com.google.crypto.tink.mac

Class AesCmacKey

java.lang.Object

com.google.crypto.tink.Key

com.google.crypto.tink.mac.MacKey

com.google.crypto.tink.mac.AesCmacKey

@Immutable
public final class AesCmacKey
extends MacKey

Represents a key computing AES-CMAC.

AES-CMAC is specified in RFC 4493. Tink supports AES-CMAC with keys of length 32 bytes (256 bits) only.

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	AesCmacKey.Builder Builder for AesCmacKey.

Method Summary

Modifier and Type	Method and Description
static AesCmacKey.Builder	builder()
boolean	equalsKey(Key o) Returns true if the key is equal to the passed in key.
SecretBytes	getAesKey() Returns the underlying AES key.
Integer	getIdRequirementOrNull() Returns null if this key has no id requirement, otherwise the required id.
Bytes	getOutputPrefix() Returns a Bytes instance which is prefixed to every mac tag.
AesCmacParameters	getParameters() Returns the parameters of this key.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Detail

builder

public static AesCmacKey.Builder builder()

getAesKey

public SecretBytes getAesKey()

Returns the underlying AES key.

getOutputPrefix

public Bytes getOutputPrefix()

Description copied from class: MacKey

Returns a Bytes instance which is prefixed to every mac tag.

In order to make key rotation more efficient, Tink allows every Mac key to be prefixed with a sequence of bytes. When verifying a tag, only keys with matching prefix have to be tried.

Note that a priori, the output prefix may not be unique in a keyset (i.e., different keys in a keyset may have the same prefix (or, one prefix may be a prefix of the other). To avoid this, built in Tink keys use the convention that the prefix is either '0x00' or '0x01'. See the Tink keys for details.

Specified by:

getOutputPrefix in class MacKey

getParameters

public AesCmacParameters getParameters()

Description copied from class: MacKey

Returns the parameters of this key.

Specified by:

getParameters in class MacKey

getIdRequirementOrNull

@Nullable
public Integer getIdRequirementOrNull()

Description copied from class: Key

Returns null if this key has no id requirement, otherwise the required id.

Some keys, when they are in a keyset, are required to have a certain ID to work properly. This comes from the fact that Tink in some cases prefixes ciphertexts or signatures with the string 0x01<id>, where the ID is encoded in big endian (see the documentation of the key type for details), in which case the key requires a certain ID.

Specified by:

getIdRequirementOrNull in class Key

equalsKey

public boolean equalsKey(Key o)

Description copied from class: Key

Returns true if the key is equal to the passed in key.

Implementations are required to do this in constant time.

Note: Tink Key objects should typically not override hashCode (because it could risk leaking key material). Hence, they typically also should not override equals.

Specified by:

equalsKey in class Key