io.confluent.kafka.schemaregistry.encryption.azure

Class AzureKmsAead

java.lang.Object

io.confluent.kafka.schemaregistry.encryption.azure.AzureKmsAead

All Implemented Interfaces:

com.google.crypto.tink.Aead

public final class AzureKmsAead
extends Object
implements com.google.crypto.tink.Aead

A Aead that forwards encryption/decryption requests to a key in AZURE KMS.

Unlike AWS KMS and GCP KMS, Azure Key Vault addresses wrap/unwrap by an explicit key version and does not embed that version in the ciphertext it returns. When encryptTarget is set (see AzureKmsDriver.ENCRYPT_AZURE_KEY_VERSION_SAVE), encrypt(byte[], byte[]) makes its output self-describing by prepending the exact version that produced it: azure:v1:<32-character key version>:<raw ciphertext bytes>.

decrypt(byte[], byte[]) always checks for this prefix regardless of the current encryptTarget, since a DEK wrapped while the toggle was on must remain decryptable even after it is turned back off.

Constructor Summary

Constructors

Constructor and Description
AzureKmsAead(com.azure.security.keyvault.keys.cryptography.CryptographyClient defaultClient, com.azure.security.keyvault.keys.cryptography.models.EncryptionAlgorithm algorithm) Constructor
AzureKmsAead(com.azure.security.keyvault.keys.cryptography.CryptographyClient defaultClient, com.azure.security.keyvault.keys.cryptography.models.EncryptionAlgorithm algorithm, Supplier<Map.Entry<com.azure.security.keyvault.keys.cryptography.CryptographyClient,String>> encryptTarget, Function<String,com.azure.security.keyvault.keys.cryptography.CryptographyClient> clientFactory)

Method Summary

Modifier and Type	Method and Description
byte[]	decrypt(byte[] ciphertext, byte[] associatedData)
byte[]	encrypt(byte[] plaintext, byte[] associatedData)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

AzureKmsAead

public AzureKmsAead(com.azure.security.keyvault.keys.cryptography.CryptographyClient defaultClient,
                    com.azure.security.keyvault.keys.cryptography.models.EncryptionAlgorithm algorithm)

Constructor

Parameters:

defaultClient - - kms client

algorithm - - algorithm

AzureKmsAead

public AzureKmsAead(com.azure.security.keyvault.keys.cryptography.CryptographyClient defaultClient,
                    com.azure.security.keyvault.keys.cryptography.models.EncryptionAlgorithm algorithm,
                    Supplier<Map.Entry<com.azure.security.keyvault.keys.cryptography.CryptographyClient,String>> encryptTarget,
                    Function<String,com.azure.security.keyvault.keys.cryptography.CryptographyClient> clientFactory)

Parameters:

defaultClient - used when encrypting with encryptTarget unset, and when decrypting ciphertext with no embedded version prefix

algorithm - algorithm

encryptTarget - if non-null, resolved lazily (not until encrypt(byte[], byte[]) is actually called) to determine the client and version (the entry's key and value, respectively) to prefix new output with. May throw AzureKmsClient.RuntimeAzureKmsException to surface a checked GeneralSecurityException from resolution.

clientFactory - builds a CryptographyClient for an arbitrary version, used by decrypt(byte[], byte[]) to target whichever version is embedded in already-wrapped ciphertext, which may differ from whatever encryptTarget currently resolves to. Consulted by decrypt regardless of whether encryptTarget is set, so may be null only if encryptTarget is also null and no already-prefixed ciphertext will ever be presented to this Aead.

Method Detail

encrypt

public byte[] encrypt(byte[] plaintext,
                      byte[] associatedData)
               throws GeneralSecurityException

Specified by:

encrypt in interface com.google.crypto.tink.Aead

Throws:

GeneralSecurityException

decrypt

public byte[] decrypt(byte[] ciphertext,
                      byte[] associatedData)
               throws GeneralSecurityException

Specified by:

decrypt in interface com.google.crypto.tink.Aead

Throws:

GeneralSecurityException