Package com.emc.object.s3.jersey

Class S3EncryptionClient

  • All Implemented Interfaces:
    S3Client
    public class S3EncryptionClient
extends S3JerseyClient
    Implements client-side encryption on top of the S3 API. Encryption method uses "Envelope Encryption". With envelope encryption, a master asymmetric (RSA) key is used to encrypt and decrypt a per-object symmetric (AES) key. This means that every object is encrypted using a unique key so breaking any one object's key does not compromise the encryption on other objects. Key rotation can also be accomplished by creating a new asymmetric key and re-encrypting the object keys without re-encrypting the actual object content.
    To use encryption, you will first need to create a keystore, set a password, and then create an RSA key to use as your master encryption key. This can be accomplished using the 'keytool' application that comes with Java In this example, we create a 2048-bit RSA key and call it "masterkey". If the keystore does not already exist, it will be created an you will be prompted for a keystore password. 
     $ keytool -genkeypair -keystore keystore.jks -alias masterkey -keyalg RSA \
   -keysize 2048 -dname "CN=My Name, OU=My Division, O=My Company, L=My Location, ST=MA, C=US"
 Enter keystore password: changeit
 Re-enter new password: changeit
 Enter key password for <masterkey>
   (RETURN if same as keystore password):
    Inside your application, you can then construct and load a Keystore object, KeyStore.load(InputStream, char[]) Once the keystore has been loaded, you then construct a EncryptionConfig object with the keystore: 
     EncryptionConfig ec = new EncryptionConfig(keystore,
             keystorePassword.toCharArray(), "masterkey", provider, 128);
    The "provider" argument is used to specify the security provider to be used for cryptographic operations. You can set it to null to use the default provider(s) as specified in your jre/lib/security/java.security file. The final argument is the AES encryption key size. Note that most JDKs only support 128-bit AES encryption by default and required the "unlimited strength jurisdiction policy files" to be installed to achieve 256-bit support. See your JRE/JDK download page for details.
    Once you have your EncryptionConfig, simply pass this to the constructor of S3EncryptionClient: 
     S3Client s3Client = new S3EncryptionClient(s3Config, ec);

    After you have your S3EncryptionClient constructed, you may use it like any other S3Client instance with the following limitations:
    • Byte range (partial) reads are not supported
    • Byte range (partial) updates including appends are not supported.
    • Pre-signed URLs are not supported because there is no way to decompress and/or decrypt the content for the receiver.