Spring/spring-vault
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Incorporate review feedback

Browse Source 
See gh-574.
This commit is contained in:
Mark Paluch
2020-09-15 09:26:11 +02:00
parent e1def38217
commit 1dec9f542d
7 changed files with 108 additions and 85 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
spring-vault-core/src/main/java/org/springframework/vault/core/VaultTransitOperations.java
View File

@@ -102,7 +102,7 @@ public interface VaultTransitOperations {
void deleteKey(String keyName);
/**
* Rotates the version of the named key. After rotation, new plaintext requests will
* Rotates the version of the named key. After rotation, new plain text requests will
* be encrypted with the new version of the key. To upgrade ciphertext to be encrypted
* with the latest version of the key, use {@link #rewrap(String, String)}.
* @param keyName must not be empty or {@literal null}.
@@ -111,8 +111,8 @@ public interface VaultTransitOperations {
void rotate(String keyName);
/**
* Encrypts the provided plaintext using the named key. The given {@code plaintext} is
* encoded into bytes using the {@link java.nio.charset.Charset#defaultCharset()
* Encrypts the provided plain text using the named key. The given {@code plaintext}
* is encoded into bytes using the {@link java.nio.charset.Charset#defaultCharset()
* default charset}. Use
* {@link #encrypt(String, org.springframework.vault.support.Plaintext)} to construct
* a {@link org.springframework.vault.support.Plaintext#of(byte[]) Plaintext} object
@@ -124,7 +124,7 @@ public interface VaultTransitOperations {
String encrypt(String keyName, String plaintext);
/**
* Encrypts the provided plaintext using the named key.
* Encrypts the provided {@code plaintext} using the named key.
* @param keyName must not be empty or {@literal null}.
* @param plaintext must not be {@literal null}.
* @since 1.1
@@ -133,7 +133,7 @@ public interface VaultTransitOperations {
Ciphertext encrypt(String keyName, Plaintext plaintext);
/**
* Encrypts the provided plaintext using the named key.
* Encrypts the provided {@code plaintext} using the named key.
* @param keyName must not be empty or {@literal null}.
* @param plaintext must not be empty or {@literal null}.
* @param transitRequest must not be {@literal null}. Use
@@ -143,10 +143,10 @@ public interface VaultTransitOperations {
String encrypt(String keyName, byte[] plaintext, VaultTransitContext transitRequest);
/**
* Encrypts the provided batch of plaintext using the named key and context. The
* encryption is done using transit backend's batch operation.
* Encrypts the provided batch of {@code plaintext} using the named key and context.
* The encryption is done using transit backend's batch operation.
* @param keyName must not be empty or {@literal null}.
* @param batchRequest a list of {@link Plaintext} which includes plaintext and an
* @param batchRequest a list of {@link Plaintext} which includes plain text and an
* optional context.
* @return the encrypted result in the order of {@code batchRequest} plaintexts.
* @since 1.1
@@ -154,7 +154,7 @@ public interface VaultTransitOperations {
List<VaultEncryptionResult> encrypt(String keyName, List<Plaintext> batchRequest);
/**
* Decrypts the provided plaintext using the named key. The decoded {@code plaintext}
* Decrypts the provided plain text using the named key. The decoded {@code plaintext}
* is decoded into {@link String} the {@link java.nio.charset.Charset#defaultCharset()
* default charset}. Use
* {@link #decrypt(String, org.springframework.vault.support.Ciphertext)} to obtain a
@@ -167,7 +167,7 @@ public interface VaultTransitOperations {
String decrypt(String keyName, String ciphertext);
/**
* Decrypts the provided plaintext using the named key.
* Decrypts the provided cipher text using the named key.
* @param keyName must not be empty or {@literal null}.
* @param ciphertext must not be {@literal null}.
* @return plain text.
@@ -176,7 +176,7 @@ public interface VaultTransitOperations {
Plaintext decrypt(String keyName, Ciphertext ciphertext);
/**
* Decrypts the provided plaintext using the named key.
* Decrypts the provided {@code ciphertext} using the named key.
* @param keyName must not be empty or {@literal null}.
* @param ciphertext must not be empty or {@literal null}.
* @param transitContext must not be {@literal null}. Use
@@ -187,10 +187,10 @@ public interface VaultTransitOperations {
byte[] decrypt(String keyName, String ciphertext, VaultTransitContext transitContext);
/**
* Decrypts the provided barch of ciphertext using the named key and context. The*
* Decrypts the provided barch of cipher text using the named key and context. The*
* decryption is done using transit backend's batch operation.
* @param keyName must not be empty or {@literal null}.
* @param batchRequest a list of {@link Ciphertext} which includes plaintext and an
* @param batchRequest a list of {@link Ciphertext} which includes plain text and an
* optional context.
* @return the decrypted result in the order of {@code batchRequest} ciphertexts.
* @since 1.1
@@ -198,8 +198,8 @@ public interface VaultTransitOperations {
List<VaultDecryptionResult> decrypt(String keyName, List<Ciphertext> batchRequest);
/**
* Rewrap the provided ciphertext using the latest version of the named key. Because
* this never returns plaintext, it is possible to delegate this functionality to
* Rewrap the provided cipher text using the latest version of the named key. Because
* this never returns plain text, it is possible to delegate this functionality to
* untrusted users or scripts.
* @param keyName must not be empty or {@literal null}.
* @param ciphertext must not be empty or {@literal null}.
@@ -209,8 +209,8 @@ public interface VaultTransitOperations {
String rewrap(String keyName, String ciphertext);
/**
* Rewrap the provided ciphertext using the latest version of the named key. Because
* this never returns plaintext, it is possible to delegate this functionality to
* Rewrap the provided cipher text using the latest version of the named key. Because
* this never returns plain text, it is possible to delegate this functionality to
* untrusted users or scripts.
* @param keyName must not be empty or {@literal null}.
* @param ciphertext must not be empty or {@literal null}.

4
spring-vault-core/src/main/java/org/springframework/vault/support/Ciphertext.java
View File

@@ -20,7 +20,7 @@ import java.util.Objects;
import org.springframework.util.Assert;
/**
* Value object representing ciphertext with an optional {@link VaultTransitContext}.
* Value object representing cipher text with an optional {@link VaultTransitContext}.
*
* @author Praveendra Singh
* @author Mark Paluch
@@ -40,7 +40,7 @@ public class Ciphertext {
/**
* Factory method to create {@link Ciphertext} from the given {@code ciphertext}.
* @param ciphertext the ciphertext to decrypt, must not be {@literal null} or empty.
* @param ciphertext the cipher text to decrypt, must not be {@literal null} or empty.
* @return the {@link Ciphertext} for {@code ciphertext}.
*/
public static Ciphertext of(String ciphertext) {

14
spring-vault-core/src/main/java/org/springframework/vault/support/Plaintext.java
View File

@@ -22,7 +22,7 @@ import java.util.Objects;
import org.springframework.util.Assert;
/**
* Value object representing plaintext with an optional {@link VaultTransitContext}.
* Value object representing plain text with an optional {@link VaultTransitContext}.
* Plaintext is represented binary safe as {@code byte[]}.
*
* @author Praveendra Singh
@@ -69,7 +69,7 @@ public class Plaintext {
}
/**
* Factory method to create {@link Plaintext} using from {@link String}.
* Factory method to create {@link Plaintext} using from a {@link String}.
* {@link String} is encoded to {@code byte} using the default
* {@link java.nio.charset.Charset}. Use {@link #of(String, java.nio.charset.Charset)}
* to control the {@link java.nio.charset.Charset} to use.
@@ -81,7 +81,7 @@ public class Plaintext {
}
/**
* Factory method to create {@link Plaintext} using from {@link String} using the
* Factory method to create {@link Plaintext} using from a {@link String} using the
* given {@link java.nio.charset.Charset}. {@link java.nio.charset.Charset}.
* @param plaintext the plaintext to encrypt, must not be {@literal null}.
* @return the {@link Plaintext} for {@code plaintext}.
@@ -108,8 +108,8 @@ public class Plaintext {
}
/**
* Create a new {@link Plaintext} object from this plaintext associated with the given
* {@link VaultTransitContext}.
* Create a new {@link Plaintext} object from this plain text associated with the
* given {@link VaultTransitContext}.
* @param context transit context.
* @return the new {@link Plaintext} object.
*/
@@ -118,7 +118,7 @@ public class Plaintext {
}
/**
* @return the plaintext as {@link String} decoded using the default
* @return the plain text as {@link String} decoded using the default
* {@link java.nio.charset.Charset}.
*/
public String asString() {
@@ -127,7 +127,7 @@ public class Plaintext {
/**
* @param charset the charset to use for decoding.
* @return the plaintext as {@link String} decoded using the default
* @return the plain text as {@link String} decoded using the default
* {@link java.nio.charset.Charset}.
* @since 2.3
*/

4
spring-vault-core/src/main/java/org/springframework/vault/support/TransformCiphertext.java
View File

@@ -20,7 +20,7 @@ import org.springframework.util.Assert;
import java.util.Objects;
/**
* Value object representing ciphertext with an optional {@link VaultTransformContext}.
* Value object representing cipher text with an optional {@link VaultTransformContext}.
*
* @author Lauren Voswinkel
* @since 2.3
@@ -40,7 +40,7 @@ public class TransformCiphertext {
/**
* Factory method to create {@link TransformCiphertext} from the given
* {@code ciphertext}.
* @param ciphertext the ciphertext to decrypt, must not be {@literal null} or empty.
* @param ciphertext the cipher text to decrypt, must not be {@literal null} or empty.
* @return the {@link TransformCiphertext} for {@code ciphertext}.
*/
public static TransformCiphertext of(String ciphertext) {

37
spring-vault-core/src/main/java/org/springframework/vault/support/TransformPlaintext.java
View File

@@ -15,11 +15,13 @@
*/
package org.springframework.vault.support;
import java.nio.charset.Charset;
import org.springframework.util.Assert;
import org.springframework.util.ObjectUtils;
/**
* Value object representing plaintext with an optional {@link VaultTransformContext}.
* Value object representing plain text with an optional {@link VaultTransformContext}.
* Plaintext is represented binary safe as {@code byte[]}.
*
* @author Lauren Voswinkel
@@ -49,7 +51,7 @@ public class TransformPlaintext {
/**
* Factory method to create {@link TransformPlaintext} from a byte sequence.
* @param plaintext the plaintext to encrypt, must not be {@literal null}.
* @param plaintext the plain text to encrypt, must not be {@literal null}.
* @return the {@link TransformPlaintext} for {@code plaintext}.
*/
public static TransformPlaintext of(byte[] plaintext) {
@@ -67,18 +69,29 @@ public class TransformPlaintext {
* Factory method to create {@link TransformPlaintext} using from {@link String}.
* {@link String} is encoded to {@code byte} using the default
* {@link java.nio.charset.Charset}.
* @param plaintext the plaintext to encrypt, must not be {@literal null}.
* @param plaintext the plain text to encrypt, must not be {@literal null}.
* @return the {@link TransformPlaintext} for {@code plaintext}.
*/
public static TransformPlaintext of(String plaintext) {
return of(plaintext, Charset.defaultCharset());
}
/**
* Factory method to create {@link TransformPlaintext} using from a {@link String}
* using the given {@link java.nio.charset.Charset}. {@link java.nio.charset.Charset}.
* @param plaintext the plaintext to encrypt, must not be {@literal null}.
* @return the {@link Plaintext} for {@code plaintext}.
*/
public static TransformPlaintext of(String plaintext, Charset charset) {
Assert.notNull(plaintext, "Plaintext must not be null");
Assert.notNull(charset, "Charset must not be null");
if (plaintext.length() == 0) {
return empty();
}
return of(plaintext.getBytes());
return of(plaintext.getBytes(charset));
}
public byte[] getPlaintext() {
@@ -103,11 +116,23 @@ public class TransformPlaintext {
}
/**
* @return the plaintext as {@link String} decoded using the default
* @return the plain text as {@link String} decoded using the default
* {@link java.nio.charset.Charset}.
*/
public String asString() {
return new String(getPlaintext());
return asString(Charset.defaultCharset());
}
/**
* @param charset the charset to use for decoding.
* @return the plain text as {@link String} decoded using the default
* {@link java.nio.charset.Charset}.
*/
public String asString(Charset charset) {
Assert.notNull(charset, "Charset must not be null");
return new String(getPlaintext(), charset);
}
@Override

1
src/main/asciidoc/new-features.adoc
View File

@@ -8,6 +8,7 @@
* `ReactiveVaultEndpointProvider` for non-blocking lookup of `VaultEndpoint`.
* `VaultKeyValueMetadataOperations` for Key-Value metadata interaction.
* Support for `transform` backend (Enterprise Feature).
* Documentation of <<vault.core.secret-engines,how to use Vault secret backends>>.
[[new-features.2-2-0]]
=== What's new in Spring Vault 2.2

99
src/main/asciidoc/reference/vault-secret-engines.adoc
View File

@@ -13,22 +13,22 @@ Specifically, Spring Vault ships with extensions for:
* <<vault.core.backends.transit>>
* System Backend
All other backends can be used through methods on `VaultTemplate` directly (`VaultTemplate.read(…)`, `VaultTemplate.write(…)`).
You can use all other backends through methods on `VaultTemplate` directly (`VaultTemplate.read(…)`, `VaultTemplate.write(…)`).
[[vault.core.backends.kv1]]
== Key-Value Version 1 ("unversioned secrets")
The `kv` secrets engine is used to store arbitrary secrets within the configured physical storage for Vault.
When running the `kv` secrets engine non-versioned only the most recently written value for a key will be preserved.
The benefits of non-versioned kv is a reduced storage size for each key since no additional metadata or history is stored.
Additionally, requests going to a backend configured this way will be more performant because there will be fewer storage calls and no locking for any given request.
When running the `kv` secrets engine in a non-versioned way, only the most recently written value for a key is preserved.
The benefits of non-versioned kv is a reduced storage size for each key, since no additional metadata or history is stored.
Additionally, requests going to a backend configured this way are more performant because there are fewer storage calls and no locking for any given request.
Spring Vault ships with a dedicated Key-Value API to encapsulate differences between the individual Key-Value API implementations.
`VaultKeyValueOperations` follows the Vault CLI design.
That's the primary command line tool for Vault providing commands such as `vault kv get`, `vault kv put` and so on.
This API can be used with both Key-Value engine versions by specifying the version and mount path.
You can use this API with both Key-Value engine versions by specifying the version and mount path.
The following example uses the Key-Value version 1:
====
@@ -56,18 +56,18 @@ You can find more details about the https://www.vaultproject.io/api-docs/secret/
[[vault.core.backends.kv2]]
== Key-Value Version 2 ("versioned secrets")
The `kv` secrets engine can be run in one of two versions.
This section explains using version 2. When running v2 of the `kv` backend a key can retain a configurable number of versions.
The older versions' metadata and data can be retrieved.
Additionally, Check-and-Set operations can be used to avoid overwriting data unintentionally.
You can run the `kv` secrets engine in one of two versions.
This section explains using version 2. When running version 2 of the `kv` backend a key can retain a configurable number of versions.
You can retrieve the metadata and data of the older versions.
Additionally, you can use check-and-set operations to avoid unintentionally overwriting data.
Similar to <<vault.core.backends.kv1>>, Spring Vault ships with a dedicated Key-Value API to encapsulate differences between the individual Key-Value API implementations.
Spring Vault ships with a dedicated Key-Value API to encapsulate differences between the individual Key-Value API implementations.
`VaultKeyValueOperations` follows the Vault CLI design.
That's the primary command line tool for Vault providing commands such as `vault kv get`, `vault kv put` and so on.
That is the primary command line tool for Vault, providing commands such as `vault kv get`, `vault kv put`, and so on.
This API can be used with both Key-Value engine versions by specifying the version and mount path.
The following example uses the Key-Value version 2:
You can use this API with both Key-Value engine versions by specifying the version and mount path.
The following example uses Key-Value version 2:
====
[source,java,indent=0]
@@ -76,7 +76,7 @@ include::../{example-root}/KeyValueV2.java[tags=keyValueApi]
----
====
`VaultKeyValueOperations` supports all Key-Value operations such as `put`, `get`, `delete`, `list`.
`VaultKeyValueOperations` supports all Key-Value operations, such as `put`, `get`, `delete`, `list`.
You can also interact with the specifics of the versioned key-value API. This is useful if you want to obtain a specific secret or you need access to the metadata.
@@ -93,8 +93,8 @@ include::../{example-root}/KeyValueV2.java[tags=versionedApi]
====
While using the `kv` v2 secrets engine through `VaultTemplate` is possible.
It’s not the most convenient approach since the API offers a different approach to context paths and how input/output is represented.
Specifically, interaction with the actual secrets requires wrapping/unwrapping of the data section and introducing a `data/` path segment between the mount and the secrets key.
It is not the most convenient approach since the API offers a different approach to context paths and how input/output is represented.
Specifically, interaction with the actual secrets requires wrapping and unwrapping of the data section and introducing a `data/` path segment between the mount and the secrets key.
====
[source,java,indent=0]
@@ -124,14 +124,14 @@ The following examples explain briefly the use of how to issue and revoke certif
----
include::../{example-root}/PKI.java[tags=pkiApi]
----
<1> Construct a certificate request using the `VaultCertificateRequest` builder.
<1> Construct a certificate request by using the `VaultCertificateRequest` builder.
<2> Request a certificate from Vault.
Vault acts as certificate authority and responds with a signed X.509 certificate.
The actual response is a `CertificateBundle`.
<3> Generated certificates can be loaded directly into a Java `KeyStore` containing public and private keys as well as the issuer certificate. `KeyStore` has a wide range of uses which makes this format suitable to configure for example a HTTP client, a database driver or a SSL-secured HTTP server.
<4> `CertificateBundle` allows accessing the private key, public and issuer certificate directly through the Java Cryptography Extension API.
<5> Once a certificate is no longer in use, it can be revokey through its serial number.
Vault will include the revoked certificate in its CRL.
<3> You can obtain generated certificates directly as Java KeyStore that contains public and private keys as well as the issuer certificate. KeyStore has a wide range of uses, which makes this format suitable to configure (for example a HTTP client, a database driver, or an SSL-secured HTTP server).
<4> `CertificateBundle` allows accessing the private key and the public and issuer certificates directly through the Java Cryptography Extension API.
<5> Once a certificate is no longer in use (or it was compromised), you can revoke it through its serial number.
Vault includes the revoked certificate in its CRL.
====
You can find more details about the https://www.vaultproject.io/api-docs/secret/pki[Vault PKI secrets API] in the Vault reference documentation.
@@ -139,31 +139,31 @@ You can find more details about the https://www.vaultproject.io/api-docs/secret/
[[vault.core.backends.token]]
== Token Authentication Backend
This backend is an authentication backend that doesn't interact with actual secrets.
This backend is an authentication backend that does not interact with actual secrets.
Rather, it gives access to access token management.
You can read more about <<vault.authentication.token,Token-based authentication>> in the <<vault.core.authentication, authentication methods chapter>>.
The `token` authentication method is built-in and automatically available at `/auth/token`.
It allows users to authenticate using a token, as well to create new tokens, revoke secrets by token, and more.
It lets users authenticate using a token, as well to create new tokens, revoke secrets by token, and more.
When any other auth method returns an identity, Vault core invokes the token method to create a new unique token for that identity.
The token store can also be used to bypass any other auth method: you can create tokens directly, as well as perform a variety of other operations on tokens such as renewal and revocation.
You can also use the token store to bypass any other auth method. You can create tokens directly, as well as perform a variety of other operations on tokens, such as renewal and revocation.
Spring Vault uses this backend to renew and revoke session tokens supplied by the configured <<vault.core.authentication, authentication method>>.
Spring Vault uses this backend to renew and revoke the session tokens supplied by the configured <<vault.core.authentication, authentication method>>.
The following examples shows how to request, renew and revoke a Vault token from within your application:
The following examples show how to request, renew and revoke a Vault token from within your application:
====
[source,java,indent=0]
----
include::../{example-root}/Token.java[tags=tokenApi]
----
<1> Create an token applying role defaults.
<1> Create an token by applying role defaults.
<2> Using the builder API, you can define fine-grained settings for the token to request.
Requesting a token returns a `VaultToken` which is used as value object for Vault tokens.
<3> Tokens can be renewed through the Token API. Typically, that is done by `SessionManager` to keep track of the Vault session token.
<5> Tokens can be revoked if needed through the Token API. Typically, that is done by `SessionManager` to keep track of the Vault session token.
Requesting a token returns a `VaultToken`, which is used as value object for Vault tokens.
<3> You can renew tokens through the Token API. Typically, that is done by `SessionManager` to keep track of the Vault session token.
<4> Tokens can be revoked if needed through the Token API. Typically, that is done by `SessionManager` to keep track of the Vault session token.
====
You can find more details about the https://www.vaultproject.io/api-docs/auth/token[Vault Token Auth Method API] in the Vault reference documentation.
@@ -172,12 +172,12 @@ You can find more details about the https://www.vaultproject.io/api-docs/auth/to
== Transit Backend
The transit secrets engine handles cryptographic functions on data in-transit.
Vault doesn't store the data sent to this secrets engine.
Vault does not store the data sent to this secrets engine.
It can also be seen as "cryptography as a service" or "encryption as a service".
The transit secrets engine can also sign and verify data; generate hashes and HMACs of data; and act as a random bytes source.
The transit secrets engine can also sign and verify data, generate hashes and HMACs of data, and act as a random bytes source.
The primary use case for transit is to encrypt data from applications while still storing that encrypted data in some primary data store.
This relieves the burden of proper encryption/decryption from application developers and pushes the burden onto the operators of Vault.
This relieves the burden of proper encryption and decryption from application developers and pushes the burden onto the operators of Vault.
Spring Vault supports a wide range of Transit operations:
@@ -188,10 +188,9 @@ Spring Vault supports a wide range of Transit operations:
* Signing and signature verification
All operations within `transit` are centered around keys.
The Transit engine supports the versioning of keys allowing you to pick a key type https://www.vaultproject.io/docs/secrets/transit[from a variety of key types].
Note that depending on the key type may impose a limitation on which operations can used.
The Transit engine supports the versioning of keys and https://www.vaultproject.io/docs/secrets/transit[a variety of key types].
Note that the key type may impose a limitation on which operations can used.
Let's take a look at encryption and decryption.
The following examples shows how to create a key and how to encrypt and decrypt data:
====
@@ -200,18 +199,18 @@ The following examples shows how to create a key and how to encrypt and decrypt
include::../{example-root}/Transit.java[tags=encryptSimple]
----
<1> First, we need a key to begin with.
Each key requires the type to be specified. `aes128-gcm96` supports encryption, decryption, key derivation, and convergent encryption of which we need encryption and decryption for this example.
<2> Next, we encrypt a `String` containing the plaintext that should be encrypted.
Each key requires the type to be specified. `aes128-gcm96` supports encryption, decryption, key derivation, and convergent encryption, of which we need encryption and decryption for this example.
<2> Next, we encrypt a `String` that contains the plain text that should be encrypted.
The input `String` uses the default `Charset` to encode the string into its binary representation.
Requesting a token returns a `VaultToken` which is used as value object for Vault tokens.
Requesting a token returns a `VaultToken`, which is used as value object for Vault tokens.
The `encrypt` method returns Base64-encoded ciphertext, typically starting with `vault:`.
<3> To decrypt ciphertext into plaintext, call the `decrypt` method.
<3> To decrypt ciphertext into plain text, call the `decrypt` method.
It decrypts the ciphertext and returns a `String` that is decoded using the default charset.
====
The preceeding example uses simple strings for cryptographic operations.
While it's a simple approach, it bears the risk of charset misconfiguration and it is not binary-safe.
Binary safety is required when the plaintext uses a binary representation for data such as images, compressed data or binary datastructures.
While it is a simple approach, it bears the risk of charset misconfiguration and is not binary-safe.
Binary safety is required when the plain text uses a binary representation for data such as images, compressed data, or binary data structures.
To encrypt and decrypt binary data, use the `Plaintext` and `Ciphertext` value objects that can hold binary values:
@@ -225,28 +224,26 @@ In return, the `encrypt` method returns a `Ciphertext` object.
<2> The `Ciphertext` object can be used directly for decryption and returns a `Plaintext` object.
====
`Plaintext` and `Ciphertext` come with a contextual object `VaultTransitContext`.
`Plaintext` and `Ciphertext` come with a contextual object, `VaultTransitContext`.
It is used to supply a nonce value for https://www.vaultproject.io/docs/secrets/transit#convergent-encryption[convergent encryption] and for a context value to make use of key derivation.
Transit allows for signing plaintext and verifying the signature for a given plaintext.
Transit allows for signing plain text and verifying the signature for a given plain text.
Sign operations require an asymmetric key, typically using Elliptic Curve Cryptography or RSA.
TIP: This tip explains how signatures work internally. +
+
Signatures make use of the public/private key split to ensure authenticity. +
The signer uses its private key to create a signature (as otherwise anybody would be able to sign messages in your name!).
NOTE: Signatures use the public/private key split to ensure authenticity. +
The signer uses its private key to create a signature. Otherwise, anybody would be able to sign messages in your name.
The verifier uses the public key part to verify the signature. The actual signature is typically a hash value. +
+
Internally, the hash gets computed and encrypted using the private key to create the final signature. The verification decrypts the signature message, computes their own hash for the plaintext and compares both hash values to check whether the signature is valid or not.
Internally, the hash gets computed and encrypted using the private key to create the final signature. The verification decrypts the signature message, computes their own hash for the plain text and compares both hash values to check whether the signature is valid or not.
====
[source,java,indent=0]
----
include::../{example-root}/Transit.java[tags=signVerify]
----
<1> Signing requires an asymmetric key. Any Elliptic Curve Cryptography or RSA key type can be used. Once the key is created, we have all pre-requisites in place to create a signature.
<2> The signature gets created for a plaintext message. The returned `Signature` contains an ASCII-safe string that uses Base64 characters.
<3> To verify the signature, the verification requires a `Signature` object and the plaintext message. As return you get whether the signature was valid or not.
<1> Signing requires an asymmetric key. You can use any Elliptic Curve Cryptography or RSA key type. Once the key is created, you have all the prerequisites in place to create a signature.
<2> The signature gets created for a plain text message. The returned `Signature` contains an ASCII-safe string that uses Base64 characters.
<3> To verify the signature, the verification requires a Signature object and the plain text message. As the return value, you get whether the signature was valid or not.
====
You can find more details about the https://www.vaultproject.io/api/secret/transit[Vault Transit Backend] in the Vault reference documentation.