1 /** 2 * Copyright 2021 Google LLC 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except 5 * in compliance with the License. You may obtain a copy of the License at 6 * 7 * http://www.apache.org/licenses/LICENSE-2.0 8 * 9 * Unless required by applicable law or agreed to in writing, software distributed under the License 10 * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express 11 * or implied. See the License for the specific language governing permissions and limitations under 12 * the License. 13 */ 14 // [START envelope-example] 15 package envelopeaead; 16 17 import static java.nio.charset.StandardCharsets.UTF_8; 18 19 import com.google.crypto.tink.Aead; 20 import com.google.crypto.tink.KmsClient; 21 import com.google.crypto.tink.aead.AeadConfig; 22 import com.google.crypto.tink.aead.KmsEnvelopeAead; 23 import com.google.crypto.tink.aead.PredefinedAeadParameters; 24 import com.google.crypto.tink.integration.gcpkms.GcpKmsClient; 25 import java.io.File; 26 import java.io.FileOutputStream; 27 import java.nio.file.Files; 28 import java.nio.file.Paths; 29 import java.security.GeneralSecurityException; 30 31 /** 32 * A command-line utility for encrypting small files with envelope encryption. 33 * 34 * <p>It requires the following arguments: 35 * 36 * <ul> 37 * <li>mode: Can be "encrypt" or "decrypt" to encrypt/decrypt the input to the output. 38 * <li>kek-uri: Use this Cloud KMS' key as the key-encrypting-key for envelope encryption. 39 * <li>gcp-credential-file: Use this JSON credential file to connect to Cloud KMS. 40 * <li>input-file: Read the input from this file. 41 * <li>output-file: Write the result to this file. 42 * <li>[optional] associated-data: Associated data used for the encryption or decryption. 43 */ 44 public final class EnvelopeAeadExample { 45 private static final String MODE_ENCRYPT = "encrypt"; 46 private static final String MODE_DECRYPT = "decrypt"; 47 main(String[] args)48 public static void main(String[] args) throws Exception { 49 if (args.length != 5 && args.length != 6) { 50 System.err.printf("Expected 5 or 6 parameters, got %d\n", args.length); 51 System.err.println( 52 "Usage: java EnvelopeAeadExample encrypt/decrypt kek-uri gcp-credential-file" 53 + " input-file output-file [associated-data]"); 54 System.exit(1); 55 } 56 String mode = args[0]; 57 String kekUri = args[1]; 58 String gcpCredentialFilename = args[2]; 59 byte[] input = Files.readAllBytes(Paths.get(args[3])); 60 File outputFile = new File(args[4]); 61 byte[] associatedData = new byte[0]; 62 if (args.length == 6) { 63 System.out.println("Associated data!"); 64 associatedData = args[5].getBytes(UTF_8); 65 } 66 // Initialise Tink: register all AEAD key types with the Tink runtime 67 AeadConfig.register(); 68 69 // Read the GCP credentials and create a remote AEAD object. 70 Aead remoteAead = null; 71 try { 72 KmsClient kmsClient = new GcpKmsClient().withCredentials(gcpCredentialFilename); 73 remoteAead = kmsClient.getAead(kekUri); 74 } catch (GeneralSecurityException ex) { 75 System.err.println("Error initializing GCP client: " + ex); 76 System.exit(1); 77 } 78 79 // Create envelope AEAD primitive using AES256 GCM for encrypting the data 80 Aead aead = KmsEnvelopeAead.create(PredefinedAeadParameters.AES256_GCM, remoteAead); 81 82 // Use the primitive to encrypt/decrypt files. 83 if (MODE_ENCRYPT.equals(mode)) { 84 byte[] ciphertext = aead.encrypt(input, associatedData); 85 try (FileOutputStream stream = new FileOutputStream(outputFile)) { 86 stream.write(ciphertext); 87 } 88 } else if (MODE_DECRYPT.equals(mode)) { 89 byte[] plaintext = aead.decrypt(input, associatedData); 90 try (FileOutputStream stream = new FileOutputStream(outputFile)) { 91 stream.write(plaintext); 92 } 93 } else { 94 System.err.println("The first argument must be either encrypt or decrypt, got: " + mode); 95 System.exit(1); 96 } 97 98 System.exit(0); 99 } 100 EnvelopeAeadExample()101 private EnvelopeAeadExample() {} 102 } 103 // [END envelope-example] 104