net.java.truevfs.driver.zip.raes.crypto

Class RaesReadOnlyChannel

java.lang.Object

net.java.truecommons.io.AbstractSeekableChannel

net.java.truecommons.io.DecoratingSeekableChannel

net.java.truecommons.io.ReadOnlyChannel

net.java.truevfs.driver.zip.raes.crypto.RaesReadOnlyChannel

All Implemented Interfaces:

Closeable, AutoCloseable, ByteChannel, Channel, ReadableByteChannel, SeekableByteChannel, WritableByteChannel

@NotThreadSafe
public abstract class RaesReadOnlyChannel
extends net.java.truecommons.io.ReadOnlyChannel

This class implements a SeekableByteChannel for random read-only access to the plain text data of a RAES encrypted file, where RAES means Random Access Encryption Specification. RAES specifies a multistep authentication process:

The first step is mandatory and implemented in the constructor of the concrete implementation of this abstract class. For this step only the cipher key and the file length is authenticated, which is fast to process (O(1)).

The second step is optional and must be initiated by the client by calling authenticate(). For this step the entire cipher text is authenticated, which is comparably slow (O(n)). Please note that this step does not require the cipher text to be decrypted first, which features comparably fast processing.

So it is up to the application which level of security it needs to provide: Most applications should always call authenticate() in order to guard against integrity attacks. However, some applications may provide additional (faster) methods for authentication of the pay load, in which case the authentication provided by this class may be safely skipped.

Note that this channel implements its own virtual file pointer.

Author:

Christian Schlichtherle

See Also:

RaesOutputStream

Field Summary

Fields inherited from class net.java.truecommons.io.DecoratingSeekableChannel

channel

Constructor Summary

Constructors

Constructor and Description
RaesReadOnlyChannel()

Method Summary

Modifier and Type	Method and Description
abstract void	authenticate() Authenticates all encrypted data in this read only file.
static RaesReadOnlyChannel	create(RaesParameters param, net.java.truecommons.io.Source source) Creates a new RAES read-only channel.
abstract net.java.truecommons.key.spec.common.AesKeyStrength	getKeyStrength() Returns the key strength which is actually used to decrypt the data of the RAES file.

Methods inherited from class net.java.truecommons.io.ReadOnlyChannel

truncate, write

Methods inherited from class net.java.truecommons.io.DecoratingSeekableChannel

close, isOpen, position, position, read, size, toString

Methods inherited from class net.java.truecommons.io.AbstractSeekableChannel

checkOpen

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Constructor Detail

RaesReadOnlyChannel

public RaesReadOnlyChannel()

Method Detail

authenticate

public abstract void authenticate()
                           throws RaesAuthenticationException,
                                  IOException

Authenticates all encrypted data in this read only file. It is safe to call this method multiple times to detect if the file has been tampered with meanwhile.

This is the second, optional step of authentication. The first, mandatory step is to compute the cipher key and cipher text length only and must already have been successfully completed in the constructor.

Throws:

RaesAuthenticationException - If the computed MAC does not match the MAC declared in the RAES file.

IOException - On any I/O related issue.

create

@CreatesObligation
public static RaesReadOnlyChannel create(RaesParameters param,
                                                            net.java.truecommons.io.Source source)
                                                     throws RaesParametersException,
                                                            RaesException,
                                                            EOFException,
                                                            IOException

Creates a new RAES read-only channel.

Parameters:

param - the RaesParameters required to access the RAES type actually found in the file. If the class of this parameter does not match the required parameter interface according to the RAES type found in the file, but is an instance of the RaesParametersProvider interface, then it gets queried to find the required RAES parameters. This algorithm gets recursively applied.

source - the source for reading the RAES file from.

Returns:

A new RAES read-only channel.

Throws:

RaesParametersException - If no RAES parameter can be found which match the type of RAES file in the given channel.

RaesException - If the file is not RAES compatible.

EOFException - on unexpected end-of-file.

IOException - on any I/O error.

getKeyStrength

public abstract net.java.truecommons.key.spec.common.AesKeyStrength getKeyStrength()

Returns the key strength which is actually used to decrypt the data of the RAES file.

Returns:

The key strength which is actually used to decrypt the data of the RAES file.