org.apache.parquet.crypto.keytools

Class KeyMaterial

java.lang.Object

org.apache.parquet.crypto.keytools.KeyMaterial

public class KeyMaterial
extends Object

KeyMaterial class represents the "key material", keeping the information that allows readers to recover an encryption key (see description of the KeyMetadata class). The keytools package (PARQUET-1373) implements the "envelope encryption" pattern, in a "single wrapping" or "double wrapping" mode. In the single wrapping mode, the key material is generated by encrypting the "data encryption key" (DEK) by a "master key". In the double wrapping mode, the key material is generated by encrypting the DEK by a "key encryption key" (KEK), that in turn is encrypted by a "master key".

Key material is kept in a flat json object, with the following fields: 1. "keyMaterialType" - a String, with the type of key material. In the current version, only one value is allowed - "PKMT1" (stands for "parquet key management tools, version 1"). For external key material storage, this field is written in both "key metadata" and "key material" jsons. For internal key material storage, this field is written only once in the common json. 2. "isFooterKey" - a boolean. If true, means that the material belongs to a file footer key, and keeps additional information (such as KMS instance ID and URL). If false, means that the material belongs to a column key. 3. "kmsInstanceID" - a String, with the KMS Instance ID. Written only in footer key material. 4. "kmsInstanceURL" - a String, with the KMS Instance URL. Written only in footer key material. 5. "masterKeyID" - a String, with the ID of the master key used to generate the material. 6. "wrappedDEK" - a String, with the wrapped DEK (base64 encoding). 7. "doubleWrapping" - a boolean. If true, means that the material was generated in double wrapping mode. If false - in single wrapping mode. 8. "keyEncryptionKeyID" - a String, with the ID of the KEK used to generate the material. Written only in double wrapping mode. 9. "wrappedKEK" - a String, with the wrapped KEK (base64 encoding). Written only in double wrapping mode.

Method Summary

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait