Class RsaEncDataContentBuilder

java.lang.Object
zeroecho.sdk.builders.alg.RsaEncDataContentBuilder
All Implemented Interfaces:
DataContentBuilder<DataContent>
public final class RsaEncDataContentBuilder extends Object implements DataContentBuilder<DataContent>
RsaEncDataContentBuilder builds streaming RSA encryption or decryption pipelines that operate while an InputStream is consumed.

Overview

This builder produces DataContent backed by an EncryptionContext created from CryptoAlgorithms. In encrypt mode it transforms upstream plaintext into ciphertext; in decrypt mode it transforms ciphertext back to plaintext. Padding and OAEP parameters are configured via RsaEncSpec.

Key material

Keys can be supplied directly, generated from RsaKeyGenSpec, or imported from standard encodings: PKCS#8 for private keys and X.509 SubjectPublicKeyInfo for public keys. If both generation and import are requested, the last configuration applied before build(boolean) takes effect.

Examples

// Encrypt with OAEP-SHA-256 and a generated 2048-bit key pair
DataContent enc = RsaEncDataContentBuilder.builder()
    .oaepSha256()
    .generateKeyPair(RsaKeyGenSpec.rsa2048())
    .build(true);

// Decrypt with an imported PKCS#8 private key
DataContent dec = RsaEncDataContentBuilder.builder()
    .importPrivatePkcs8(pkcs8Bytes)
    .build(false);

// Encrypt with OAEP-SHA-512 and an application label
DataContent enc2 = RsaEncDataContentBuilder.builder()
    .oaep(RsaEncSpec.Hash.SHA512)
    .oaepLabelUtf8("session-1")
    .withPublicKey(pub)
    .build(true);

Thread-safety

Instances are mutable and not thread-safe. Configure and use each builder instance from a single thread.
See Also:

  • Method Details

    • builder

      public static RsaEncDataContentBuilder builder(ZeroEchoSession session)
      Creates a new builder for constructing RSA encryption or decryption pipelines. 
      RsaEncDataContentBuilder b = RsaEncDataContentBuilder.builder();
      Parameters:
      session - active session used to create cryptographic contexts
      Returns:
      a new RsaEncDataContentBuilder instance

    • spec

      public RsaEncDataContentBuilder spec(RsaEncSpec s)
      Sets the RSA encryption specification, including padding and OAEP parameters.
      Parameters:
      s - the RSA encryption spec; must not be null
      Returns:
      this builder for chaining
      Throws:
      NullPointerException - if s is null

    • oaepSha256

      public RsaEncDataContentBuilder oaepSha256()
      Selects RSA-OAEP with SHA-256 for MGF1 and hash.
      Returns:
      this builder for chaining

    • oaep

      public RsaEncDataContentBuilder oaep(RsaEncSpec.Hash h)
      Selects RSA-OAEP with the given hash algorithm for MGF1 and hash.
      Parameters:
      h - the OAEP hash function
      Returns:
      this builder for chaining
      Throws:
      NullPointerException - if h is null

    • oaepLabel

      public RsaEncDataContentBuilder oaepLabel(byte[] label)
      Sets the OAEP label as arbitrary bytes.

      The label is included in the OAEP parameter set. It is not encrypted and must be supplied identically during decryption.

      Parameters:
      label - the OAEP label bytes; may be null to clear
      Returns:
      this builder for chaining

    • oaepLabelUtf8

      public RsaEncDataContentBuilder oaepLabelUtf8(String s)
      Sets the OAEP label from a UTF-8 string.
      Parameters:
      s - the label text; may be null to clear
      Returns:
      this builder for chaining

    • pkcs1v15

      public RsaEncDataContentBuilder pkcs1v15()
      Selects PKCS#1 v1.5 padding for RSA.
      Returns:
      this builder for chaining

    • withPublicKey

      public RsaEncDataContentBuilder withPublicKey(PublicKey k)
      Supplies the public key to use for encryption.
      Parameters:
      k - the public key; must not be null
      Returns:
      this builder for chaining
      Throws:
      NullPointerException - if k is null

    • withPrivateKey

      public RsaEncDataContentBuilder withPrivateKey(PrivateKey k)
      Supplies the private key to use for decryption.
      Parameters:
      k - the private key; must not be null
      Returns:
      this builder for chaining
      Throws:
      NullPointerException - if k is null

    • generateKeyPair

      public RsaEncDataContentBuilder generateKeyPair(RsaKeyGenSpec spec)
      Requests generation of a fresh RSA key pair with the provided key generation specification.
      Parameters:
      spec - the RSA key generation spec; must not be null
      Returns:
      this builder for chaining
      Throws:
      NullPointerException - if spec is null

    • generateKeyPair

      public RsaEncDataContentBuilder generateKeyPair(int bits, int publicExponent)
      Requests generation of a fresh RSA key pair using the given modulus size and public exponent.
      Parameters:
      bits - modulus size in bits
      publicExponent - public exponent (for example 65537)
      Returns:
      this builder for chaining

    • importPrivatePkcs8

      public RsaEncDataContentBuilder importPrivatePkcs8(byte[] pkcs8)
      Imports a private key from PKCS#8-encoded bytes.
      Parameters:
      pkcs8 - PKCS#8 PrivateKeyInfo bytes; must not be null
      Returns:
      this builder for chaining
      Throws:
      NullPointerException - if pkcs8 is null

    • importPublicX509

      public RsaEncDataContentBuilder importPublicX509(byte[] x509)
      Imports a public key from X.509 SubjectPublicKeyInfo bytes.
      Parameters:
      x509 - X.509 public key bytes; must not be null
      Returns:
      this builder for chaining
      Throws:
      NullPointerException - if x509 is null

    • build

      public DataContent build(boolean encrypt)
      Builds a streaming encryption or decryption pipeline according to the current configuration.

      When encrypt is true, a public key must be available from prior configuration, generation, or import. When encrypt is false, a private key must be available. 

      DataContent enc = RsaEncDataContentBuilder.builder()
    .oaepSha256()
    .generateKeyPair(2048, 65537)
    .build(true);
      Specified by:
      build in interface DataContentBuilder<DataContent>
      Parameters:
      encrypt - true to build an encrypting pipeline, false for a decrypting pipeline
      Returns:
      a DataContent that performs the requested operation when its stream is consumed
      Throws:
      IllegalStateException - if a required key is missing or if key setup fails