com.amazonaws.services.s3.internal.crypto.v2

Class S3CryptoModuleAE

java.lang.Object

com.amazonaws.services.s3.internal.crypto.v2.S3CryptoModule<T>

com.amazonaws.services.s3.internal.crypto.v2.S3CryptoModuleBase<com.amazonaws.services.s3.internal.crypto.v2.MultipartUploadCryptoContext>

com.amazonaws.services.s3.internal.crypto.v2.S3CryptoModuleAE

Direct Known Subclasses:

S3CryptoModuleAEStrict

public class S3CryptoModuleAE
extends S3CryptoModuleBase<com.amazonaws.services.s3.internal.crypto.v2.MultipartUploadCryptoContext>

Authenticated encryption (AE) cryptographic module for the S3 encryption client.

Field Summary

Fields inherited from class com.amazonaws.services.s3.internal.crypto.v2.S3CryptoModuleBase

contentCryptoScheme, cryptoConfig, DEFAULT_BUFFER_SIZE, kekMaterialsProvider, kms, log, multipartUploadContexts, s3

Constructor Summary

Constructors

Constructor and Description
S3CryptoModuleAE(AWSKMS kms, S3Direct s3, AWSCredentialsProvider credentialsProvider, EncryptionMaterialsProvider encryptionMaterialsProvider, CryptoConfigurationV2 cryptoConfig)

Method Summary

Modifier and Type	Method and Description
protected com.amazonaws.services.s3.internal.crypto.v2.S3ObjectWrapper	adjustToDesiredRange(com.amazonaws.services.s3.internal.crypto.v2.S3ObjectWrapper s3object, long[] range, Map<String,String> instruction) Adjusts the retrieved S3Object so that the object contents contain only the range of bytes desired by the user.
protected long	ciphertextLength(long originalContentLength) Returns the length of the ciphertext computed from the length of the plaintext.
S3Object	getObjectSecurely(GetObjectRequest req)
ObjectMetadata	getObjectSecurely(GetObjectRequest getObjectRequest, File destinationFile)
protected boolean	isRangeGetEnabled()
protected boolean	isStrict() Returns true if a strict encryption mode is in use in the current crypto module; false otherwise.

Methods inherited from class com.amazonaws.services.s3.internal.crypto.v2.S3CryptoModuleBase

abortMultipartUploadSecurely, completeMultipartUploadSecurely, copyPartSecurely, createContentCryptoMaterial, createInstructionPutRequest, generateCEK, getCryptoConfiguration, getEncryptionMaterialsProvider, initiateMultipartUploadSecurely, newMultipartS3CipherInputStream, plaintextLength, putInstructionFileSecurely, putLocalObjectSecurely, putObjectSecurely, securityCheck, updateInstructionPutRequest, updateMetadataWithContentCryptoMaterial, uploadPartSecurely, wrapWithCipher

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

S3CryptoModuleAE

public S3CryptoModuleAE(AWSKMS kms,
                        S3Direct s3,
                        AWSCredentialsProvider credentialsProvider,
                        EncryptionMaterialsProvider encryptionMaterialsProvider,
                        CryptoConfigurationV2 cryptoConfig)

Parameters:

cryptoConfig - a read-only copy of the crypto configuration.

Method Detail

isStrict

protected boolean isStrict()

Returns true if a strict encryption mode is in use in the current crypto module; false otherwise.

getObjectSecurely

public S3Object getObjectSecurely(GetObjectRequest req)

Specified by:

getObjectSecurely in class S3CryptoModule<com.amazonaws.services.s3.internal.crypto.v2.MultipartUploadCryptoContext>

adjustToDesiredRange

protected final com.amazonaws.services.s3.internal.crypto.v2.S3ObjectWrapper adjustToDesiredRange(com.amazonaws.services.s3.internal.crypto.v2.S3ObjectWrapper s3object,
                                                                                                  long[] range,
                                                                                                  Map<String,String> instruction)

Adjusts the retrieved S3Object so that the object contents contain only the range of bytes desired by the user. Since encrypted contents can only be retrieved in CIPHER_BLOCK_SIZE (16 bytes) chunks, the S3Object potentially contains more bytes than desired, so this method adjusts the contents range.

Parameters:

s3object - The S3Object retrieved from S3 that could possibly contain more bytes than desired by the user.

range - A two-element array of longs corresponding to the start and finish (inclusive) of a desired range of bytes.

instruction - Instruction file in JSON or null if no instruction file is involved

Returns:

The S3Object with adjusted object contents containing only the range desired by the user. If the range specified is invalid, then the S3Object is returned without any modifications.

getObjectSecurely

public ObjectMetadata getObjectSecurely(GetObjectRequest getObjectRequest,
                                        File destinationFile)

Specified by:

getObjectSecurely in class S3CryptoModule<com.amazonaws.services.s3.internal.crypto.v2.MultipartUploadCryptoContext>

ciphertextLength

protected final long ciphertextLength(long originalContentLength)

Description copied from class: S3CryptoModuleBase

Returns the length of the ciphertext computed from the length of the plaintext.

Specified by:

ciphertextLength in class S3CryptoModuleBase<com.amazonaws.services.s3.internal.crypto.v2.MultipartUploadCryptoContext>

Parameters:

originalContentLength - a non-negative number

Returns:

a non-negative number

isRangeGetEnabled

protected boolean isRangeGetEnabled()