com.nimbusds.jose.crypto.MACSigner Maven / Gradle / Ivy
Show all versions of nimbus-jose-jwt Show documentation
/*
* nimbus-jose-jwt
*
* Copyright 2012-2023, Connect2id Ltd.
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use
* this file except in compliance with the License. You may obtain a copy of the
* License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed
* under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
* CONDITIONS OF ANY KIND, either express or implied. See the License for the
* specific language governing permissions and limitations under the License.
*/
package com.nimbusds.jose.crypto;
import com.nimbusds.jose.JOSEException;
import com.nimbusds.jose.JWSHeader;
import com.nimbusds.jose.JWSSigner;
import com.nimbusds.jose.KeyLengthException;
import com.nimbusds.jose.crypto.impl.HMAC;
import com.nimbusds.jose.crypto.impl.MACProvider;
import com.nimbusds.jose.jwk.OctetSequenceKey;
import com.nimbusds.jose.util.Base64URL;
import com.nimbusds.jose.util.StandardCharset;
import net.jcip.annotations.ThreadSafe;
import javax.crypto.SecretKey;
/**
* Message Authentication Code (MAC) signer of
* {@link com.nimbusds.jose.JWSObject JWS objects}. Expects a secret key.
*
* See RFC 7518
* section 3.2
* for more information.
*
*
This class is thread-safe.
*
*
Supports the following algorithms:
*
*
* - {@link com.nimbusds.jose.JWSAlgorithm#HS256}
*
- {@link com.nimbusds.jose.JWSAlgorithm#HS384}
*
- {@link com.nimbusds.jose.JWSAlgorithm#HS512}
*
*
* Tested with the AWS CloudHSM JCE provider.
*
* @author Vladimir Dzhuvinov
* @author Ulrich Winter
* @version 2024-10-28
*/
@ThreadSafe
public class MACSigner extends MACProvider implements JWSSigner {
/**
* Creates a new Message Authentication (MAC) signer.
*
* @param secret The secret. Must be at least 256 bits long and not
* {@code null}.
*
* @throws KeyLengthException If the secret length is shorter than the
* minimum 256-bit requirement.
*/
public MACSigner(final byte[] secret)
throws KeyLengthException {
super(secret);
}
/**
* Creates a new Message Authentication (MAC) signer.
*
* @param secretString The secret as a UTF-8 encoded string. Must be at
* least 256 bits long and not {@code null}.
*
* @throws KeyLengthException If the secret length is shorter than the
* minimum 256-bit requirement.
*/
public MACSigner(final String secretString)
throws KeyLengthException {
this(secretString.getBytes(StandardCharset.UTF_8));
}
/**
* Creates a new Message Authentication (MAC) signer.
*
* @param secretKey The secret key. Must be at least 256 bits long and
* not {@code null}.
*
* @throws KeyLengthException If the secret length is shorter than the
* minimum 256-bit requirement.
*/
public MACSigner(final SecretKey secretKey)
throws KeyLengthException {
super(secretKey);
}
/**
* Creates a new Message Authentication (MAC) signer.
*
* @param jwk The secret as a JWK. Must be at least 256 bits long and
* not {@code null}.
*
* @throws KeyLengthException If the secret length is shorter than the
* minimum 256-bit requirement.
*/
public MACSigner(final OctetSequenceKey jwk)
throws KeyLengthException {
this(jwk.toByteArray());
}
@Override
public Base64URL sign(final JWSHeader header, final byte[] signingInput)
throws JOSEException {
ensureSecretLengthSatisfiesAlgorithm(header.getAlgorithm());
String jcaAlg = getJCAAlgorithmName(header.getAlgorithm());
byte[] hmac = HMAC.compute(jcaAlg, getSecretKey(), signingInput, getJCAContext().getProvider());
return Base64URL.encode(hmac);
}
}