io.minio.admin

Class Crypto

java.lang.Object

io.minio.admin.Crypto

public class Crypto
extends Object

MinIO encrypts/decrypts any payloads containing access or secret keys. The encryption scheme used is from a library called sio-go. The library encrypts/decrypts data in chunks, which allows it handle large amounts of data, without sacrificing security. In addition, MinIO itself formats the data into specific format, to allow encryption/decryption between client and server.

Constructor Summary

Constructors

Constructor and Description
Crypto()

Method Summary

Modifier and Type	Method and Description
static byte[]	decrypt(String password, byte[] payload) Decrypts data in BUFFER_SIZE chunks using AES-GCM using a 256-bit Argon2ID key.
static byte[]	encrypt(String password, byte[] data) Encrypts data in BUFFER_SIZE chunks using AES-GCM using a 256-bit Argon2ID key.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

Crypto

public Crypto()

Method Detail

encrypt

public static byte[] encrypt(String password,
                             byte[] data)
                      throws UnsupportedEncodingException,
                             org.bouncycastle.crypto.InvalidCipherTextException

Encrypts data in BUFFER_SIZE chunks using AES-GCM using a 256-bit Argon2ID key. The format returned is compatible with MinIO servers and clients. Header format: salt [string 32] | aead id [byte 1] | nonce [byte 8] | encrypted_data [byte len(encrypted_data)] To see the original implementation in Go, check out the madmin-go library.

Parameters:

password - Plaintext password

data - The data to encrypt

Returns:

Encrypted data

Throws:

UnsupportedEncodingException

org.bouncycastle.crypto.InvalidCipherTextException

decrypt

public static byte[] decrypt(String password,
                             byte[] payload)
                      throws UnsupportedEncodingException,
                             org.bouncycastle.crypto.InvalidCipherTextException

Decrypts data in BUFFER_SIZE chunks using AES-GCM using a 256-bit Argon2ID key.

Parameters:

password - Plaintext password

payload - Data to decrypt, including headers

Returns:

Decrypted data

Throws:

UnsupportedEncodingException

org.bouncycastle.crypto.InvalidCipherTextException