Package io.confluent.kafka.schemaregistry.encryption.azure

Class AzureKmsAead

java.lang.Object
io.confluent.kafka.schemaregistry.encryption.azure.AzureKmsAead
All Implemented Interfaces:
com.google.crypto.tink.Aead
public final class AzureKmsAead extends Object implements com.google.crypto.tink.Aead
A Aead that forwards encryption/decryption requests to a key in AZURE KMS.

Unlike AWS KMS and GCP KMS, Azure Key Vault addresses wrap/unwrap by an explicit key version and does not embed that version in the ciphertext it returns. When encryptTarget is set (see AzureKmsDriver.ENCRYPT_AZURE_KEY_VERSION_SAVE), encrypt(byte[], byte[]) makes its output self-describing by prepending the exact version that produced it: azure:v1:<32-character key version>:<raw ciphertext bytes>.

decrypt(byte[], byte[]) always checks for this prefix regardless of the current encryptTarget, since a DEK wrapped while the toggle was on must remain decryptable even after it is turned back off.

  • Constructor Summary

    Constructors
    Constructor
    Description
    AzureKmsAead(com.azure.security.keyvault.keys.cryptography.CryptographyClient defaultClient, com.azure.security.keyvault.keys.cryptography.models.EncryptionAlgorithm algorithm)
    Constructor
    AzureKmsAead(com.azure.security.keyvault.keys.cryptography.CryptographyClient defaultClient, com.azure.security.keyvault.keys.cryptography.models.EncryptionAlgorithm algorithm, Supplier<Map.Entry<com.azure.security.keyvault.keys.cryptography.CryptographyClient,String>> encryptTarget, Function<String,com.azure.security.keyvault.keys.cryptography.CryptographyClient> clientFactory)
     

  • Method Summary

    Modifier and Type
    Method
    Description
    byte[]
    decrypt(byte[] ciphertext, byte[] associatedData)
     
    byte[]
    encrypt(byte[] plaintext, byte[] associatedData)
     

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Constructor Details

    • AzureKmsAead

      public AzureKmsAead(com.azure.security.keyvault.keys.cryptography.CryptographyClient defaultClient, com.azure.security.keyvault.keys.cryptography.models.EncryptionAlgorithm algorithm)
      Constructor
      Parameters:
      defaultClient - - kms client
      algorithm - - algorithm

    • AzureKmsAead

      public AzureKmsAead(com.azure.security.keyvault.keys.cryptography.CryptographyClient defaultClient, com.azure.security.keyvault.keys.cryptography.models.EncryptionAlgorithm algorithm, Supplier<Map.Entry<com.azure.security.keyvault.keys.cryptography.CryptographyClient,String>> encryptTarget, Function<String,com.azure.security.keyvault.keys.cryptography.CryptographyClient> clientFactory)
      Parameters:
      defaultClient - used when encrypting with encryptTarget unset, and when decrypting ciphertext with no embedded version prefix
      algorithm - algorithm
      encryptTarget - if non-null, resolved lazily (not until encrypt(byte[], byte[]) is actually called) to determine the client and version (the entry's key and value, respectively) to prefix new output with. May throw AzureKmsClient.RuntimeAzureKmsException to surface a checked GeneralSecurityException from resolution.
      clientFactory - builds a CryptographyClient for an arbitrary version, used by decrypt(byte[], byte[]) to target whichever version is embedded in already-wrapped ciphertext, which may differ from whatever encryptTarget currently resolves to. Consulted by decrypt regardless of whether encryptTarget is set, so may be null only if encryptTarget is also null and no already-prefixed ciphertext will ever be presented to this Aead.

  • Method Details