public final class AesKeyWrap extends SymmetricBlockCipher
This algorithm uses the AES symmetric cipher to securely encrypt plaintext key(s) with any associated integrity information and data, such that the combination could be longer than the width of the AES block size (128 bits). It is capable of processing data blocks of 64 bits, using an AES key encryption key (KEK) of length 128, 192, or 256 bits.
An instance of this algorithm can be obtained using the Java Cryptography
Architecture (JCA), by requesting an 'AESWrap' cipher from the
Entrust cryptographic
service provider. This can be done using the following call:
Cipher.getInstance("AESWrap", "Entrust");Although this algorithm is implemented in the JCA as a cipher, it does not support a block mode (mechanism) or a padding mechanism as symmetric cipher implementation do. These concepts do not apply to key wrap algorithms.
The AES key wrap algorithm is designed to wrap or encrypt key data and unwrap or decrypt wrapped key data. The algorithm operates on blocks of 64 bits, and is capable of processing a value of any length, providing the value is a multiple of 64 bits in length. During wrapping, at least one block of data is required; during unwrapping, at least two blocks of data are required.
The AES key wrap algorithm can be configured to use any of the three key sizes supported by the underlying AES symmetric cipher. The choice of key size affects the overall security provided by the key wrap, but it does not alter the description of the key wrap algorithm.
This key wrap implementation accepts keys in 'RAW' format (software keys), or
keys stored on cryptographic hardware devices and accessed via the PKCS#11
interface (PKCS#11 keys). A software-based AES key can be generated using the
AES key generation algorithm (KeyGenerator.getInstance("AES, "Entrust"))
or manually created using an appropriate Key implementation (
javax.crypto.spec.SecretKeySpec). A PKCS#11-based AES key can be
created using the JNIPKCS11
class, and referenced using the
TokenSymmetricKey
class.
The algorithm uses an initial value (IV) to provide an integrity check on the
key data. During wrapping, the IV is encrypted along with the key data, then,
during unwrapping, the IV is decrypted along with the key data. If the
recovered IV does not match what was expected, the key is not accepted as
valid. By default, this implementation uses the default IV (
A6A6A6A6A6A6A6A6). However, a different IV can be configured by
supplying an
AesKeyWrapParameterSpec or an
AesKeyWrapParameters
during initialization. Currently, only IVs of length 64 bits are supported.
Note that a call to retrieve the algorithm parameters will return
null if algorithm parameters were not explicitly set at
algorithm initialization time. If parameters are not explicitly set, the
default IV is still used, but is not returned by getParameters.
This class SHOULD NOT be used directly; it should only be used through the JCA/JCE.
AesKeyWrapParameterSpec,
AesKeyWrapParameters| Constructor and Description |
|---|
AesKeyWrap()
The constructor; creates a new instance of the AES key wrap algorithm.
|
| Modifier and Type | Method and Description |
|---|---|
protected void |
engineSetMode(java.lang.String mode)
This method is not supported for key wrap algorithms; with key wrap
algorithms, a mode of operation is not applicable.
|
protected void |
engineSetPadding(java.lang.String padding)
This method is not supported for key wrap algorithms; with key wrap
algorithms, a padding mechanism is not applicable.
|
engineDoFinal, engineDoFinal, engineGetBlockSize, engineGetIV, engineGetKeySize, engineGetOutputSize, engineGetParameters, engineInit, engineInit, engineInit, engineUnwrap, engineUpdate, engineUpdate, engineUpdateAAD, engineWrappublic AesKeyWrap()
Applications should never use this constructor, instead the key wrap
algorithm should be requested from the appropriate JCA/JCE cryptographic
service provider as follows:
Cipher.getInstance("AESWrap", "Entrust").
protected final void engineSetMode(java.lang.String mode)
throws java.security.NoSuchAlgorithmException
engineSetMode in class SymmetricBlockCiphermode - [FIPS 140-2 control input] ignoredjava.security.NoSuchAlgorithmException - [FIPS 140-2 status output] always thrownprotected final void engineSetPadding(java.lang.String padding)
throws javax.crypto.NoSuchPaddingException
This method is not supported for key wrap algorithms; with key wrap algorithms, a padding mechanism is not applicable.
engineSetPadding in class SymmetricBlockCipherpadding - [FIPS 140-2 control input] ignoredjavax.crypto.NoSuchPaddingException - [FIPS 140-2 status output] always thrown