Class EncCtxRecipient

java.lang.Object
zeroecho.sdk.guard.EncCtxRecipient
All Implemented Interfaces:
AutoCloseable, Recipient
public final class EncCtxRecipient extends Object implements Recipient, AutoCloseable
Recipient implementation that delegates content-encryption key (CEK) wrapping to a provided EncryptionContext.

Unlike KemCtxRecipient, which derives a key-encryption key (KEK) via key encapsulation, this class directly uses an existing EncryptionContext to transform the CEK into a wrapped form. The CEK is streamed through the context, and the transformed output is returned as a recipient entry.

Thread-safety

This class is not thread-safe. Each instance binds to a single EncryptionContext and must not be reused concurrently.
Since:
1.0

  • Constructor Details

    • EncCtxRecipient

      public EncCtxRecipient(EncryptionContext enc)
      Constructs a recipient that uses the given EncryptionContext.
      Parameters:
      enc - the encryption context used to wrap CEKs

    • EncCtxRecipient

      public EncCtxRecipient(EncryptionContext enc, boolean decoy)
      Constructs a recipient backed by the specified EncryptionContext.

      The provided encryption context is used to wrap content-encryption keys (CEKs) for this recipient. A recipient may also be marked as a decoy to obscure the number of real recipients in a multi-recipient envelope.

      Parameters:
      enc - the encryption context used to perform CEK wrapping; must not be null
      decoy - true if this recipient is a decoy entry (fake recipient that cannot unwrap a CEK), false if it is a real recipient

  • Method Details

    • id

      public String id()
      Returns the identifier string for this recipient mechanism.

      The format is "CTX-ENC:<algoId>" where <algoId> is the canonical identifier of the underlying EncryptionContext algorithm.

      Specified by:
      id in interface Recipient
      Returns:
      identifier string for this recipient type

    • buildRecipientEntry

      public byte[] buildRecipientEntry(byte[] cek) throws IOException
      Builds a recipient entry for the given content-encryption key (CEK).

      The CEK bytes are streamed through the attached EncryptionContext, and the encrypted result is returned. The resulting byte array represents the recipient entry that can later be processed for decryption with the corresponding context.

      Specified by:
      buildRecipientEntry in interface Recipient
      Parameters:
      cek - the content-encryption key to wrap
      Returns:
      the wrapped CEK encoded as a recipient entry
      Throws:
      IOException - if streaming through the encryption context fails

    • decoy

      public boolean decoy()
      Returns whether this recipient entry is marked as a decoy.

      A decoy recipient is syntactically valid but intentionally unusable for recovering the content-encryption key (CEK). Such entries are included to conceal the number and identity of real recipients within a multi-recipient envelope.

      Specified by:
      decoy in interface Recipient
      Returns:
      true if this recipient is a decoy (fake recipient that cannot unwrap a CEK); false if it is a real recipient

    • close

      public void close() throws IOException
      Closes the owned encryption context.
      Specified by:
      close in interface AutoCloseable
      Throws:
      IOException - if context cleanup fails