Examples with EncryptionKeyCanary org.cloudfoundry.credhub.entity.EncryptionKeyCanary used on opensource projects

Example 11 with EncryptionKeyCanary

use of org.cloudfoundry.credhub.entity.EncryptionKeyCanary in project credhub by cloudfoundry-incubator.

the class EncryptionKeyCanaryDataServiceTest method findAll_whenThereAreCanaries_returnsCanariesAsAList.

@Test
public void findAll_whenThereAreCanaries_returnsCanariesAsAList() {
    EncryptionKeyCanary firstCanary = new EncryptionKeyCanary();
    EncryptionKeyCanary secondCanary = new EncryptionKeyCanary();
    subject.save(firstCanary);
    subject.save(secondCanary);
    List<EncryptionKeyCanary> canaries = subject.findAll();
    List<UUID> uuids = canaries.stream().map(canary -> canary.getUuid()).collect(Collectors.toList());
    assertThat(canaries, hasSize(2));
    assertThat(uuids, containsInAnyOrder(firstCanary.getUuid(), secondCanary.getUuid()));
}

Example 12 with EncryptionKeyCanary

use of org.cloudfoundry.credhub.entity.EncryptionKeyCanary in project credhub by cloudfoundry-incubator.

the class EncryptionKeyRotatorTest method rotation_removesOldCanaries.

@Test
public void rotation_removesOldCanaries() throws Exception {
    setupInitialContext();
    setActiveKey(1);
    encryptionKeyRotator.rotate();
    List<UUID> oldCanaryUuids = keySet.getInactiveUuids();
    List<EncryptionKeyCanary> allCanaries = encryptionKeyCanaryDataService.findAll();
    List<UUID> remainingCanaryUuids = allCanaries.stream().map(EncryptionKeyCanary::getUuid).collect(Collectors.toList());
    assertThat(remainingCanaryUuids, hasItem(keySet.getActive().getUuid()));
    for (UUID uuid : oldCanaryUuids) {
        assertThat(remainingCanaryUuids, not(hasItem(uuid)));
    }
}

Example 13 with EncryptionKeyCanary

use of org.cloudfoundry.credhub.entity.EncryptionKeyCanary in project credhub by cloudfoundry-incubator.

the class EncryptionKeyRotatorTest method createOldKey.

private Key createOldKey() throws Exception {
    final PasswordBasedKeyProxy keyProxy = new PasswordBasedKeyProxy("old-password", 1, encryptionService);
    Key oldKey = keyProxy.deriveKey();
    oldCanary = new EncryptionKeyCanary();
    final EncryptedValue canaryEncryption = encryptionService.encrypt(null, oldKey, CANARY_VALUE);
    oldCanary.setEncryptedCanaryValue(canaryEncryption.getEncryptedValue());
    oldCanary.setNonce(canaryEncryption.getNonce());
    oldCanary = encryptionKeyCanaryDataService.save(oldCanary);
    keySet.add(new EncryptionKey(encryptionService, oldCanary.getUuid(), oldKey));
    return oldKey;
}

Example 14 with EncryptionKeyCanary

use of org.cloudfoundry.credhub.entity.EncryptionKeyCanary in project credhub by cloudfoundry-incubator.

the class PasswordBasedKeyProxyTest method matchesCanary_whenCanaryDoesNotContainSalt_returnsFalse.

@Test
public void matchesCanary_whenCanaryDoesNotContainSalt_returnsFalse() {
    EncryptionKeyCanary canary = new EncryptionKeyCanary();
    canary.setSalt(null);
    assertFalse(subject.matchesCanary(canary));
}

Example 15 with EncryptionKeyCanary

use of org.cloudfoundry.credhub.entity.EncryptionKeyCanary in project credhub by cloudfoundry-incubator.

the class PasswordBasedKeyProxyTest method matchesCanary_whenCanaryMatches_setsTheKey.

@Test
public void matchesCanary_whenCanaryMatches_setsTheKey() throws Exception {
    // Generate a key from the password and a new salt
    PasswordBasedKeyProxy oldProxy = new PasswordBasedKeyProxy(password, 1, encryptionService);
    Key derivedKey = oldProxy.deriveKey();
    final List<Byte> salt = oldProxy.getSalt();
    // Create a canary whose value is encrypted with this key
    final EncryptedValue encryptedCanaryValue = encryptionService.encrypt(null, derivedKey, CANARY_VALUE);
    EncryptionKeyCanary canary = new EncryptionKeyCanary();
    canary.setEncryptedCanaryValue(encryptedCanaryValue.getEncryptedValue());
    canary.setNonce(encryptedCanaryValue.getNonce());
    final Byte[] saltArray = new Byte[salt.size()];
    canary.setSalt(toPrimitive(salt.toArray(saltArray)));
    final boolean match = subject.matchesCanary(canary);
    assertTrue(match);
    assertThat(subject.getKey(), equalTo(derivedKey));
}