Class PasswordRecipient

java.lang.Object
zeroecho.sdk.guard.PasswordRecipient
All Implemented Interfaces:
AutoCloseable, Destroyable, Recipient
public final class PasswordRecipient extends Object implements Recipient, Destroyable, AutoCloseable
Password recipient that derives a KEK via PBKDF2(HMAC-SHA-256) and wraps the CEK with AES-GCM.

  • Method Details

    • id

      public String id()
      Returns the recipient entry identifier used in the header.
      Specified by:
      id in interface Recipient
      Returns:
      "PWD:PBKDF2-SHA256:GCM-WRAP"

    • buildRecipientEntry

      public byte[] buildRecipientEntry(byte[] cek) throws GeneralSecurityException, IOException
      Builds the recipient entry blob for this password recipient.
      Specified by:
      buildRecipientEntry in interface Recipient
      Parameters:
      cek - the CEK to wrap
      Returns:
      a blob containing pack7(iter) || salt || wrapIv || wrappedCEK
      Throws:
      GeneralSecurityException - if PBKDF2 or AES-GCM fails
      IOException - if blob assembly fails

    • decoy

      public boolean decoy()
      Returns whether this recipient entry is marked as a decoy.

      A decoy recipient is syntactically valid but intentionally unusable for recovering the content-encryption key (CEK). Such entries are included to conceal the number and identity of real recipients within a multi-recipient envelope.

      Specified by:
      decoy in interface Recipient
      Returns:
      true if this recipient is a decoy (fake recipient that cannot unwrap a CEK); false if it is a real recipient

    • destroy

      public void destroy()
      Specified by:
      destroy in interface Destroyable

    • isDestroyed

      public boolean isDestroyed()
      Specified by:
      isDestroyed in interface Destroyable

    • close

      public void close()
      Closes this recipient by destroying its retained password copy.
      Specified by:
      close in interface AutoCloseable