org.unitedid.yhsm.internal

Class AEADCmd

java.lang.Object

org.unitedid.yhsm.internal.AEADCmd

public class AEADCmd
extends Object

AEADCmd implements AEAD commands for the YubiHSM

Method Summary

Methods

Modifier and Type	Method and Description
static Map<String,String>	generateAEAD(DeviceHandler device, String nonce, int keyHandle, byte[] data) Generate AEADCmd block from data for a specific key and nonce.
static Map<String,String>	generateBufferAEAD(DeviceHandler device, String nonce, int keyHandle) Generate AEAD block of data buffer for a specific key.
static Map<String,String>	generateRandomAEAD(DeviceHandler device, String nonce, int keyHandle, int size) Generate a random AEAD block using the YubiHSM internal TRNG.
static boolean	validateAEAD(DeviceHandler device, String nonce, int keyHandle, String aead, byte[] plaintext) Validate an AEAD using the YubiHSM, matching it against some known plain text.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Detail

generateAEAD

public static Map<String,String> generateAEAD(DeviceHandler device,
                              String nonce,
                              int keyHandle,
                              byte[] data)
                                       throws YubiHSMInputException,
                                              YubiHSMCommandFailedException,
                                              YubiHSMErrorException

Generate AEADCmd block from data for a specific key and nonce.

Parameters:

device - the YubiHSM device handler

nonce - the nonce

keyHandle - the key to use

data - is the byte array to turn into an AEAD

Returns:

a hash map with the AEAD and nonce

Throws:

YubiHSMInputException - argument exceptions

YubiHSMCommandFailedException - command failed exception

YubiHSMErrorException - error exception

generateRandomAEAD

public static Map<String,String> generateRandomAEAD(DeviceHandler device,
                                    String nonce,
                                    int keyHandle,
                                    int size)
                                             throws YubiHSMInputException,
                                                    YubiHSMCommandFailedException,
                                                    YubiHSMErrorException

Generate a random AEAD block using the YubiHSM internal TRNG. To generate a secret for a YubiKey use public_id as nonce.

Parameters:

device - the YubiHSM device handler

nonce - the nonce or public_id

keyHandle - the key to use

size - the resulting byte length of the AEAD

Returns:

a hash map with the AEAD and nonce

Throws:

YubiHSMInputException - argument exceptions

YubiHSMCommandFailedException - command failed exception

YubiHSMErrorException - error exception

generateBufferAEAD

public static Map<String,String> generateBufferAEAD(DeviceHandler device,
                                    String nonce,
                                    int keyHandle)
                                             throws YubiHSMInputException,
                                                    YubiHSMCommandFailedException,
                                                    YubiHSMErrorException

Generate AEAD block of data buffer for a specific key. After a key has been loaded into the internal data buffer, this command can be used a number of times to get AEADs of the data buffer for different key handles. For example, to encrypt a YubiKey secrets to one or more Yubico KSM's that all have a YubiHSM attached to them.

Parameters:

device - the YubiHSM device handler

nonce - the nonce

keyHandle - the key to use

Returns:

a hash map with the AEAD and nonce

Throws:

YubiHSMInputException - argument exceptions

YubiHSMCommandFailedException - command failed exception

YubiHSMErrorException - error exception

validateAEAD

public static boolean validateAEAD(DeviceHandler device,
                   String nonce,
                   int keyHandle,
                   String aead,
                   byte[] plaintext)
                            throws YubiHSMInputException,
                                   YubiHSMCommandFailedException,
                                   YubiHSMErrorException

Validate an AEAD using the YubiHSM, matching it against some known plain text. Matching is done inside the YubiHSM so the decrypted AEAD is never exposed.

Parameters:

device - the YubiHSM device

nonce - the nonce or public_id

keyHandle - the key to use

aead - the AEAD (hex string)

plaintext - the plain text data

Returns:

returns true if validation was a success, false if the validation failed

Throws:

YubiHSMInputException - argument exceptions

YubiHSMCommandFailedException - command failed exception

YubiHSMErrorException - error exception