001/*
002 * nimbus-jose-jwt
003 *
004 * Copyright 2012-2016, Connect2id Ltd.
005 *
006 * Licensed under the Apache License, Version 2.0 (the "License"); you may not use
007 * this file except in compliance with the License. You may obtain a copy of the
008 * License at
009 *
010 *    http://www.apache.org/licenses/LICENSE-2.0
011 *
012 * Unless required by applicable law or agreed to in writing, software distributed
013 * under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
014 * CONDITIONS OF ANY KIND, either express or implied. See the License for the
015 * specific language governing permissions and limitations under the License.
016 */
017
018package com.nimbusds.jose.crypto;
019
020
021import javax.crypto.SecretKey;
022import javax.crypto.spec.SecretKeySpec;
023
024import net.jcip.annotations.ThreadSafe;
025
026import com.nimbusds.jose.*;
027import com.nimbusds.jose.crypto.impl.AlgorithmSupportMessage;
028import com.nimbusds.jose.crypto.impl.ContentCryptoProvider;
029import com.nimbusds.jose.crypto.impl.DirectCryptoProvider;
030import com.nimbusds.jose.jwk.OctetSequenceKey;
031import com.nimbusds.jose.util.Base64URL;
032
033
034/**
035 * Direct encrypter of {@link com.nimbusds.jose.JWEObject JWE objects} with a
036 * shared symmetric key.
037 *
038 * <p>See RFC 7518
039 * <a href="https://tools.ietf.org/html/rfc7518#section-4.5">section 4.5</a>
040 * for more information.</p>
041 *
042 * <p>This class is thread-safe.
043 *
044 * <p>Supports the following key management algorithms:
045 *
046 * <ul>
047 *     <li>{@link com.nimbusds.jose.JWEAlgorithm#DIR}
048 * </ul>
049 *
050 * <p>Supports the following content encryption algorithms:
051 *
052 * <ul>
053 *     <li>{@link com.nimbusds.jose.EncryptionMethod#A128CBC_HS256} (requires 256 bit key)
054 *     <li>{@link com.nimbusds.jose.EncryptionMethod#A192CBC_HS384} (requires 384 bit key)
055 *     <li>{@link com.nimbusds.jose.EncryptionMethod#A256CBC_HS512} (requires 512 bit key)
056 *     <li>{@link com.nimbusds.jose.EncryptionMethod#A128GCM} (requires 128 bit key)
057 *     <li>{@link com.nimbusds.jose.EncryptionMethod#A192GCM} (requires 192 bit key)
058 *     <li>{@link com.nimbusds.jose.EncryptionMethod#A256GCM} (requires 256 bit key)
059 *     <li>{@link com.nimbusds.jose.EncryptionMethod#A128CBC_HS256_DEPRECATED} (requires 256 bit key)
060 *     <li>{@link com.nimbusds.jose.EncryptionMethod#A256CBC_HS512_DEPRECATED} (requires 512 bit key)
061 *     <li>{@link com.nimbusds.jose.EncryptionMethod#XC20P} (requires 256 bit key)
062 * </ul>
063 *
064 * @author Vladimir Dzhuvinov
065 * @version 2022-09-20
066 */
067@ThreadSafe
068public class DirectEncrypter extends DirectCryptoProvider implements JWEEncrypter {
069
070
071        /**
072         * Creates a new direct encrypter.
073         *
074         * @param key The symmetric key. Its algorithm should be "AES". Must be
075         *            128 bits (16 bytes), 192 bits (24 bytes), 256 bits (32
076         *            bytes), 384 bits (48 bytes) or 512 bits (64 bytes) long.
077         *            Must not be {@code null}.
078         *
079         * @throws KeyLengthException If the symmetric key length is not
080         *                            compatible.
081         */
082        public DirectEncrypter(final SecretKey key)
083                throws KeyLengthException {
084
085                super(key);
086        }
087
088
089        /**
090         * Creates a new direct encrypter.
091         *
092         * @param keyBytes The symmetric key, as a byte array. Must be 128 bits
093         *                 (16 bytes), 192 bits (24 bytes), 256 bits (32
094         *                 bytes), 384 bits (48 bytes) or 512 bits (64 bytes)
095         *                 long. Must not be {@code null}.
096         *
097         * @throws KeyLengthException If the symmetric key length is not
098         *                            compatible.
099         */
100        public DirectEncrypter(final byte[] keyBytes)
101                throws KeyLengthException {
102
103                this(new SecretKeySpec(keyBytes, "AES"));
104        }
105
106
107        /**
108         * Creates a new direct encrypter.
109         *
110         * @param octJWK The symmetric key, as a JWK. Must be 128 bits (16
111         *               bytes), 192 bits (24 bytes), 256 bits (32 bytes), 384
112         *               bits (48 bytes) or 512 bits (64 bytes) long. Must not
113         *               be {@code null}.
114         *
115         * @throws KeyLengthException If the symmetric key length is not
116         *                            compatible.
117         */
118        public DirectEncrypter(final OctetSequenceKey octJWK)
119                throws KeyLengthException {
120
121                this(octJWK.toSecretKey("AES"));
122        }
123
124
125        @Override
126        public JWECryptoParts encrypt(final JWEHeader header, final byte[] clearText)
127                throws JOSEException {
128
129                JWEAlgorithm alg = header.getAlgorithm();
130
131                if (! alg.equals(JWEAlgorithm.DIR)) {
132                        throw new JOSEException(AlgorithmSupportMessage.unsupportedJWEAlgorithm(alg, SUPPORTED_ALGORITHMS));
133                }
134
135                final Base64URL encryptedKey = null; // The second JWE part
136
137                return ContentCryptoProvider.encrypt(header, clearText, getKey(), encryptedKey, getJCAContext());
138        }
139}