Information about the receiver of an encrypted message used in
EnvelopedDataEncryptor. The RecipientInfo type depends on the key
management algorithm used for the recipient of an
EnvelopedData
or
AuthenticatedData. CMS provides three alternatives (see rfc5652):
- key transport: the content-encryption key is encrypted with the public
key of the recipient. This technique id compatible to PKCS#7 when creating a
RecipientInfo for the public key of the recipient's certificate, identified
by issuer and serial number. CMS recommends to use RSA for encrypting the
content encryption key.
- key agreement: the recipient's public key and the sender's private key
are used to generate a symmetric key, then the content encryption key is
encrypted with the symmetric key. Each RecipientInfo of type may transfer the
encrypted content encryption key to one or more recipient using the same key
agreement algorithm and domain parameters for that algorithm. CMS recommends
to use ESDH with an ephemeral sender key.
- symmetric key-encryption keys: the content-encryption key is encrypted
with a previously distributed symmetric key-encryption key. The RecipientInfo
is using a CMS key wrap algorithm like Triple-DES key wrap or RC2 key wrap.
- password based encryption: the content-encryption key is encrypted with
key-encryption key derived from a password. The RecipientInfo is using a key
derivation algorithm like PBKDF2 as specified by RFC 2898 (PKCS#5) and a key encryption
algorithm like PWRI-KEK as specified by RFC 3211.
- any other technique: based on private, user defined key management
techniques
Currently we only support the "key transport" alternative. However in
preparation to support in future further types, we have introduced this
class.