org.apache.nifi.security.util.crypto

Class PBKDF2CipherProvider

java.lang.Object

org.apache.nifi.security.util.crypto.RandomIVPBECipherProvider

org.apache.nifi.security.util.crypto.PBKDF2CipherProvider

All Implemented Interfaces:

CipherProvider, PBECipherProvider

public class PBKDF2CipherProvider
extends RandomIVPBECipherProvider

Field Summary

Fields

Modifier and Type	Field and Description
private static int	DEFAULT_ITERATION_COUNT This can be calculated automatically using the code PBKDF2CipherProviderGroovyTest#calculateMinimumIterationCount or manually updated by a maintainer
private static String	DEFAULT_PRF
private static int	DEFAULT_SALT_LENGTH
private int	iterationCount
private static org.slf4j.Logger	logger
private org.bouncycastle.crypto.Digest	prf

Fields inherited from class org.apache.nifi.security.util.crypto.RandomIVPBECipherProvider

IV_DELIMITER, MAX_IV_LIMIT, MAX_SALT_LIMIT, SALT_DELIMITER

Constructor Summary

Constructors

Constructor and Description
PBKDF2CipherProvider() Instantiates a PBKDF2 cipher provider with the default number of iterations and the default PRF.
PBKDF2CipherProvider(String prf, int iterationCount) Instantiates a PBKDF2 cipher provider with the specified number of iterations and the specified PRF.

Method Summary

Modifier and Type	Method and Description
byte[]	generateSalt() Returns a random salt suitable for this cipher provider.
Cipher	getCipher(EncryptionMethod encryptionMethod, String password, byte[] salt, byte[] iv, int keyLength, boolean encryptMode) Returns an initialized cipher for the specified algorithm.
Cipher	getCipher(EncryptionMethod encryptionMethod, String password, byte[] salt, int keyLength, boolean encryptMode) Returns an initialized cipher for the specified algorithm.
int	getDefaultSaltLength() Returns the default salt length for this implementation.
protected Cipher	getInitializedCipher(EncryptionMethod encryptionMethod, String password, byte[] salt, byte[] iv, int keyLength, boolean encryptMode)
protected int	getIterationCount()
(package private) org.slf4j.Logger	getLogger()
protected String	getPRFName()
private org.bouncycastle.crypto.Digest	resolvePRF(String prf)

Methods inherited from class org.apache.nifi.security.util.crypto.RandomIVPBECipherProvider

readIV, readSalt, writeIV, writeSalt

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

logger

private static final org.slf4j.Logger logger

DEFAULT_SALT_LENGTH

private static final int DEFAULT_SALT_LENGTH

See Also:

Constant Field Values

iterationCount

private final int iterationCount

prf

private final org.bouncycastle.crypto.Digest prf

DEFAULT_PRF

private static final String DEFAULT_PRF

See Also:

Constant Field Values

DEFAULT_ITERATION_COUNT

private static final int DEFAULT_ITERATION_COUNT

This can be calculated automatically using the code PBKDF2CipherProviderGroovyTest#calculateMinimumIterationCount or manually updated by a maintainer

See Also:

Constant Field Values

Constructor Detail

PBKDF2CipherProvider

public PBKDF2CipherProvider()

Instantiates a PBKDF2 cipher provider with the default number of iterations and the default PRF. Currently 128,000 iterations and SHA-512.

PBKDF2CipherProvider

public PBKDF2CipherProvider(String prf,
                            int iterationCount)

Instantiates a PBKDF2 cipher provider with the specified number of iterations and the specified PRF. Currently supports MD5, SHA1, SHA256, SHA384, and SHA512. Unknown PRFs will default to SHA512.

Parameters:

prf - a String representation of the PRF name, e.g. "SHA256", "SHA-384" "sha_512"

iterationCount - the number of iterations

Method Detail

getCipher

public Cipher getCipher(EncryptionMethod encryptionMethod,
                        String password,
                        byte[] salt,
                        byte[] iv,
                        int keyLength,
                        boolean encryptMode)
                 throws Exception

Returns an initialized cipher for the specified algorithm. The key is derived by the KDF of the implementation. The IV is provided externally to allow for non-deterministic IVs, as IVs deterministically derived from the password are a potential vulnerability and compromise semantic security. See Ilmari Karonen's answer on Crypto Stack Exchange

Specified by:

getCipher in class RandomIVPBECipherProvider

Parameters:

encryptionMethod - the EncryptionMethod

password - the secret input

salt - the salt

iv - the IV

keyLength - the desired key length in bits

encryptMode - true for encrypt, false for decrypt

Returns:

the initialized cipher

Throws:

Exception - if there is a problem initializing the cipher

getLogger

org.slf4j.Logger getLogger()

Specified by:

getLogger in class RandomIVPBECipherProvider

getCipher

public Cipher getCipher(EncryptionMethod encryptionMethod,
                        String password,
                        byte[] salt,
                        int keyLength,
                        boolean encryptMode)
                 throws Exception

Returns an initialized cipher for the specified algorithm. The key (and IV if necessary) are derived by the KDF of the implementation. The IV can be retrieved by the calling method using Cipher.getIV().

Parameters:

encryptionMethod - the EncryptionMethod

password - the secret input

salt - the salt

keyLength - the desired key length in bits

encryptMode - true for encrypt, false for decrypt

Returns:

the initialized cipher

Throws:

Exception - if there is a problem initializing the cipher

getInitializedCipher

protected Cipher getInitializedCipher(EncryptionMethod encryptionMethod,
                                      String password,
                                      byte[] salt,
                                      byte[] iv,
                                      int keyLength,
                                      boolean encryptMode)
                               throws Exception

Throws:

Exception

generateSalt

public byte[] generateSalt()

Description copied from interface: PBECipherProvider

Returns a random salt suitable for this cipher provider.

Returns:

a random salt

See Also:

PBECipherProvider.getDefaultSaltLength()

getDefaultSaltLength

public int getDefaultSaltLength()

Description copied from interface: PBECipherProvider

Returns the default salt length for this implementation.

Returns:

the default salt length in bytes

getIterationCount

protected int getIterationCount()

getPRFName

protected String getPRFName()

resolvePRF

private org.bouncycastle.crypto.Digest resolvePRF(String prf)