public abstract class RecipientInfo extends java.lang.Object implements ASN1Type
The CMS Cryptographic Message Syntax
specifies the RecipientInfo type for collecting all recipient-related
information about some particular recipient a CMS EnvelopedData or
CMS AuthenticatedData shall be sent to.
The RecipientInfo type depends on the key management algorithm used for the
recipient of an EnvelopedData or AuthenticatedData.
CMS provides three alternatives:
KeyTransRecipientInfo for the public key of the recipient´s
certificate, identified by IssuerAndSerialNumber. CMS recommends to use RSA for encrypting
the content encryption key.
KeyAgreeRecipientInfo may transfer the encrypted content
encryption key to one or more recipient using the same key
agreement algorithm and domain parameters for that algorithm.
CMS recommends to use ephemeral-static DH or ECDH with an
ephemeral sender key
KEKRecipientInfo using a CMS key wrap algorithm like
Triple-DES key wrap or RC2 key wrap.
| Modifier and Type | Field and Description |
|---|---|
static int |
KEK_RECIPIENT_INFO
The CMS RecipientInfo type
KEKRecipientInfo. |
static int |
KEY_AGREE_RECIPIENT_INFO
The CMS RecipientInfo type
KeyAgreeRecipientInfo. |
static int |
KEY_TRANSPORT_RECIPIENT_INFO
The CMS RecipientInfo type
KeyTransRecipientInfo. |
protected AlgorithmID |
keyEncryptionAlgorithm_
The algorithm used for encrypting the content encryption key.
|
static int |
OTHER_RECIPIENT_INFO
The CMS RecipientInfo type
OtherRecipientInfo. |
static int |
PASSWORD_RECIPIENT_INFO
The CMS RecipientInfo type
PasswordRecipientInfo. |
protected SecurityProvider |
securityProvider_
The SecurityProvider providing the required cryptographic engines.
|
protected int |
version_
The CMS version this RecipientInfo represents.
|
| Modifier | Constructor and Description |
|---|---|
protected |
RecipientInfo()
Creates an empty RecipientInfo.
|
| Modifier and Type | Method and Description |
|---|---|
javax.crypto.SecretKey |
decryptKey(java.security.Key key)
Decrypts the encrypted content-encryption key this RecipientInfo holds
for the given recipient.
|
javax.crypto.SecretKey |
decryptKey(java.security.Key key,
KeyIdentifier recipientIdentifier)
Decrypts the encrypted content-encryption key this RecipientInfo holds
for the given recipient.
|
abstract javax.crypto.SecretKey |
decryptKey(java.security.Key key,
KeyIdentifier keyidentifier,
java.lang.String algorithmName)
Decrypts the encrypted content-encryption key this RecipientInfo holds for the given recipient.
|
static ASN1Object |
encodeSequence(java.util.List<RecipientInfo> ris)
Encode the list of RecipientInfos into an ASN1 SET.
|
abstract void |
encryptKey(javax.crypto.SecretKey cek)
Encrypts the given secret content encryption key for the recipient(s) this
RecipientInfo represents.
|
abstract byte[] |
getEncryptedKey(KeyIdentifier recipientIdentifier)
Returns the encrypted content-encryption key for the recipient with
the given keyIdentfier.
|
AlgorithmID |
getKeyEncryptionAlgorithm()
Returns the key-encryption algorithm used for encrypting
the content-encryption key with the recipient's public key.
|
abstract KeyIdentifier[] |
getRecipientIdentifiers()
Returns the key identifier(s) belonging to the recipient(s) of this
RecipientInfo.
|
int |
getRecipientInfoType()
Returns the type of the recipient info.
|
int |
getVersion()
Returns the CMS version this RecipientInfo represents.
|
boolean |
isPasswordRequired() |
abstract boolean |
isRecipientInfoFor(KeyIdentifier recipientIdentifier)
Checks if this is a RecipientInfo for the recipient identified by the
given key identifier.
|
abstract CertificateIdentifier |
isRecipientInfoFor(X509Certificate recipientCertificate)
Checks if this is a RecipientInfo for the given recipient certificate.
|
abstract RecipientInfo |
makeClone() |
static RecipientInfo |
parseRecipientInfo(ASN1Object obj)
Parses a RecipientInfo from the supplied ASN1Object.
|
static RecipientInfo |
parseRecipientInfo(java.io.InputStream is)
Parses a DER encoded RecipientInfo from the supplied input stream.
|
static RecipientInfo[] |
parseRecipientInfos(java.io.InputStream is)
Parses a SET of DER encoded RecipientInfos from the supplied input stream.
|
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, waitdecode, toASN1Objectpublic static final int KEY_TRANSPORT_RECIPIENT_INFO
KeyTransRecipientInfo.public static final int KEY_AGREE_RECIPIENT_INFO
KeyAgreeRecipientInfo.public static final int KEK_RECIPIENT_INFO
KEKRecipientInfo.public static final int PASSWORD_RECIPIENT_INFO
PasswordRecipientInfo.public static final int OTHER_RECIPIENT_INFO
OtherRecipientInfo.protected int version_
protected AlgorithmID keyEncryptionAlgorithm_
protected SecurityProvider securityProvider_
public int getVersion()
public abstract void encryptKey(javax.crypto.SecretKey cek)
throws CMSException
cek - the symmetric content encryption key to encryptCMSException - if the key encryption process fails for some
reason (e.g. the key-encryption algorithm used
by this RecipientInfo is not implemented,
or the recipient´s key is invalid, ...)public javax.crypto.SecretKey decryptKey(java.security.Key key,
KeyIdentifier recipientIdentifier)
throws java.security.InvalidKeyException,
CMSException
The recovered key is returned as SecretKey.
key - the recipient´s key used to decrypt the encrypted content-encryption key.recipientIdentifier - information to be used for getting the right encrypted content
encryption key for the right recipient; may be required if this
RecipientInfo holds content encryption keys for more than one
recipient (see KeyAgreeRecipientInfo)CMSException - if the key-decryption process fails for some reason (e.g. the
key-encryption algorithm used by this RecipientInfo
is not supported, a padding error occurs during decryption...java.security.InvalidKeyException - if the specified private key is not validpublic abstract javax.crypto.SecretKey decryptKey(java.security.Key key,
KeyIdentifier keyidentifier,
java.lang.String algorithmName)
throws java.security.InvalidKeyException,
CMSException
Parameters:
key - - the recipient´s key used to decrypt the encrypted content-encryption key.keyidentifier - - information to be used for getting the right encrypted content encryption key for the right
recipient; may be required if this RecipientInfo holds content encryption keys for more than one recipient
(see KeyAgreeRecipientInfo)algorithmName - - the name of the content encryption key (e.g. "DES") to be set for the SecretKey object
created by this methodCMSException - - if the key-decryption process fails for some reason (e.g. the key-encryption algorithm used by this
RecipientInfo is not supported, a padding error occurs during decryption... InvalidKeyException - if the
specified private key is not validjava.security.InvalidKeyExceptionpublic javax.crypto.SecretKey decryptKey(java.security.Key key)
throws java.security.InvalidKeyException,
CMSException
The recovered key is returned as SecretKey.
Note that a KeyAgreeRecipientInfo may
hold recipient encrypted keys for more than only one recipient; so it may
be appropriate to specify a recipient identifier when decrypting the encrypted content-encryption key. Otherwise
all included recipient encrypted keys may be tried to be decrypted with the
given key encryption key, which might give some overhead.
key - the recipient´s key used to decrypt the encrypted content-encryption key.CMSException - if the key-decryption process fails for some reason (e.g. the
key-encryption algorithm used by this RecipientInfo
is not supported, a padding error occurs during decryption...java.security.InvalidKeyException - if the specified private key is not validpublic abstract byte[] getEncryptedKey(KeyIdentifier recipientIdentifier) throws CMSException
A RecipientInfo only may hold one single encrypted content-encryption
key (e.g. KeyTransRecipientInfo),
but may hold encrypted content-encryption keys for more than one
recipients (e.g. KeyAgreeRecipientInfo),
each of them identified by its corresponding key identifier.
recipientIdentifier - information to be used for getting the right encrypted content
encryption key for the right recipient; may be required if this
RecipientInfo holds content encryption keys for more than one
recipient (see KeyAgreeRecipientInfo)CMSException - if no recipient with this key identifier is includedpublic abstract KeyIdentifier[] getRecipientIdentifiers()
A RecipientInfo only may represent only one single recipient
(e.g. KeyTransRecipientInfo),
but may represent more than one recipients (e.g. KeyAgreeRecipientInfo),
each of them identified by its corresponding key identifier.
public abstract boolean isRecipientInfoFor(KeyIdentifier recipientIdentifier)
recipientIdentifier - the key identifier belonging to the recipient
we are searching fortrue if this RecipientInfo belongs to the particular
recipient in mind, false if notpublic abstract CertificateIdentifier isRecipientInfoFor(X509Certificate recipientCertificate)
This method only may be used for asking if a KeyTransRecipientInfo or KeyAgreeRecipientInfo belongs to the recipient with the given
certificate. Class KEKRecipientInfo
has to implement this method, too, but always will return null
since the KEKRecipientInfo does not use certificates.
recipientCertificate - the certificate of the recipientnull
if notpublic int getRecipientInfoType()
KEY_TRANSPORT_RECIPIENT_INFO (0) or
KEY_AGREE_RECIPIENT_INFO (1) or
KEK_RECIPIENT_INFO (2)
PASSWORD_RECIPIENT_INFO (4)
OTHER_RECIPIENT_INFO (4)public AlgorithmID getKeyEncryptionAlgorithm()
public static RecipientInfo[] parseRecipientInfos(java.io.InputStream is) throws java.io.IOException, CMSParsingException
is - the input stream supplying the SET of DER encoded RecipientInfoKeyTransRecipientInfos,
KeyAgreeRecipientInfos,
KEKRecipientInfos,
PasswordRecipientInfos,
or OtherRecipientInfo,
depending on the versions of RecipientInfos contained in the SETjava.io.IOException - if an I/O error occurs while reading from the streamCMSParsingException - if an error occurs while parsing the RecipientInfopublic static RecipientInfo parseRecipientInfo(java.io.InputStream is) throws java.io.IOException, CMSParsingException
is - the input stream supplying the DER encoded RecipientInfoKeyTransRecipientInfo,
KeyAgreeRecipientInfo,
KEKRecipientInfos,
PasswordRecipientInfos,
or OtherRecipientInfo
depending on the CMS version fieldjava.io.IOException - if an I/O error occurs while reading from the streamCMSParsingException - if an error occurs while parsing the RecipientInfopublic static RecipientInfo parseRecipientInfo(ASN1Object obj) throws CMSParsingException
obj - the RecipientInfo as ASN1ObjectKeyTransRecipientInfo,
KeyAgreeRecipientInfo,
KEKRecipientInfo,
PasswordRecipientInfo,
or OtherRecipientInfo
depending on the ASN1 tagCMSParsingException - if an error occurs while parsing the RecipientInfopublic static ASN1Object encodeSequence(java.util.List<RecipientInfo> ris) throws CodingException
ris - the list of RecipientInfos to be encodedCodingExceptionpublic abstract RecipientInfo makeClone()
public boolean isPasswordRequired()