com.safenetinc.luna.provider.keyagree

Class LunaKeyAgreementEcDhWithNistKdf256

java.lang.Object

javax.crypto.KeyAgreementSpi

com.safenetinc.luna.provider.keyagree.LunaKeyAgreementEcDh

com.safenetinc.luna.provider.keyagree.LunaKeyAgreementEcDhWithNistKdf256

public class LunaKeyAgreementEcDhWithNistKdf256
extends LunaKeyAgreementEcDh

This class implements an Elliptic Curve Diffie-Hellman key agreement with the NIST SHA256 KDF, where the private key is stored on the HSM. The shared secret is created on the HSM but is extractable.

Field Summary

Fields

Modifier and Type	Field and Description
protected java.security.KeyFactory	kf
protected LunaKey	privateKey

Constructor Summary

Constructors

Constructor and Description
LunaKeyAgreementEcDhWithNistKdf256()
LunaKeyAgreementEcDhWithNistKdf256(LunaECDHParameterSpec params)

Method Summary

Methods

Modifier and Type	Method and Description
protected void	checkPublicKey(java.security.Key key, boolean lastPhase) Checks the parameters to engineDoPhase().
protected int	engineGenerateSecret(byte[] sharedSecret, int offset) Generates the shared secret, and places it into the buffer sharedSecret, beginning at offset inclusive.
protected int	getDerivedKeyLength(long algId) Returns the derived key length in bytes for a key of the given algorithm.

Methods inherited from class com.safenetinc.luna.provider.keyagree.LunaKeyAgreementEcDh

engineDoPhase, engineGenerateSecret, engineGenerateSecret, engineGenerateSecretWantBytes, engineInit, engineInit, getMaxSharedSecretLength, getParameterSpec

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

privateKey

protected LunaKey privateKey

kf

protected final java.security.KeyFactory kf

Constructor Detail

LunaKeyAgreementEcDhWithNistKdf256

public LunaKeyAgreementEcDhWithNistKdf256()

LunaKeyAgreementEcDhWithNistKdf256

public LunaKeyAgreementEcDhWithNistKdf256(LunaECDHParameterSpec params)

Method Detail

checkPublicKey

protected void checkPublicKey(java.security.Key key,
                  boolean lastPhase)
                       throws java.security.InvalidKeyException,
                              java.lang.IllegalStateException

Checks the parameters to engineDoPhase().

Parameters:

key - The other party's public key

lastPhase - Must be set to true

Throws:

java.lang.IllegalStateException - If this key agreement has not been initialized, or if lastPhase is false

java.security.InvalidKeyException - If the pubic key's slot doesn't match the private key's slot

engineGenerateSecret

protected int engineGenerateSecret(byte[] sharedSecret,
                       int offset)
                            throws java.lang.IllegalStateException,
                                   javax.crypto.ShortBufferException

Generates the shared secret, and places it into the buffer sharedSecret, beginning at offset inclusive.

If the sharedSecret buffer is too small to hold the result, a ShortBufferException is thrown. In this case, the key agreement is not reset and the call can be repeated with a larger output buffer.

Successful completion of this method resets this KeyAgreement object, so that it can be reused for further key agreements. Unless this key agreement is reinitialized with one of the init methods, the same private information will be used for subsequent key agreements. However, doPhase will have to be called after every call to generateSecret in order to re-initialize the public information.

Specified by:

engineGenerateSecret in class javax.crypto.KeyAgreementSpi

Parameters:

sharedSecret - The buffer for the shared secret

offset - The offset in sharedSecret where the shared secret will be stored

Returns:

The number of bytes places into sharedSecret

Throws:

java.lang.IllegalStateException - If this key agreement has not been completed yet

javax.crypto.ShortBufferException - If the given output buffer is too small to hold the secret

getDerivedKeyLength

protected int getDerivedKeyLength(long algId)
                           throws java.security.NoSuchAlgorithmException

Returns the derived key length in bytes for a key of the given algorithm. A "generic secret" key will have the same length as the DH/ECDH keys used to create it.

Parameters:

algId - Algorithm of the secret key

Returns:

Length of the secret key, in bytes

Throws:

java.security.NoSuchAlgorithmException - If the algorithm id is not recognized