Package co.ankatech.ankasecure.sdk.model

Class ReencryptResult

java.lang.Object
co.ankatech.ankasecure.sdk.model.ReencryptResult
public final class ReencryptResult extends Object
Result of a re-encryption operation.

Contains the new compact JWE token produced by server-side re-encryption from one key to another, along with comprehensive metadata for both the old decryption key and the new encryption key. The plaintext is never exposed to the client during this operation.

Use Cases

  • Key rotation for encrypted data without client-side decryption
  • Migrating encrypted data to stronger algorithms
  • Compliance-driven periodic key rotation
  • Transparent key migration for legacy encrypted files

JWE Token Structure

The getJweToken() returns a compact JWE (RFC 7516) containing five Base64URL segments:


 BASE64URL(ProtectedHeader).
 BASE64URL(EncryptedKey).
 BASE64URL(IV).
 BASE64URL(Ciphertext).
 BASE64URL(AuthenticationTag)

Migration Mode

The isMigrationMode() flag indicates whether the operation handled legacy ciphertext without a kid in the header. This is useful for auditing and tracking migration workflows.

Thread Safety

Instances are effectively immutable after construction. All setters are for internal SDK use during deserialization. Once returned from SDK methods, instances are safe to share across threads.

Example


 // Re-encrypt from old key to new key
 ReencryptResult result = sdk.reencrypt("new-ml-kem-key", oldJweToken);

 System.out.println("Re-encryption complete");
 System.out.println("Old key: " + result.getOldKeyRequested() +
                    " (" + result.getOldKeyAlgorithmUsed() + ")");
 System.out.println("New key: " + result.getNewKeyRequested() +
                    " (" + result.getNewKeyAlgorithmUsed() + ")");
 System.out.println("Material versions: " + result.getSourceMaterialVersion() +
                    " -> " + result.getTargetMaterialVersion());

 if (result.isMigrationMode()) {
     System.out.println("Migrated legacy ciphertext to managed format");
 }

 // New JWE token ready for storage
 String newJwe = result.getJweToken();
Since:
3.0.0
See Also:

  • Constructor Details

    • ReencryptResult

      public ReencryptResult()

  • Method Details

    • getJweToken

      public String getJweToken()
      Returns the new compact JWE token after re-encryption.

      The token contains the same plaintext as the original JWE but encrypted with the new key. It is self-contained and can be stored or transmitted independently.

      Returns:
      the compact JWE string (five Base64URL segments); never null

    • getOldKeyRequested

      public String getOldKeyRequested()
      Returns the original key identifier requested for decryption.
      Returns:
      non-null old kid

    • getSourceMaterialVersion

      public Integer getSourceMaterialVersion()
      Returns the key-material version that decrypted the original payload under the source Stable KID.
      Returns:
      source material version; null when not resolvable — never 0

    • getOldKeyAlgorithmUsed

      public String getOldKeyAlgorithmUsed()
      Returns the hybrid algorithm used for decryption.
      Returns:
      non-null algorithm identifier

    • getNewKeyRequested

      public String getNewKeyRequested()
      Returns the original key identifier requested for encryption.
      Returns:
      non-null new kid

    • getTargetMaterialVersion

      public Integer getTargetMaterialVersion()
      Returns the PRIMARY key-material version that encrypted the new payload under the target Stable KID.
      Returns:
      target material version; null when not resolvable — never 0

    • getNewKeyAlgorithmUsed

      public String getNewKeyAlgorithmUsed()
      Returns the hybrid algorithm used for encryption.
      Returns:
      non-null algorithm identifier

    • getWarnings

      public List<CryptoWarning> getWarnings()
      Returns non-fatal warnings encountered during the re-encryption operation.

      Warnings are type-safe instances that may relate to either the old decryption key or the new encryption key. Use pattern matching for programmatic handling: 

      
 ReencryptResult result = sdk.reencrypt("new-key", oldJweToken);

 if (result.getWarnings() != null && !result.getWarnings().isEmpty()) {
     for (CryptoWarning warning : result.getWarnings()) {
         switch (warning) {
             case KeyExpirationWarning kew -> {
                 logger.warn("Key expiring in {} days - Old: {}, New: {}",
                     kew.daysRemaining(),
                     result.getOldKeyRequested(),
                     result.getNewKeyRequested());
                 if (kew.severity() == WarningSeverity.CRITICAL) {
                     alertOps("Urgent key rotation needed");
                 }
             }
             case UsageLimitWarning ulw ->
                 logger.warn("{} - {}", ulw.message(), ulw.recommendedAction());
             case GenericWarning gw when gw.rawMessage().contains("MIGRATION_MODE") ->
                 auditLog("Migrated legacy ciphertext to managed format");
             case GenericWarning gw ->
                 logger.info("Warning: {}", gw.rawMessage());
         }
     }
 }

      Common warning types:

      Returns:
      unmodifiable list of warnings (null if no warnings, never empty if non-null)

    • isMigrationMode

      public boolean isMigrationMode()
      Indicates whether the operation ran in migration mode.

      Returns true if the original ciphertext lacked a kid in the JWE header and a sourceKidOverride was provided to locate the decryption key. This is typical for legacy encrypted files.

      Returns:
      true if migration mode was used; false for normal managed re-encryption