Package org.springframework.security.crypto.encrypt

Class AesGcmBytesEncryptor

java.lang.Object

org.springframework.security.crypto.encrypt.AesGcmBytesEncryptor

All Implemented Interfaces:

BytesEncryptor

public final class AesGcmBytesEncryptor
extends Object
implements BytesEncryptor

BytesEncryptor that uses 256-bit AES/GCM/NoPadding with a random 16-byte initialization vector and a 128-bit authentication tag. The IV is prepended to the ciphertext on encrypt and stripped on decrypt. GCM provides authenticated encryption (AEAD): both confidentiality and integrity are protected, and decryption throws if the ciphertext has been tampered with.

This class uses a 16-byte (128-bit) IV rather than the 12-byte (96-bit) IV recommended by NIST SP 800-38D for GCM. Both lengths are cryptographically valid; the 16-byte choice maintains consistency with the rest of the Spring Security crypto module. For additional guidance, please see the OWASP Cryptographic Storage Cheat Sheet.

When key derivation is used via withPassword(String, CharSequence), the key is derived using PBKDF2WithHmacSHA256 with DEFAULT_PBKDF2_ITERATIONS iterations per the OWASP Password Storage Cheat Sheet. Because derivation is intentionally expensive, the encryptor instance should be created once and reused rather than constructed per-operation.

Since:

5.7.26

See Also:

• AesCbcBytesEncryptor
• AesBytesEncryptor

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final class	AesGcmBytesEncryptor.Builder	A Builder for AesGcmBytesEncryptor.

Method Summary

Modifier and Type	Method	Description
byte[]	decrypt(byte[] encryptedBytes)	Decrypt the byte array.
byte[]	encrypt(byte[] bytes)	Encrypt the byte array.
static AesGcmBytesEncryptor.Builder	withPassword(String password, CharSequence salt)	Creates an encryptor that derives its key from the given password and hex-encoded salt using PBKDF2WithHmacSHA1.
static AesGcmBytesEncryptor.Builder	withSecretKey(SecretKey secretKey)	Creates an encryptor using the supplied SecretKey.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

withPassword

public static AesGcmBytesEncryptor.Builder withPassword(String password,
 CharSequence salt)

Creates an encryptor that derives its key from the given password and hex-encoded salt using PBKDF2WithHmacSHA1.

Parameters:

password - the password value

salt - the hex-encoded salt value

withSecretKey

public static AesGcmBytesEncryptor.Builder withSecretKey(SecretKey secretKey)

Creates an encryptor using the supplied SecretKey.

Parameters:

secretKey - the secret (symmetric) key

encrypt

public byte[] encrypt(byte[] bytes)

Description copied from interface: BytesEncryptor

Encrypt the byte array.

Specified by:

encrypt in interface BytesEncryptor

decrypt

public byte[] decrypt(byte[] encryptedBytes)

Description copied from interface: BytesEncryptor

Decrypt the byte array.

Specified by:

decrypt in interface BytesEncryptor