Examples with EncryptedValue org.cloudfoundry.credhub.entity.EncryptedValue used on opensource projects

Example 26 with EncryptedValue

use of org.cloudfoundry.credhub.entity.EncryptedValue in project credhub by cloudfoundry-incubator.

the class EncryptionKeyRotatorTest method createOldKey.

private Key createOldKey() throws Exception {
    final PasswordBasedKeyProxy keyProxy = new PasswordBasedKeyProxy("old-password", 1, encryptionService);
    Key oldKey = keyProxy.deriveKey();
    oldCanary = new EncryptionKeyCanary();
    final EncryptedValue canaryEncryption = encryptionService.encrypt(null, oldKey, CANARY_VALUE);
    oldCanary.setEncryptedCanaryValue(canaryEncryption.getEncryptedValue());
    oldCanary.setNonce(canaryEncryption.getNonce());
    oldCanary = encryptionKeyCanaryDataService.save(oldCanary);
    keySet.add(new EncryptionKey(encryptionService, oldCanary.getUuid(), oldKey));
    return oldKey;
}

Example 27 with EncryptedValue

use of org.cloudfoundry.credhub.entity.EncryptedValue in project credhub by cloudfoundry-incubator.

the class PasswordBasedKeyProxyTest method matchesCanary_whenCanaryMatches_setsTheKey.

@Test
public void matchesCanary_whenCanaryMatches_setsTheKey() throws Exception {
    // Generate a key from the password and a new salt
    PasswordBasedKeyProxy oldProxy = new PasswordBasedKeyProxy(password, 1, encryptionService);
    Key derivedKey = oldProxy.deriveKey();
    final List<Byte> salt = oldProxy.getSalt();
    // Create a canary whose value is encrypted with this key
    final EncryptedValue encryptedCanaryValue = encryptionService.encrypt(null, derivedKey, CANARY_VALUE);
    EncryptionKeyCanary canary = new EncryptionKeyCanary();
    canary.setEncryptedCanaryValue(encryptedCanaryValue.getEncryptedValue());
    canary.setNonce(encryptedCanaryValue.getNonce());
    final Byte[] saltArray = new Byte[salt.size()];
    canary.setSalt(toPrimitive(salt.toArray(saltArray)));
    final boolean match = subject.matchesCanary(canary);
    assertTrue(match);
    assertThat(subject.getKey(), equalTo(derivedKey));
}

Example 28 with EncryptedValue

use of org.cloudfoundry.credhub.entity.EncryptedValue in project credhub by cloudfoundry-incubator.

the class RetryingEncryptionServiceTest method decrypt_whenThrowsErrors_unlocksAfterExceptionAndLocksAgainBeforeEncrypting.

@Test
public void decrypt_whenThrowsErrors_unlocksAfterExceptionAndLocksAgainBeforeEncrypting() throws Exception {
    when(keySet.get(activeKeyUuid)).thenReturn(firstActiveKey);
    when(keySet.getActive()).thenReturn(firstActiveKey);
    when(firstActiveKey.decrypt(any(byte[].class), any(byte[].class))).thenThrow(new ProviderException("function 'C_GenerateRandom' returns 0x30"));
    reset(writeLock);
    try {
        subject.decrypt(new EncryptedValue(activeKeyUuid, "an encrypted value".getBytes(), "a nonce".getBytes()));
    } catch (ProviderException e) {
    // expected
    }
    verify(readLock, times(2)).lock();
    verify(readLock, times(2)).unlock();
    verify(writeLock, times(1)).lock();
    verify(writeLock, times(1)).unlock();
}

Example 29 with EncryptedValue

use of org.cloudfoundry.credhub.entity.EncryptedValue in project credhub by cloudfoundry-incubator.

the class RetryingEncryptionServiceTest method decrypt_whenTheEncryptionKeyCannotBeFound_throwsAnException.

@Test(expected = KeyNotFoundException.class)
public void decrypt_whenTheEncryptionKeyCannotBeFound_throwsAnException() throws Exception {
    UUID fakeUuid = UUID.randomUUID();
    reset(encryptionService);
    when(keySet.get(fakeUuid)).thenReturn(null);
    subject.decrypt(new EncryptedValue(fakeUuid, "something we cant read".getBytes(), "nonce".getBytes()));
}

Example 30 with EncryptedValue

use of org.cloudfoundry.credhub.entity.EncryptedValue in project credhub by cloudfoundry-incubator.

the class RetryingEncryptionServiceTest method decryptionLocks_acquiresALunaUsageReadLock.

@Test
public void decryptionLocks_acquiresALunaUsageReadLock() throws Exception {
    when(keySet.get(activeKeyUuid)).thenReturn(firstActiveKey);
    subject.decrypt(new EncryptedValue(activeKeyUuid, "an encrypted value".getBytes(), "a nonce".getBytes()));
    verify(readLock, times(1)).lock();
    verify(readLock, times(1)).unlock();
    verify(writeLock, times(0)).lock();
    verify(writeLock, times(0)).unlock();
}