Interface AES_GCM
access this type via: sec.crypto.AES_GCM (provides, requires or uses)
AES-GCM implementation. AES-GCM provides confidentiality and authenticity of the encrypted ciphertext data.
Constants
byte ENCRYPT
byte DECRYPT
int KEY_128
int KEY_192
int KEY_256
Functions
AES_GCM(byte mode, int keyLength, char key[], char iv[])
bool encryptAAD(byte content[])
byte[] encryptGetTag()
bool decryptAAD(byte content[])
void decryptSetTag(byte tag[])
byte[] encryptPart(byte content[])
byte[] encryptFinish()
bool encryptOK()
byte[] decryptPart(byte content[])
byte[] decryptFinish()
bool decryptOK()
Constants
ENCRYPT
DECRYPT
KEY_128
KEY_192
KEY_256
AES_GCM(byte mode, int keyLength, char key[], char iv[])
Create the cipher using a given key length, shared secret key, and IV. The provided key must be the same length, in bits, as keyLength. Applications will typically use an SHA algorithm to convert an arbitrary-length key (like a user password) into a fixed-length key for use with a cipher. IV should be a randomly-generated string. The same IV value must be used when decrypting the ciphertext (it is generally considered safe to store / transmit the IV in plain text to allow decryption).
mode Encryption or decryption mode, using the constants ENCRYPT or DECRYPT.
keyLength The length of the key, in bits. This must be one of KEY_128, KEY_192, or KEY_256.
key The shared secret key, which must be the same length as the specified key length (e.g., 32 bytes for KEY_256). Applications will typically use an SHA algorithm to convert an arbitrary-length key (like a user password) into a fixed-length key for use with a cipher.
iv A string of characters, which is recommended to be of length 12 (96 bits). This is used to help generate the first encrypted block, and the same iv value must later be used to decrypt.
bool encryptAAD(byte content[])
This function associates 'additional authentication data' (AAD) to the encrypted ciphertext, and must be called before any encryption happens. The AAD content is associated, using a mathematical relationship, with to the encrypted data, so that at the point of decryption it is possible to check that the decrypted data relates to the AAD content. Using AAD is optional and does not increase the level of confidentiality or authenticity of the ciphertext itself, but may be useful to higher-level protocols to add additional levels of authenticity checking to transmitted data - such as an origin IP address of a message. Note that it is not advisable to attach a particularly large amount of AAD content.
byte[] encryptGetTag()
This function must be called after encryptFinish(), and returns the 'tag' associated with this encrypted ciphertext. The tag can be used during decryption to verify that the ciphertext was not modified or corrupted (or vice versa).
bool decryptAAD(byte content[])
This function associates 'additional authentication data' (AAD) to the encrypted ciphertext, and must be called before any decryption happens. The AAD content used here must be tbe same as the AAD content used when encrypting the ciphertext.
void decryptSetTag(byte tag[])
This function must be called before decryptFinish(), using the tag that was originally generated via encryptGetTag() when encrypting the data.
byte[] encryptPart(byte content[])
Encrypt part (or all) of a plain-text message. This function can be called repeatedly on each successive part of a message / data, or can be called once on the entirety of that item.
byte[] encryptFinish()
Finish encryption. This function must always be called to return any final bytes of ciphertext.
bool encryptOK()
Check if encryption process has occurred without errors so far. Because it is potentially 'normal' for encryptPart() or encryptFinish() to return an empty / null byte array, and this return status can also occur due to an exception, this function can be called to differentiate the two cases.
byte[] decryptPart(byte content[])
Decrypt part (or all) of a ciphertext message. This function can be called repeatedly on each successive part of a ciphertext message / data, or can be called once on the entirety of that item.
byte[] decryptFinish()
Finish decryption. This function must always be called to return any final bytes of decrypted plain text.
bool decryptOK()
Check if decryption process has occurred without errors so far. Because it is potentially 'normal' for decryptPart() or decryptFinish() to return an empty / null byte array, and this return status can also occur due to an exception, this function can be called to differentiate the two cases.