Hpke

.github/dependabot.yml

@@ -0,0 +1,30 @@
+version: 2
+updates:
+  # Java / Maven dependencies
+  - package-ecosystem: "maven"
+    directory: "/"
+    target-branch: "main"
+    schedule:
+      interval: "weekly"
+      day: "sunday"
+    open-pull-requests-limit: 15
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    groups:
+      maven-dependencies:
+        patterns:
+          - "*"
+
+  # GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    target-branch: "main"
+    schedule:
+      interval: "weekly"
+      day: "sunday"
+    open-pull-requests-limit: 10
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/build.yml

@@ -0,0 +1,74 @@
+name: Build
+
+on:
+  push:
+    branches: master
+  pull_request:
+    branches: master
+    types: [opened, synchronize, reopened]
+  schedule:
+    - cron: '41 13 * * 3'
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+jobs:
+  codeql:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - language: actions
+          build-mode: none
+        - language: java-kotlin
+          build-mode: manual
+    name: 'codeql: ${{ matrix.language }}'
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
+      - name: Set up JDK 25
+        if: ${{ matrix.language == 'java-kotlin' }}
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        with:
+          distribution: 'zulu'
+          java-version: 25
+          cache: 'maven'
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+          queries: security-extended, security-and-quality
+      - name: Minimal Maven Build
+        if: ${{ matrix.language == 'java-kotlin' }}
+        run: mvn -B package -Dgpg.skip -DskipTests
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+        with:
+          category: "/language:${{matrix.language}}"
+
+  maven:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+      main: ${{ steps.main.outputs.main }}
+    steps:
+      - name: Checkout repository 
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Set up JDK 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        with:
+          distribution: 'zulu'
+          java-version: 25
+          cache: 'maven'
+      - name: Maven Verify
+        run: mvn -B -fae verify -Dgpg.skip

README.md

@@ -1,5 +1,6 @@
 # crypto-utils
-Utility library for reading and writing X509 certificates as well as reading, writing and generating RSA and EC keys. Also provides a simple certificate authority implementation and RSA-KEM AES GCM based on BouncyCastle as well as a ECDH-KEM AES GCM implementation based on JEP 452.
+Utility library for reading and writing X509 certificates as well as reading, writing and generating RSA and EC keys. Also provides a simple certificate authority and a RFC 9180 Hybrid Public Key Encryption implementation.
+
 
 [![Java CI with Maven](https://github.com/hhund/crypto-utils/workflows/Java%20CI%20with%20Maven/badge.svg)](https://github.com/hhund/crypto-utils/actions?query=workflow%3A"Java+CI+with+Maven")
 [![Maven Central](https://maven-badges.sml.io/sonatype-central/de.hs-heilbronn.mi/crypto-utils/badge.svg)](https://maven-badges.sml.io/sonatype-central/de.hs-heilbronn.mi/crypto-utils)
@@ -8,6 +9,6 @@ Utility library for reading and writing X509 certificates as well as reading, wr
 <dependency>
     <groupId>de.hs-heilbronn.mi</groupId>
     <artifactId>crypto-utils</artifactId>
-    <version>5.2.1</version>
+    <version>6.0.0</version>
 </dependency>
 ```

pom.xml

@@ -3,21 +3,21 @@
 
 	<groupId>de.hs-heilbronn.mi</groupId>
 	<artifactId>crypto-utils</artifactId>
-	<version>5.2.1</version>
+	<version>6.0.0-SNAPSHOT</version>
 
 	<name>crypto-utils</name>
-	<description>Utility library for reading and writing X509 certificates as well as reading, writing and generating RSA and EC keys. Also provides a simple certificate authority implementation and RSA-KEM AES GCM based on BouncyCastle as well as a ECDH-KEM AES GCM implementation based on JEP 452.</description>
+	<description>Utility library for reading and writing X509 certificates as well as reading, writing and generating RSA and EC keys. Also provides a simple certificate authority and a RFC 9180 Hybrid Public Key Encryption implementation.</description>
 	<url>https://github.com/hhund/crypto-utils</url>
 
 	<properties>
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-		<maven.compiler.source>21</maven.compiler.source>
-		<maven.compiler.target>21</maven.compiler.target>
-		<maven.compiler.release>21</maven.compiler.release>
+		<maven.compiler.source>25</maven.compiler.source>
+		<maven.compiler.target>25</maven.compiler.target>
+		<maven.compiler.release>25</maven.compiler.release>
 
-		<slf4j.version>2.0.17</slf4j.version>
-		<bouncycastle.version>1.83</bouncycastle.version>
-		<junit.version>5.14.1</junit.version>
+		<slf4j.version>2.0.18</slf4j.version>
+		<bouncycastle.version>1.84</bouncycastle.version>
+		<junit.version>5.14.4</junit.version>
 	</properties>
 
 	<licenses>
@@ -78,21 +78,21 @@
 		<dependency>
 			<groupId>org.apache.logging.log4j</groupId>
 			<artifactId>log4j-slf4j2-impl</artifactId>
-			<version>2.25.2</version>
+			<version>2.26.0</version>
 			<scope>test</scope>
 		</dependency>
-		
+
 		<dependency>
-		    <groupId>org.junit.jupiter</groupId>
-		    <artifactId>junit-jupiter-engine</artifactId>
-		    <version>${junit.version}</version>
-		    <scope>test</scope>
+			<groupId>org.junit.jupiter</groupId>
+			<artifactId>junit-jupiter-engine</artifactId>
+			<version>${junit.version}</version>
+			<scope>test</scope>
 		</dependency>
 		<dependency>
-		    <groupId>org.junit.jupiter</groupId>
-		    <artifactId>junit-jupiter-params</artifactId>
-		    <version>${junit.version}</version>
-		    <scope>test</scope>
+			<groupId>org.junit.jupiter</groupId>
+			<artifactId>junit-jupiter-params</artifactId>
+			<version>${junit.version}</version>
+			<scope>test</scope>
 		</dependency>
 	</dependencies>
 
@@ -101,7 +101,7 @@
 			<plugin>
 				<groupId>org.apache.maven.plugins</groupId>
 				<artifactId>maven-compiler-plugin</artifactId>
-				<version>3.14.1</version>
+				<version>3.15.0</version>
 				<configuration>
 					<compilerArgs>
 						<arg>-proc:none</arg>
@@ -111,7 +111,7 @@
 			<plugin>
 				<groupId>org.apache.maven.plugins</groupId>
 				<artifactId>maven-source-plugin</artifactId>
-				<version>3.3.1</version>
+				<version>3.4.0</version>
 				<executions>
 					<execution>
 						<id>attach-sources</id>
@@ -151,12 +151,12 @@
 			<plugin>
 				<groupId>org.apache.maven.plugins</groupId>
 				<artifactId>maven-surefire-plugin</artifactId>
-				<version>3.5.4</version>
+				<version>3.5.5</version>
 			</plugin>
 			<plugin>
 				<groupId>org.apache.maven.plugins</groupId>
 				<artifactId>maven-enforcer-plugin</artifactId>
-				<version>3.6.2</version>
+				<version>3.6.3</version>
 				<executions>
 					<execution>
 						<id>enforce-maven</id>
@@ -182,7 +182,7 @@
 			<plugin>
 				<groupId>org.sonatype.central</groupId>
 				<artifactId>central-publishing-maven-plugin</artifactId>
-				<version>0.9.0</version>
+				<version>0.10.0</version>
 				<extensions>true</extensions>
 				<configuration>
 					<publishingServerId>central</publishingServerId>

src/main/java/de/hsheilbronn/mi/utils/crypto/hpke/AbstractKemWrapper.java

@@ -0,0 +1,64 @@
+package de.hsheilbronn.mi.utils.crypto.hpke;
+
+import java.security.InvalidKeyException;
+import java.security.NoSuchAlgorithmException;
+import java.security.PrivateKey;
+import java.security.PublicKey;
+import java.security.SecureRandom;
+import java.util.Objects;
+
+import javax.crypto.DecapsulateException;
+import javax.crypto.KEM.Encapsulated;
+import javax.crypto.SecretKey;
+
+public abstract class AbstractKemWrapper implements KemWrapper
+{
+	private final KemId kemId;
+
+	public AbstractKemWrapper(KemId kemId)
+	{
+		this.kemId = Objects.requireNonNull(kemId, "kemId");
+	}
+
+	@Override
+	public final Encapsulated getEncapsulated(PublicKey publicKey, SecureRandom secureRandom)
+			throws NoSuchAlgorithmException, InvalidKeyException, KeyNotSupportedException
+	{
+		if (!kemId.isKeySupported(publicKey))
+			throw new KeyNotSupportedException("publicKey not supported");
+
+		Encapsulated encapsulated = doGetEncapsulated(publicKey, secureRandom, kemId.getSharedSecretLength());
+
+		if (encapsulated.encapsulation().length != kemId.getEncapsulationLength())
+			throw new IllegalStateException("encapsulation.length not " + kemId.getEncapsulationLength());
+
+		if (encapsulated.key().getEncoded().length != kemId.getSharedSecretLength())
+			throw new IllegalStateException("sharedSecret.length not " + kemId.getSharedSecretLength());
+
+		return encapsulated;
+	}
+
+	protected abstract Encapsulated doGetEncapsulated(PublicKey publicKey, SecureRandom secureRandom,
+			int sharedSecretLength) throws NoSuchAlgorithmException, InvalidKeyException;
+
+	@Override
+	public final SecretKey getSharedSecret(PrivateKey privateKey, byte[] encapsulation)
+			throws NoSuchAlgorithmException, InvalidKeyException, DecapsulateException, KeyNotSupportedException
+	{
+		if (!kemId.isKeySupported(privateKey))
+			throw new KeyNotSupportedException("privateKey not supported");
+
+		if (encapsulation.length != kemId.getEncapsulationLength())
+			throw new IllegalStateException("encapsulation.length not " + kemId.getEncapsulationLength());
+
+		SecretKey sharedSecret = doGetSharedSecret(privateKey, encapsulation, kemId.getSharedSecretLength());
+
+		if (sharedSecret.getEncoded().length != kemId.getSharedSecretLength())
+			throw new IllegalStateException("sharedSecret.length not " + kemId.getSharedSecretLength());
+
+		return sharedSecret;
+	}
+
+	protected abstract SecretKey doGetSharedSecret(PrivateKey privateKey, byte[] encapsulation, int sharedSecretLength)
+			throws NoSuchAlgorithmException, InvalidKeyException, DecapsulateException;
+}