software.amazon.jdbc.plugin.encryption.service

Class EncryptionService

java.lang.Object

software.amazon.jdbc.plugin.encryption.service.EncryptionService

public class EncryptionService
extends java.lang.Object

Service for encrypting and decrypting data using AES-256-GCM algorithm. Supports multiple data types and provides secure memory handling.

Constructor Summary

Constructors

Constructor and Description
EncryptionService() Creates a new EncryptionService instance.

Method Summary

Modifier and Type	Method and Description
java.lang.Object	decrypt(byte[] encryptedValue, byte[] dataKey, byte[] hmacKey, java.lang.String algorithm, java.lang.Class<?> targetType) Decrypts encrypted data using the specified data key and algorithm.
byte[]	encrypt(java.lang.Object value, byte[] dataKey, byte[] hmacKey, java.lang.String algorithm) Encrypts a value using the specified data key and algorithm.
java.lang.String	getDefaultAlgorithm() Returns the default encryption algorithm.
boolean	isAlgorithmSupported(java.lang.String algorithm) Checks if the specified algorithm is supported.
boolean	verifyEncryptedData(byte[] encryptedValue, byte[] hmacKey) Verifies that encrypted data has not been tampered with, without decrypting it.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

EncryptionService

public EncryptionService()

Creates a new EncryptionService instance.

Method Detail

encrypt

public byte[] encrypt(java.lang.Object value,
                      byte[] dataKey,
                      byte[] hmacKey,
                      java.lang.String algorithm)
               throws EncryptionException

Encrypts a value using the specified data key and algorithm.

Parameters:

value - the value to encrypt

dataKey - the encryption key

hmacKey - the HMAC verification key

algorithm - the encryption algorithm to use

Returns:

the encrypted data as byte array with HMAC prepended

Throws:

EncryptionException - if encryption fails

decrypt

public java.lang.Object decrypt(byte[] encryptedValue,
                                byte[] dataKey,
                                byte[] hmacKey,
                                java.lang.String algorithm,
                                java.lang.Class<?> targetType)
                         throws EncryptionException

Decrypts encrypted data using the specified data key and algorithm.

Parameters:

encryptedValue - the encrypted data with HMAC prepended

dataKey - the decryption key

hmacKey - the HMAC verification key

algorithm - the encryption algorithm used

targetType - the expected type of the decrypted value

Returns:

the decrypted value

Throws:

EncryptionException - if decryption fails or HMAC verification fails

getDefaultAlgorithm

public java.lang.String getDefaultAlgorithm()

Returns the default encryption algorithm.

Returns:

the default algorithm name

isAlgorithmSupported

public boolean isAlgorithmSupported(java.lang.String algorithm)

Checks if the specified algorithm is supported.

Parameters:

algorithm - the algorithm to check

Returns:

true if supported, false otherwise

verifyEncryptedData

public boolean verifyEncryptedData(byte[] encryptedValue,
                                   byte[] hmacKey)

Verifies that encrypted data has not been tampered with, without decrypting it. This method only requires the HMAC key, not the encryption key or decryption permission.

Parameters:

encryptedValue - the encrypted data with HMAC prepended

hmacKey - the HMAC verification key

Returns:

true if HMAC verification passes, false otherwise