Kryptografie

<?xml version="1.0" encoding="UTF-8"?>
        <project xmlns="http://maven.apache.org/POM/4.0.0"
                 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                 xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
            <modelVersion>4.0.0</modelVersion>
            <parent>
                <groupId>at.aydin.academy</groupId>
                <artifactId>32crypto-pair</artifactId>
                <version>1.0.0</version>
                <relativePath>../pom.xml</relativePath>
            </parent>
            <artifactId>crypto-modern</artifactId>
            <packaging>jar</packaging>
            <name>Crypto Modern</name>

            <dependencies>

<dependency>
    <groupId>org.junit.jupiter</groupId>
    <artifactId>junit-jupiter</artifactId>
    <scope>test</scope>
</dependency>

            </dependencies>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-compiler-plugin</artifactId>
                    </plugin>

                </plugins>
            </build>
        </project>

package at.aydin.lab.crypto.modern;

import javax.crypto.*;
import javax.crypto.spec.*;
import java.nio.charset.StandardCharsets;
import java.security.*;

// Design Pattern: Security Gateway
// Zweck: Sichere kryptografische Parameter werden zentral erzwungen.
public final class AesGcmService {
    private final SecureRandom random = new SecureRandom();
    private SecretKey key(char[] password, byte[] salt) throws Exception {
        var f = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256");
        return new SecretKeySpec(f.generateSecret(new PBEKeySpec(password, salt, 120_000, 256)).getEncoded(), "AES");
    }

    public EncryptedPayload encrypt(String text, char[] password) throws Exception {
        byte[] salt = new byte[16], iv = new byte[12];
        random.nextBytes(salt);
        random.nextBytes(iv);
        Cipher c = Cipher.getInstance("AES/GCM/NoPadding");
        c.init(Cipher.ENCRYPT_MODE, key(password, salt), new GCMParameterSpec(128, iv));
        return new EncryptedPayload(salt, iv, c.doFinal(text.getBytes(StandardCharsets.UTF_8)));
    }

    public String decrypt(EncryptedPayload p, char[] password) throws Exception {
        Cipher c = Cipher.getInstance("AES/GCM/NoPadding");
        c.init(Cipher.DECRYPT_MODE, key(password, p.salt()), new GCMParameterSpec(128, p.iv()));
        return new String(c.doFinal(p.cipherText()), StandardCharsets.UTF_8);
    }
}

package at.aydin.lab.crypto.modern;

// Design Pattern: Value Object
// Zweck: Ciphertext, Salt und IV bleiben als untrennbare verschlüsselte Nutzlast zusammen.
public record EncryptedPayload(byte[] salt, byte[] iv, byte[] cipherText) {
    public EncryptedPayload {
        salt = salt.clone();
        iv = iv.clone();
        cipherText = cipherText.clone();
    }

    public byte[] salt() {
        return salt.clone();
    }

    public byte[] iv() {
        return iv.clone();
    }

    public byte[] cipherText() {
        return cipherText.clone();
    }
}

package at.aydin.lab.crypto.modern;

import org.junit.jupiter.api.Test;
import static org.junit.jupiter.api.Assertions.*;

class AesGcmServiceTest {
    @Test
    void encryptsRandomizedAndAuthenticated() throws Exception {
        var s = new AesGcmService();
        var a = s.encrypt("text", "pw".toCharArray());
        var b = s.encrypt("text", "pw".toCharArray());
        assertFalse(java.util.Arrays.equals(a.cipherText(), b.cipherText()));
        assertEquals("text", s.decrypt(a, "pw".toCharArray()));
    }
}