Class PasswordOpener

java.lang.Object

zeroecho.sdk.guard.PasswordOpener

All Implemented Interfaces:

AutoCloseable, RecipientOpener

public final class PasswordOpener
extends Object
implements RecipientOpener

Recipient opener for password-based entries that derives a KEK via PBKDF2 and unwraps the CEK with AES-GCM.

Constructor Summary

Constructors

Constructor	Description
PasswordOpener(Pbkdf2Limits limits)	Creates an opener with explicit decoded-input limits.

Method Summary

Modifier and Type	Method	Description
byte[]	tryOpen(String entryId, byte[] entryBlob, UnlockMaterial material)	Attempts to open a password-based recipient entry using a password unlock material.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface RecipientOpener

close

Constructor Details

PasswordOpener

public PasswordOpener(Pbkdf2Limits limits)

Creates an opener with explicit decoded-input limits.

Parameters:

limits - PBKDF2 safety limits

Method Details

tryOpen

public byte[] tryOpen(String entryId,
 byte[] entryBlob,
 UnlockMaterial material)
               throws GeneralSecurityException,
IOException

Attempts to open a password-based recipient entry using a password unlock material.

Specified by:

tryOpen in interface RecipientOpener

Parameters:

entryId - the recipient entry identifier

entryBlob - the recipient entry blob encoding iter || salt || iv || wrappedCEK

material - the unlocking material; must contain a password

Returns:

the recovered CEK or null if entryId does not match the password scheme or material is not applicable

Throws:

GeneralSecurityException - if PBKDF2 or AES-GCM fails or if authentication fails after a match

IOException - if entry decoding fails