Package com.google.crypto.tink.hybrid.internal

Class AuthHpkeHelperForAndroidKeystore

java.lang.Object

com.google.crypto.tink.hybrid.internal.AuthHpkeHelperForAndroidKeystore

@Immutable
public final class AuthHpkeHelperForAndroidKeystore
extends java.lang.Object

A class with functions helping for HPKE implementations based on Android Keystore.

It is currently possible (starting with Android 31) to store ECDH P256 keys in AndroidKeystore, and do the DH key exchange part of HPKE on Android Keystore, without the key ever leaving Android Keystore.

The goal of this class is to do as much as possible to help this for authenticated HPKE. Hence, it does all of HPKE except the initial DH key agreement.

Method Summary

Modifier and Type	Method	Description
static AuthHpkeHelperForAndroidKeystore	create(HpkePublicKey ourPublicKey, HpkePublicKey theirPublicKey)	Creates a new AuthHpkeHelperForAndroidKeystore object.
byte[]	decryptAuthenticatedWithEncapsulatedKeyAndP256SharedSecret(byte[] encapsulatedKey, byte[] dhSharedSecret1, byte[] dhSharedSecret2, byte[] ciphertext, int ciphertextOffset, byte[] info)	Decrypts a ciphertext.
byte[]	encryptAuthenticatedWithEncapsulatedKeyAndP256SharedSecret(java.security.spec.ECPoint emphemeralPublicKey, byte[] dhSharedSecret1, byte[] dhSharedSecret2, byte[] plaintext, byte[] contextInfo)	Encrypts a message.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Detail

create

public static AuthHpkeHelperForAndroidKeystore create(HpkePublicKey ourPublicKey,
                                                      HpkePublicKey theirPublicKey)
                                               throws java.security.GeneralSecurityException

Creates a new AuthHpkeHelperForAndroidKeystore object.

The public key provided is the one corresponding to the private key which is typically stored in Android Keystore. In other words, this class is only useful if the caller can somehow do the Diffie-Hellman key exchange with the private key corresponding to the public key provided here.

Throws:

java.security.GeneralSecurityException

decryptAuthenticatedWithEncapsulatedKeyAndP256SharedSecret

public byte[] decryptAuthenticatedWithEncapsulatedKeyAndP256SharedSecret(byte[] encapsulatedKey,
                                                                         byte[] dhSharedSecret1,
                                                                         byte[] dhSharedSecret2,
                                                                         byte[] ciphertext,
                                                                         int ciphertextOffset,
                                                                         byte[] info)
                                                                  throws java.security.GeneralSecurityException

Decrypts a ciphertext.

The ciphertext must have been encrypted with the public key used to create this helper object. The encapsulated key must be in encapsulatedKey. dhSharedSecret1 must be the Diffie-Hellman shared secrets computed between the receiver and encapsulated key, dhSharedSecret2 must be the Diffie-Hellman secret between the receiver and the sender key.

Throws:

java.security.GeneralSecurityException

encryptAuthenticatedWithEncapsulatedKeyAndP256SharedSecret

public byte[] encryptAuthenticatedWithEncapsulatedKeyAndP256SharedSecret(java.security.spec.ECPoint emphemeralPublicKey,
                                                                         byte[] dhSharedSecret1,
                                                                         byte[] dhSharedSecret2,
                                                                         byte[] plaintext,
                                                                         byte[] contextInfo)
                                                                  throws java.security.GeneralSecurityException

Encrypts a message.

The message will be encrypted for `theirPublicKeyByteArray` and authenticated with `ourPublicKey`. The value in emphemeralPublicKey must contain the public key piont of an ephemerally generated key. dhSharedSecret1 must be the Diffie-Hellman shared secrets computed between the receiver and emphemeralKey. dhSharedSecret2 must be the Diffie-Hellman secret between the receiver and the sender key.

Throws:

java.security.GeneralSecurityException