public class SealedObject extends Object implements Serializable
Given any Serializable object, one can create a SealedObject that encapsulates the original object, in serialized format (i.e., a "deep copy"), and seals (encrypts) its serialized contents, using a cryptographic algorithm such as AES, to protect its confidentiality. The encrypted content can later be decrypted (with the corresponding algorithm using the correct decryption key) and de-serialized, yielding the original object.
Note that the Cipher object must be fully initialized with the correct algorithm, key, padding scheme, etc., before being applied to a SealedObject.
The original object that was sealed can be recovered in two different ways:
getObject
method that takes a Cipher object.
This method requires a fully initialized Cipher object,
initialized with the
exact same algorithm, key, padding scheme, etc., that were used to seal the
object.
This approach has the advantage that the party who unseals the sealed object does not require knowledge of the decryption key. For example, after one party has initialized the cipher object with the required decryption key, it could hand over the cipher object to another party who then unseals the sealed object.
getObject methods
that take a Key object.
In this approach, the getObject method creates a cipher
object for the appropriate decryption algorithm and initializes it with the
given decryption key and the algorithm parameters (if any) that were stored
in the sealed object.
This approach has the advantage that the party who unseals the object does not need to keep track of the parameters (e.g., an IV) that were used to seal the object.
Cipher,
Serialized Form| Modifier and Type | Field and Description |
|---|---|
protected byte[] |
encodedParams
The cryptographic parameters used by the sealing Cipher,
encoded in the default format.
|
| Modifier | Constructor and Description |
|---|---|
protected |
SealedObject(SealedObject so)
Constructs a SealedObject object from the passed-in SealedObject.
|
|
SealedObject(Serializable object,
Cipher c)
Constructs a SealedObject from any Serializable object.
|
| Modifier and Type | Method and Description |
|---|---|
String |
getAlgorithm()
Returns the algorithm that was used to seal this object.
|
Object |
getObject(Cipher c)
Retrieves the original (encapsulated) object.
|
Object |
getObject(Key key)
Retrieves the original (encapsulated) object.
|
Object |
getObject(Key key,
String provider)
Retrieves the original (encapsulated) object.
|
protected byte[] encodedParams
That is, cipher.getParameters().getEncoded().
public SealedObject(Serializable object, Cipher c) throws IOException, IllegalBlockSizeException
The given object is serialized, and its serialized contents are encrypted using the given Cipher, which must be fully initialized.
Any algorithm parameters that may be used in the encryption
operation are stored inside of the new SealedObject.
object - the object to be sealed; can be null.c - the cipher used to seal the object.NullPointerException - if the given cipher is null.IOException - if an error occurs during serializationIllegalBlockSizeException - if the given cipher is a block
cipher, no padding has been requested, and the total input length
(i.e., the length of the serialized object contents) is not a multiple
of the cipher's block sizeprotected SealedObject(SealedObject so)
so - a SealedObject objectNullPointerException - if the given sealed object is null.public final String getAlgorithm()
public final Object getObject(Key key) throws IOException, ClassNotFoundException, NoSuchAlgorithmException, InvalidKeyException
This method creates a cipher for the algorithm that had been used in
the sealing operation.
If the default provider package provides an implementation of that
algorithm, an instance of Cipher containing that implementation is used.
If the algorithm is not available in the default package, other
packages are searched.
The Cipher object is initialized for decryption, using the given
key and the parameters (if any) that had been used in the
sealing operation.
The encapsulated object is unsealed and de-serialized, before it is returned.
key - the key used to unseal the object.IOException - if an error occurs during de-serialiazation.ClassNotFoundException - if an error occurs during
de-serialiazation.NoSuchAlgorithmException - if the algorithm to unseal the
object is not available.InvalidKeyException - if the given key cannot be used to unseal
the object (e.g., it has the wrong algorithm).NullPointerException - if key is null.public final Object getObject(Cipher c) throws IOException, ClassNotFoundException, IllegalBlockSizeException, BadPaddingException
The encapsulated object is unsealed (using the given Cipher, assuming that the Cipher is already properly initialized) and de-serialized, before it is returned.
c - the cipher used to unseal the objectNullPointerException - if the given cipher is null.IOException - if an error occurs during de-serialiazationClassNotFoundException - if an error occurs during
de-serialiazationIllegalBlockSizeException - if the given cipher is a block
cipher, no padding has been requested, and the total input length is
not a multiple of the cipher's block sizeBadPaddingException - if the given cipher has been
initialized for decryption, and padding has been specified, but
the input data does not have proper expected padding bytespublic final Object getObject(Key key, String provider) throws IOException, ClassNotFoundException, NoSuchAlgorithmException, NoSuchProviderException, InvalidKeyException
This method creates a cipher for the algorithm that had been used in
the sealing operation, using an implementation of that algorithm from
the given provider.
The Cipher object is initialized for decryption, using the given
key and the parameters (if any) that had been used in the
sealing operation.
The encapsulated object is unsealed and de-serialized, before it is returned.
key - the key used to unseal the object.provider - the name of the provider of the algorithm to unseal
the object.IllegalArgumentException - if the given provider is null
or empty.IOException - if an error occurs during de-serialiazation.ClassNotFoundException - if an error occurs during
de-serialiazation.NoSuchAlgorithmException - if the algorithm to unseal the
object is not available.NoSuchProviderException - if the given provider is not
configured.InvalidKeyException - if the given key cannot be used to unseal
the object (e.g., it has the wrong algorithm).NullPointerException - if key is null. Submit a bug or feature
For further API reference and developer documentation, see Java SE Documentation. That documentation contains more detailed, developer-targeted descriptions, with conceptual overviews, definitions of terms, workarounds, and working code examples.
Copyright © 1993, 2022, Oracle and/or its affiliates. All rights reserved. Use is subject to license terms. Also see the documentation redistribution policy.