Class SpoolCipher

java.lang.Object
com.mcpdbwizard.pub.SpoolCipher
public final class SpoolCipher extends Object
Encrypts one spooled audit record, so a write-ahead spool is not plaintext on disk.

What this protects, and what it does not

It protects the file, not the process. Anyone who can read this JVM's environment or its memory has the key, so this is not a defence against root on the host. What it does defend is everything that outlives the process and travels: disk images, volume snapshots, backups, and other users on a shared box.

Encrypting the volume is usually the better answer and costs no code — it also covers the configs, the accounts and the runtime workspaces sitting in the same directory, which this does not. Reach for this when the storage layer is not yours to configure, or when the records must be unreadable to someone who legitimately administers the host.

Format

ENC1:base64(iv‖ciphertext‖tag) — AES-256-GCM, a fresh 12-byte IV per record, one line per record so the spool stays line-oriented and its size accounting still works. The marker is what makes the feature safe to turn on: a spool written before encryption was enabled still holds plaintext lines, and the drainer has to read both rather than strand whatever was queued.

The key is derived by SHA-256 over the supplied secret, so any passphrase length works and the cipher always gets 256 bits. That is deliberately not a password-hardening KDF — this secret comes from a deployment's secret store, not from a human's memory, and pretending otherwise by adding iterations would suggest a resistance to guessing that a 12-character passphrase would not have.

Losing the key

There is no recovery. A segment written under a key you no longer have cannot be delivered and cannot be read; SpoolingAuditSink quarantines it rather than retrying for ever or deleting it. Rotating the key therefore means draining the spool first. Copyright 2003-2026 ATB Consultancy Services Ltd (formerly Orinda Software Ltd, Dublin, Ireland)

  • Field Details

  • Method Details

    • fromEnvironment

      public static SpoolCipher fromEnvironment()
      The cipher this deployment is configured for, or null when the spool should stay plaintext.
      Throws:
      IllegalStateException - if a key is named but unusable — a spool must not silently fall back to plaintext when encryption was asked for, because the operator would believe the records were protected

    • encrypt

      public String encrypt(String thePlainText)
      One line, encrypted and marked.

    • decrypt

      public String decrypt(String theLine)
      One line, decrypted if it is marked and returned unchanged if it is not.

      Passing plaintext through is what lets encryption be switched on over an existing spool. A line that IS marked and cannot be decrypted throws — it is not delivered as gibberish, and not silently skipped.

    • isEncrypted

      public static boolean isEncrypted(String theLine)
      True when this line was written encrypted, whoever holds the key.