final LinkedHashSet<String> requestedAttributes
= new LinkedHashSet<String>();
requestedAttributes.add("dn");
final InternalClientConnection icc
= InternalClientConnection.getRootConnection();
InternalSearchOperation searchOp = icc.processSearch(
baseDN,
SearchScope.SINGLE_LEVEL,
DereferencePolicy.NEVER_DEREF_ALIASES,
/* size limit */ 0, /* time limit */ 0,
/* types only */ false,
SearchFilter.createFilterFromString(searchFilter),
requestedAttributes);
assertTrue(0 < searchOp.getSearchEntries().size());
String compromisedTime = TimeThread.getGeneralizedTime();
for (Entry e : searchOp.getSearchEntries()) {
TestCaseUtils.applyModifications(true,
"dn: " + e.getDN().toNormalizedString(),
"changetype: modify",
"replace: " + ConfigConstants.ATTR_CRYPTO_KEY_COMPROMISED_TIME,
ConfigConstants.ATTR_CRYPTO_KEY_COMPROMISED_TIME + ": "
+ compromisedTime);
}
//Wait so the above asynchronous modification can be applied. The crypto
//manager's cipherKeyEntryCache needs to be updated before the encrypt()
//method is called below.
Thread.sleep(1000);
// Use the transformation and key length again. A new cipher key
// should be produced.
final byte[] cipherText2 = cm.encrypt(cipherTransformationName,
cipherKeyLength, secretMessage.getBytes());
// 1. Test for distinct keys.
final byte[] keyID = new byte[16];
final byte[] keyID2 = new byte[16];
System.arraycopy(cipherText, 1, keyID, 0, 16);
System.arraycopy(cipherText2, 1, keyID2, 0, 16);
assertTrue(! Arrays.equals(keyID, keyID2));
// 2. Confirm ciphertext produced using the compromised key can still be
// decrypted.
final byte[] plainText = cm.decrypt(cipherText);
assertEquals((new String(plainText)), secretMessage);
// 3. Delete the compromised entry(ies) and ensure ciphertext produced
// using a compromised key can no longer be decrypted.
for (Entry e : searchOp.getSearchEntries()) {
TestCaseUtils.applyModifications(true,
"dn: " + e.getDN().toNormalizedString(), "changetype: delete");
}
Thread.sleep(1000); // Clearing the cache is asynchronous.
try {