Interface CryptoPolicy<S extends ContextSpec, K extends Key>

Type Parameters:
S - context specification type
K - key type
public interface CryptoPolicy<S extends ContextSpec, K extends Key>
A strategy interface for validating cryptographic keys, usages, and specifications before contexts are created.

A CryptoPolicy is consulted by higher layers (such as CryptoAlgorithms) to enforce organizational or security-specific rules. Policies may range from permissive (accept everything) to strict (require minimum key sizes, algorithm whitelisting, usage separation, etc.).

Design goals

  • Allow central enforcement of key strength and usage constraints.
  • Support extensibility without hardcoding checks into algorithms.
  • Enable application-specific security postures while sharing the same underlying primitives.

Typical usage

ZeroEchoSession session = new ZeroEchoSession()
        .withPolicy(CryptoPolicy.minStrength(128));

// Later, when creating a context:
EncryptionContext ctx = session.createContext("AES", KeyUsage.ENCRYPT, secretKey);
Since:
1.0
See Also:

  • Method Summary

    Modifier and Type
    Method
    Description
    static <S extends ContextSpec, K extends Key>
    CryptoPolicy<S,K>
    minStrength(int minBits)
    Returns a policy that enforces a minimum estimated key strength.
    static <S extends ContextSpec, K extends Key>
    CryptoPolicy<S,K>
    permissive()
    Returns a permissive policy that accepts all keys, roles, and specs without validation.
    void
    validate(String id, KeyUsage role, K key, S spec)
    Validates an algorithm identifier, role, key, and spec.

  • Method Details

    • validate

      void validate(String id, KeyUsage role, K key, S spec)
      Validates an algorithm identifier, role, key, and spec.

      Implementations should throw an unchecked exception (typically IllegalArgumentException) if the combination violates policy.

      Parameters:
      id - canonical algorithm identifier
      role - intended key usage role
      key - cryptographic key (may be NullKey for unkeyed flows)
      spec - optional context specification; may be null
      Throws:
      IllegalArgumentException - if the parameters are not permitted by the policy

    • permissive

      static <S extends ContextSpec, K extends Key> CryptoPolicy<S,K> permissive()
      Returns a permissive policy that accepts all keys, roles, and specs without validation.

      This is the default when no explicit policy is configured.

      Type Parameters:
      S - context specification type
      K - key type
      Returns:
      a permissive CryptoPolicy

    • minStrength

      static <S extends ContextSpec, K extends Key> CryptoPolicy<S,K> minStrength(int minBits)
      Returns a policy that enforces a minimum estimated key strength.

      Key strength is estimated in bits using SecurityStrengthAdvisor.estimateBits(String, Key). If the strength is below minBits, validation fails with IllegalArgumentException.

      Type Parameters:
      S - context specification type
      K - key type
      Parameters:
      minBits - minimum acceptable estimated key strength, in bits
      Returns:
      a CryptoPolicy that enforces minimum key strength
      Throws:
      IllegalArgumentException - if minBits is negative