Class ServerSecurityManager

Method Details

• getInstance

  public static ServerSecurityManager getInstance()

  Gets the instance of the security manager.

  Returns:

  The security manager.

• digest

  public static byte[] digest(byte[] data)

  Digests the bytes using preferably SHA-512, SHA-384, SHA-256, then SHA-1 and worst case MD5.

  Parameters:

  data - The data to digest.

  Returns:

  The digested data.

• setKeyTimeout

  public void setKeyTimeout(long timeout)

  Assigns the timeout in milliseconds a key is valid.

  Parameters:

  timeout - The timeout for a key in milliseconds, default is 90 days.

  Throws:

  IllegalArgumentException - If the timeout is less than 1 hour (3_600_000 ms).

• loadKeys

  public void loadKeys(File file) throws IOException, PropException

  Loads the server keys from the specified file.

  Parameters:

  file - The file.

  Throws:

  IOException - For I/O errors.

  PropException - For property exceptions.

• getServerKey

  public ServerKey getServerKey()

  Gets the key to use for encryption. The last server key is used when possible, otherwise a new key is generated. Upon generation, the keys are saved in the server and other clustered server are informed (asynchronously).

  Returns:

  The key.

• dispose

  public void dispose()

  Disposes of the instance.

• decodeParameter

  public String decodeParameter(String data) throws NoSuchAlgorithmException, NoSuchPaddingException, InvalidKeyException, InvalidAlgorithmParameterException, IllegalBlockSizeException, BadPaddingException

  Decodes a sensitive information device parameter using the previously exchanged keys.

  The wire form is blob.fingerprint where both halves are base64url and the separator is a dot (unambiguous: a dot never occurs in base64url). The fingerprint half selects which server key decrypts the blob.

  Specified by:

  decodeParameter in interface ISensitiveParameterHandler

  Parameters:

  data - The base64url encoded data with a '.'-separated key fingerprint.

  Returns:

  The decoded string.

  Throws:

  IllegalArgumentException - If the data encoding is invalid.

  NoSuchPaddingException - If the separator is missing or the key is unknown.

  NoSuchAlgorithmException - If AES/GCM is unavailable (should never happen).

  InvalidAlgorithmParameterException - If the GCM parameters are rejected.

  InvalidKeyException - If the key is invalid.

  BadPaddingException - If the authentication tag does not verify (tampering).

  IllegalBlockSizeException - Never for GCM; declared for API symmetry.

• encodeParameter

  public String encodeParameter(String data) throws NoSuchAlgorithmException, NoSuchPaddingException, InvalidKeyException, InvalidAlgorithmParameterException, IllegalBlockSizeException, BadPaddingException

  Encodes a sensitive information device parameter using the previously exchanged keys.

  The result is blob.fingerprint, both halves base64url, dot-separated - entirely URL- and cookie-safe with no further escaping needed.

  Specified by:

  encodeParameter in interface ISensitiveParameterHandler

  Parameters:

  data - The parameter to encode.

  Returns:

  The base64url encoded data with a '.'-separated key fingerprint.

  Throws:

  NoSuchPaddingException - Never (GCM uses no padding); declared for API symmetry.

  NoSuchAlgorithmException - If AES/GCM is unavailable (should never happen).

  InvalidAlgorithmParameterException - If the GCM parameters are rejected.

  InvalidKeyException - If the key is invalid.

  BadPaddingException - Never on encrypt; declared for API symmetry.

  IllegalBlockSizeException - Never for GCM; declared for API symmetry.