1414 */
1515package com .amazonaws .examples ;
1616
17+ import com .amazonaws .services .dynamodbv2 .datamodeling .encryption .DynamoDBEncryptor ;
18+ import com .amazonaws .services .dynamodbv2 .datamodeling .encryption .EncryptionContext ;
19+ import com .amazonaws .services .dynamodbv2 .datamodeling .encryption .EncryptionFlags ;
20+ import com .amazonaws .services .dynamodbv2 .datamodeling .encryption .providers .WrappedMaterialsProvider ;
21+ import com .amazonaws .services .dynamodbv2 .model .AttributeValue ;
1722import java .nio .ByteBuffer ;
1823import java .security .GeneralSecurityException ;
1924import java .security .KeyPair ;
2328import java .util .Map ;
2429import java .util .Set ;
2530
26- import com .amazonaws .services .dynamodbv2 .datamodeling .encryption .DynamoDBEncryptor ;
27- import com .amazonaws .services .dynamodbv2 .datamodeling .encryption .EncryptionContext ;
28- import com .amazonaws .services .dynamodbv2 .datamodeling .encryption .EncryptionFlags ;
29- import com .amazonaws .services .dynamodbv2 .datamodeling .encryption .providers .WrappedMaterialsProvider ;
30- import com .amazonaws .services .dynamodbv2 .model .AttributeValue ;
31-
3231/**
33- * Example showing use of RSA keys for encryption and signing.
34- * For ease of the example, we create new random ones every time.
32+ * Example showing use of RSA keys for encryption and signing. For ease of the example, we create
33+ * new random ones every time.
3534 */
3635public class AsymmetricEncryptedItem {
3736 private static final String STRING_FIELD_NAME = "example" ;
@@ -50,7 +49,8 @@ public static void main(String[] args) throws GeneralSecurityException {
5049 encryptRecord (tableName , wrappingKeys , signingKeys );
5150 }
5251
53- public static void encryptRecord (String tableName , KeyPair wrappingKeys , KeyPair signingKeys ) throws GeneralSecurityException {
52+ public static void encryptRecord (String tableName , KeyPair wrappingKeys , KeyPair signingKeys )
53+ throws GeneralSecurityException {
5454 // Sample record to be encrypted
5555 final String partitionKeyName = "partition_attribute" ;
5656 final String sortKeyName = "sort_attribute" ;
@@ -59,25 +59,34 @@ public static void encryptRecord(String tableName, KeyPair wrappingKeys, KeyPair
5959 record .put (sortKeyName , new AttributeValue ().withN ("55" ));
6060 record .put (STRING_FIELD_NAME , new AttributeValue ().withS ("data" ));
6161 record .put (NUMBER_FIELD_NAME , new AttributeValue ().withN ("99" ));
62- record .put (BINARY_FIELD_NAME , new AttributeValue ().withB (ByteBuffer .wrap (new byte []{0x00 , 0x01 , 0x02 })));
63- record .put (IGNORED_FIELD_NAME , new AttributeValue ().withS ("alone" )); // We want to ignore this attribute
62+ record .put (
63+ BINARY_FIELD_NAME ,
64+ new AttributeValue ().withB (ByteBuffer .wrap (new byte [] {0x00 , 0x01 , 0x02 })));
65+ record .put (
66+ IGNORED_FIELD_NAME ,
67+ new AttributeValue ().withS ("alone" )); // We want to ignore this attribute
6468
65- // Set up our configuration and clients. All of this is thread-safe and can be reused across calls.
69+ // Set up our configuration and clients. All of this is thread-safe and can be reused across
70+ // calls.
6671 // Provider Configuration
67- final WrappedMaterialsProvider cmp = new WrappedMaterialsProvider (wrappingKeys .getPublic (), wrappingKeys .getPrivate (), signingKeys );
72+ final WrappedMaterialsProvider cmp =
73+ new WrappedMaterialsProvider (
74+ wrappingKeys .getPublic (), wrappingKeys .getPrivate (), signingKeys );
6875 // Encryptor creation
6976 final DynamoDBEncryptor encryptor = DynamoDBEncryptor .getInstance (cmp );
7077
7178 // Information about the context of our data (normally just Table information)
72- final EncryptionContext encryptionContext = new EncryptionContext .Builder ()
73- .withTableName (tableName )
74- .withHashKeyName (partitionKeyName )
75- .withRangeKeyName (sortKeyName )
76- .build ();
79+ final EncryptionContext encryptionContext =
80+ new EncryptionContext .Builder ()
81+ .withTableName (tableName )
82+ .withHashKeyName (partitionKeyName )
83+ .withRangeKeyName (sortKeyName )
84+ .build ();
7785
7886 // Describe what actions need to be taken for each attribute
7987 final EnumSet <EncryptionFlags > signOnly = EnumSet .of (EncryptionFlags .SIGN );
80- final EnumSet <EncryptionFlags > encryptAndSign = EnumSet .of (EncryptionFlags .ENCRYPT , EncryptionFlags .SIGN );
88+ final EnumSet <EncryptionFlags > encryptAndSign =
89+ EnumSet .of (EncryptionFlags .ENCRYPT , EncryptionFlags .SIGN );
8190 final Map <String , Set <EncryptionFlags >> actions = new HashMap <>();
8291 for (final String attributeName : record .keySet ()) {
8392 switch (attributeName ) {
@@ -98,13 +107,22 @@ public static void encryptRecord(String tableName, KeyPair wrappingKeys, KeyPair
98107 // End set-up
99108
100109 // Encrypt the plaintext record directly
101- final Map <String , AttributeValue > encrypted_record = encryptor .encryptRecord (record , actions , encryptionContext );
110+ final Map <String , AttributeValue > encrypted_record =
111+ encryptor .encryptRecord (record , actions , encryptionContext );
102112
103113 // Encrypted record fields change as expected
104- assert encrypted_record .get (STRING_FIELD_NAME ).getB () != null ; // the encrypted string is stored as bytes
105- assert encrypted_record .get (NUMBER_FIELD_NAME ).getB () != null ; // the encrypted number is stored as bytes
106- assert !record .get (BINARY_FIELD_NAME ).getB ().equals (encrypted_record .get (BINARY_FIELD_NAME ).getB ()); // the encrypted bytes have updated
107- assert record .get (IGNORED_FIELD_NAME ).getS ().equals (encrypted_record .get (IGNORED_FIELD_NAME ).getS ()); // ignored field is left as is
114+ assert encrypted_record .get (STRING_FIELD_NAME ).getB ()
115+ != null ; // the encrypted string is stored as bytes
116+ assert encrypted_record .get (NUMBER_FIELD_NAME ).getB ()
117+ != null ; // the encrypted number is stored as bytes
118+ assert !record
119+ .get (BINARY_FIELD_NAME )
120+ .getB ()
121+ .equals (encrypted_record .get (BINARY_FIELD_NAME ).getB ()); // the encrypted bytes have updated
122+ assert record
123+ .get (IGNORED_FIELD_NAME )
124+ .getS ()
125+ .equals (encrypted_record .get (IGNORED_FIELD_NAME ).getS ()); // ignored field is left as is
108126
109127 // We could now put the encrypted item to DynamoDB just as we would any other item.
110128 // We're skipping it to to keep the example simpler.
@@ -113,12 +131,22 @@ public static void encryptRecord(String tableName, KeyPair wrappingKeys, KeyPair
113131 System .out .println ("Encrypted Record: " + encrypted_record );
114132
115133 // Decryption is identical. We'll pretend that we retrieved the record from DynamoDB.
116- final Map <String , AttributeValue > decrypted_record = encryptor .decryptRecord (encrypted_record , actions , encryptionContext );
134+ final Map <String , AttributeValue > decrypted_record =
135+ encryptor .decryptRecord (encrypted_record , actions , encryptionContext );
117136 System .out .println ("Decrypted Record: " + decrypted_record );
118137
119138 // The decrypted fields match the original fields before encryption
120- assert record .get (STRING_FIELD_NAME ).getS ().equals (decrypted_record .get (STRING_FIELD_NAME ).getS ());
121- assert record .get (NUMBER_FIELD_NAME ).getN ().equals (decrypted_record .get (NUMBER_FIELD_NAME ).getN ());
122- assert record .get (BINARY_FIELD_NAME ).getB ().equals (decrypted_record .get (BINARY_FIELD_NAME ).getB ());
139+ assert record
140+ .get (STRING_FIELD_NAME )
141+ .getS ()
142+ .equals (decrypted_record .get (STRING_FIELD_NAME ).getS ());
143+ assert record
144+ .get (NUMBER_FIELD_NAME )
145+ .getN ()
146+ .equals (decrypted_record .get (NUMBER_FIELD_NAME ).getN ());
147+ assert record
148+ .get (BINARY_FIELD_NAME )
149+ .getB ()
150+ .equals (decrypted_record .get (BINARY_FIELD_NAME ).getB ());
123151 }
124152}
0 commit comments