Package 

Object CryptoManager

  • 
public class CryptoManager

    Enterprise-grade Hardware-Backed Cryptographic Manager.

    Implements:

    • Hardware Keystore management with StrongBox enforcement and graceful TEE fallback.

    • AES-256-GCM authenticated encryption/decryption with unique 12-byte IVs.

    • Associated Authenticated Data (AAD) bound to the immutable internal user ID.

    • DPoP (Demonstrating Proof-of-Possession - RFC 9449) ephemeral EC keypair and signature operations.

    • Memory sanitization routines to eliminate sensitive byte residues.

    • Method Summary

      Modifier and Type Method Description
      final String encrypt(ByteArray plaintextBytes, String aadUserBinding) Encrypts sensitive data using AES-256-GCM with Associated Authenticated Data (AAD).
      final ByteArray decrypt(String encryptedBase64, String aadUserBinding) Decrypts AES-256-GCM ciphertext using the hardware-backed master key and verified AAD.
      final KeyPair generateDPoPKeyPair() DPoP (RFC 9449) Keypair Generator: Generates an ephemeral in-memory EC P-256 keypair.
      final String computeJWKThumbprint(KeyPair keyPair) Computes the SHA-256 JWK Thumbprint (jkt) of an EC public key per RFC 7638.
      final String signDPoPProof(KeyPair keyPair, String payload) Signs a DPoP proof string using an ephemeral EC private key.
      final Unit wipeMemory(ByteArray buffer) Cryptographically secure zero-out routine for mutable byte arrays.
      final Unit wipeMemory(CharArray buffer) Cryptographically secure zero-out routine for mutable char arrays.

      • Methods inherited from class java.lang.Object

        clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    • Method Detail

      • encrypt

        @Synchronized() final String encrypt(ByteArray plaintextBytes, String aadUserBinding)

        Encrypts sensitive data using AES-256-GCM with Associated Authenticated Data (AAD).

        Parameters:
        plaintextBytes - Mutable byte buffer containing sensitive data (will be wiped after encryption).
        aadUserBinding - Immutable user identifier (e.g.

      • decrypt

        @Synchronized() final ByteArray decrypt(String encryptedBase64, String aadUserBinding)

        Decrypts AES-256-GCM ciphertext using the hardware-backed master key and verified AAD.

        Parameters:
        encryptedBase64 - The packaged Base64 ciphertext.
        aadUserBinding - The immutable user identifier.

      • generateDPoPKeyPair

         final KeyPair generateDPoPKeyPair()

        DPoP (RFC 9449) Keypair Generator: Generates an ephemeral in-memory EC P-256 keypair. Used by client apps to create sender-constrained authentication proofs.

      • wipeMemory

         final Unit wipeMemory(ByteArray buffer)

        Cryptographically secure zero-out routine for mutable byte arrays.

      • wipeMemory

         final Unit wipeMemory(CharArray buffer)

        Cryptographically secure zero-out routine for mutable char arrays.