org.nuxeo.ecm.core.storage.binary

Class AESBinaryManager

java.lang.Object

org.nuxeo.ecm.core.storage.binary.AbstractBinaryManager

org.nuxeo.ecm.core.storage.binary.LocalBinaryManager

org.nuxeo.ecm.core.storage.binary.AESBinaryManager

All Implemented Interfaces:

Closeable, AutoCloseable, BinaryManager

public class AESBinaryManager
extends LocalBinaryManager

A binary manager that encrypts binaries on the filesystem using AES.

The BinaryManagerDescriptor configuration holds the keystore information to retrieve the AES key, or the password that is used to generate a per-file key using PBKDF2. This configuration comes from the <binaryManager key="..."> of the repository configuration.

The configuration has the form key1=value1,key2=value2,... where the possible keys are, for keystore use:

• keyStoreType: the keystore type, for instance JCEKS
• keyStoreFile: the path to the keystore, if applicable
• keyStorePassword: the keystore password
• keyAlias: the alias (name) of the key in the keystore
• keyPassword: the key password

And for PBKDF2 use:

• password: the password

To encrypt a binary, an AES key is needed. This key can be retrieved from a keystore, or generated from a password using PBKDF2 (in which case each stored file contains a different salt for security reasons). The file format is described in storeAndDigest(InputStream, OutputStream).

While the binary is being used by the application, a temporarily-decrypted file is held in a temporary directory. It is removed as soon as possible.

Note: if the Java Cryptographic Extension (JCE) is not configured for 256-bit key length, you may get an exception "java.security.InvalidKeyException: Illegal key size or default parameters". If this is the case, go to Oracle Java SE Downloads and download and install the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files for your JDK.

Since:

6.0

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	AESBinaryManager.CipherAndDigestOutputStream A CipherOutputStream that also does a digest of the original stream at the same time.

Nested classes/interfaces inherited from class org.nuxeo.ecm.core.storage.binary.LocalBinaryManager

LocalBinaryManager.DefaultBinaryGarbageCollector

Field Summary

Fields inherited from class org.nuxeo.ecm.core.storage.binary.LocalBinaryManager

CONFIG_FILE, DATA, DEFAULT_PATH, TMP

Fields inherited from class org.nuxeo.ecm.core.storage.binary.AbstractBinaryManager

DEFAULT_DEPTH, DEFAULT_DIGEST, MAX_BUF_SIZE, MIN_BUF_SIZE

Constructor Summary

Constructors

Constructor and Description
AESBinaryManager()

Method Summary

Methods

Modifier and Type	Method and Description
Binary	getBinary(String digest) Returns a Binary corresponding to the given digest.
void	initialize(BinaryManagerDescriptor binaryManagerDescriptor) Initializer.
String	storeAndDigest(InputStream in, OutputStream out) Encrypts the given input stream into the given output stream, while also computing the digest of the input stream.

Methods inherited from class org.nuxeo.ecm.core.storage.binary.LocalBinaryManager

close, getFileForDigest, getStorageDir, touch

Methods inherited from class org.nuxeo.ecm.core.storage.binary.AbstractBinaryManager

getBinary, getGarbageCollector, toHexString

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

AESBinaryManager

public AESBinaryManager()

Method Detail

initialize

public void initialize(BinaryManagerDescriptor binaryManagerDescriptor)
                throws IOException

Description copied from interface: BinaryManager

Initializer.

Specified by:

initialize in interface BinaryManager

Overrides:

initialize in class LocalBinaryManager

Throws:

IOException

getBinary

public Binary getBinary(String digest)

Description copied from interface: BinaryManager

Returns a Binary corresponding to the given digest.

A null is returned if the digest could not be found.

Specified by:

getBinary in interface BinaryManager

Overrides:

getBinary in class LocalBinaryManager

Parameters:

digest - the digest, or null

Returns:

the corresponding binary

storeAndDigest

public String storeAndDigest(InputStream in,
                    OutputStream out)
                      throws IOException

Encrypts the given input stream into the given output stream, while also computing the digest of the input stream.

File format version 1 (values are in network order):

• 10 bytes: magic number "NUXEOCRYPT"
• 1 byte: file format version = 1
• 1 byte: use keystore = 1, use PBKDF2 = 2
• if use PBKDF2:
  • 4 bytes: salt length = n
  • n bytes: salt data
• 4 bytes: IV length = p
• p bytes: IV data
• x bytes: encrypted stream

Parameters:

in - the input stream containing the data

file - the file containing the encrypted data

Returns:

the digest of the input stream

Throws:

IOException