Cryptography helper providing hashing, HMAC-style key derivation, symmetric encryption and Diffie-Hellman key exchange for templates and scripts. Registered as the crypto property on the platform's template Formatter, so app developers reach it as formatter.crypto from Velocity templates and GraalJS. Methods accept byte arrays, base64 strings or plain strings interchangeably and delegate the actual cipher, digest and key agreement work to the Crypto utility class.

Group: Managers

---

Methods

hmacHashAsByteArray(Object key, Object message, Integer iterations, Integer length, String algorithm) · hmacHash(Object key, Object message, Integer iterations, Integer length, String algorithm) · hmacHashAsByteArray(String digest, Object key, Object message) · hmacHashAsByteArray(String digest, Object key, Object message, Integer length) · hmacHash(String digest, Object key, Object message) · hmacHash(String digest, Object key, Object message, Integer length) · decryptAsByteArray(String transformation, Object encryptedVal, Object key, Object iv) · decrypt(String transformation, Object encryptedVal, Object key, Object iv) · decryptAsByteArray(String transformation, Object encryptedVal, Object key) · decrypt(String transformation, Object encryptedVal, Object key) · encryptAsByteArray(String transformation, Object val, Object key, Object iv) · encrypt(String transformation, Object val, Object key, Object iv) · encryptAsByteArray(String transformation, Object val, Object key) · encrypt(String transformation, Object val, Object key) · createDiffieHellman() · createDiffieHellman(String prime, String prime_encoding) · createHash(String algorithm) · createMac(String algorithm, String key, String message) · createMacAsByteArray(String algorithm, String key, String message) · hmacEquals(byte[] digestA, byte[] digestB) · generateRandomAsBytes(Integer size) · generateCurveKeyPair(String curve, String algorithm) · generateCurveKeyPairAsBytes(String curve, String algorithm) · createSecretKeyFromBytes(String algorithm, byte[] secretKeyBytes) · createSecretKeyFromBase64String(String algorithm, String base64EncodedSecretKey)

hmacHashAsByteArray(Object key, Object message, Integer iterations, Integer length, String algorithm)

Returns: byte[]

Derives a key from the given password and salt using a PBKDF2-style SecretKeyFactory algorithm, and returns the raw derived key bytes. Intended for password-based key derivation rather than for hashing arbitrary HMAC digests, despite the method name.

hmacHash(Object key, Object message, Integer iterations, Integer length, String algorithm)

Returns: String

Derives a key from the given password and salt using a PBKDF2-style SecretKeyFactory algorithm, the same as hmacHashAsByteArray, and returns it as a base64-encoded string.

hmacHashAsByteArray(String digest, Object key, Object message)

Returns: byte[]

Derives a 64-byte key from the given password and salt using PBKDF2WithHmacSHA1 with 1000 iterations, and returns the raw derived key bytes. The digest parameter is currently not used by the derivation.

hmacHashAsByteArray(String digest, Object key, Object message, Integer length)

Returns: byte[]

Derives a key from the given password and salt using PBKDF2WithHmacSHA1 with 1000 iterations, and returns the raw derived key bytes. The digest parameter is currently not used; the algorithm is always PBKDF2WithHmacSHA1 regardless of what is passed in.

hmacHash(String digest, Object key, Object message)

Returns: String

Derives a 64-byte key from the given password and salt using PBKDF2WithHmacSHA1, the same as hmacHashAsByteArray, and returns it as a base64-encoded string.

hmacHash(String digest, Object key, Object message, Integer length)

Returns: String

Derives a key from the given password and salt using PBKDF2WithHmacSHA1, the same as hmacHashAsByteArray, and returns it as a base64-encoded string.

decryptAsByteArray(String transformation, Object encryptedVal, Object key, Object iv)

Returns: byte[]

Decrypts an AES value using the given cipher transformation and initialisation vector, and returns the raw decrypted bytes.

decrypt(String transformation, Object encryptedVal, Object key, Object iv)

Returns: String

Decrypts an AES value using the given cipher transformation and initialisation vector, the same as decryptAsByteArray, and returns the plaintext as a String built from the raw decrypted bytes.

decryptAsByteArray(String transformation, Object encryptedVal, Object key)

Returns: byte[]

Decrypts an AES value using the given cipher transformation with no initialisation vector, and returns the raw decrypted bytes. Suited to transformations that do not require an IV, such as ECB mode.

decrypt(String transformation, Object encryptedVal, Object key)

Returns: String

Decrypts an AES value using the given cipher transformation with no initialisation vector, the same as decryptAsByteArray, and returns the plaintext as a String built from the raw decrypted bytes.

encryptAsByteArray(String transformation, Object val, Object key, Object iv)

Returns: byte[]

Encrypts a value as AES using the given cipher transformation and initialisation vector, and returns the raw ciphertext bytes.

encrypt(String transformation, Object val, Object key, Object iv)

Returns: String

Encrypts a value as AES using the given cipher transformation and initialisation vector, the same as encryptAsByteArray, and returns the ciphertext as a base64-encoded string.

encryptAsByteArray(String transformation, Object val, Object key)

Returns: byte[]

Encrypts a value as AES using the given cipher transformation with no initialisation vector, and returns the raw ciphertext bytes. Suited to transformations that do not require an IV, such as ECB mode.

encrypt(String transformation, Object val, Object key)

Returns: String

Encrypts a value as AES using the given cipher transformation with no initialisation vector, the same as encryptAsByteArray, and returns the ciphertext as a base64-encoded string.

createDiffieHellman()

Returns: DiffieHellmanModule

Creates a Diffie-Hellman key exchange helper using a randomly generated prime.

createDiffieHellman(String prime, String prime_encoding)

Returns: DiffieHellmanModule

Creates a Diffie-Hellman key exchange helper using the given prime.

createHash(String algorithm)

Returns: MessageDigest

Creates a MessageDigest instance for the given algorithm, for example SHA-256, ready to accumulate data and compute a hash.

createMac(String algorithm, String key, String message)

Returns: String

Computes an HMAC of the given message using the given algorithm and secret key, and returns it as a hexadecimal string.

createMacAsByteArray(String algorithm, String key, String message)

Returns: byte[]

Computes an HMAC of the given message using the given algorithm and secret key, and returns the raw digest bytes.

hmacEquals(byte[] digestA, byte[] digestB)

Returns: boolean

Compares two digests for equality using a constant-time comparison, to avoid leaking timing information that could help an attacker guess a correct digest byte by byte.

generateRandomAsBytes(Integer size)

Returns: byte[]

Generates cryptographically random bytes using a SHA1PRNG secure random source.

generateCurveKeyPair(String curve, String algorithm)

Returns: KeyPair

Generates an elliptic-curve key pair for the named curve using the Bouncy Castle provider.

generateCurveKeyPairAsBytes(String curve, String algorithm)

Returns: Map<String,byte[]>

Generates an elliptic-curve key pair for the named curve, the same as generateCurveKeyPair, and returns the raw encoded key material in a map keyed by privateKey and publicKey.

createSecretKeyFromBytes(String algorithm, byte[] secretKeyBytes)

Returns: SecretKey

Wraps raw key bytes as a SecretKey for the given algorithm, without copying or validating the bytes.

createSecretKeyFromBase64String(String algorithm, String base64EncodedSecretKey)

Returns: SecretKey

Decodes a base64-encoded key and wraps it as a SecretKey for the given algorithm, the same as createSecretKeyFromBytes.