); String newKey; try { newKey = KeyUtils.encryptKey(objectKey, provider, masterEncryptionKey.getPublic()); } catch (GeneralSecurityException e) { throw new TransformException("Could not re-encrypt key: " + e, e); } Map<String, String> newMetadata = new HashMap<String, String>(); newMetadata.putAll(metadata); newMetadata.remove(TransformConstants.META_ENCRYPTION_META_SIG); newMetadata.put(TransformConstants.META_ENCRYPTION_OBJECT_KEY, newKey); newMetadata.put(TransformConstants.META_ENCRYPTION_KEY_ID, masterEncryptionKeyFingerprint); String signature = KeyUtils.signMetadata(newMetadata, (RSAPrivateKey) masterEncryptionKey.getPrivate(), provider); newMetadata.put(TransformConstants.META_ENCRYPTION_META_SIG, signature); return newMetadata; } BasicEncryptionTransformFactory();  BasicEncryptionTransformFactory(KeyPair masterEncryptionKey, 
            Set<KeyPair> masterDecryptionKeys);  BasicEncryptionTransformFactory(KeyPair masterEncryptionKey, 
            Set<KeyPair> masterDecryptionKeys, Provider provider); void setMasterEncryptionKey(KeyPair pair); void addMasterDecryptionKey(KeyPair pair); @Override Map<String, String> rekey(Map<String, String> metadata); @Override BasicEncryptionOutputTransform getOutputTransform(
            OutputStream streamToEncodeTo, Map<String, String> metadataToEncode); @Override BasicEncryptionOutputTransform getOutputTransform(
            InputStream streamToEncode, Map<String, String> metadataToEncode); @Override BasicEncryptionInputTransform getInputTransform(
            String transformConfig, InputStream streamToDecode,
            Map<String, String> metadata); public KeyPair masterEncryptionKey; }