Dynamic IV 도출 지원 — DerivedKey iv 필드 추가, HsmKeyAndIvDerivationStrategy 구현

2026-05-27 13:48:23 +09:00
parent c95307901e
commit c74d1777df
3 changed files with 217 additions and 1 deletions
@@ -0,0 +1,41 @@
+package com.eactive.eai.custom.common.security.keyderiv;
+
+import java.util.Map;
+
+import javax.xml.bind.DatatypeConverter;
+
+import com.eactive.eai.common.security.keyderiv.DerivedKey;
+import com.eactive.eai.common.security.keyderiv.strategy.BaseHsmKeyDerivationStrategy;
+
+/**
+ * HSM에서 키와 IV를 각각 가져오는 전략.
+ * IV는 HSM에서 가져온 바이트 배열을 hex 문자열로 변환한 뒤 substring(32, 64)를 적용하여 사용한다.
+ * (32바이트 HSM 키 → 64자 hex → substring(32,64) → 16바이트 IV)
+ *
+ * key_deriv_params (JSON) 예시:
+ * { "hsmKeyAlias" : "MASTER_KEY_AES", "hsmIvAlias" : "MASTER_IV_AES" }
+ */
+public class HsmKeyAndIvSliceDerivationStrategy extends BaseHsmKeyDerivationStrategy {
+
+    private static final int IV_HEX_OFFSET = 32;
+    private static final int IV_HEX_END    = 64;
+
+    @Override
+    public DerivedKey deriveKey(Map<String, String> params, Map<String, String> runtimeContext) throws Exception {
+        byte[] keyBytes = super.getHsmKey(params);
+        byte[] rawIv    = super.getHsmIv(params);
+        String ivHex    = DatatypeConverter.printHexBinary(rawIv);
+        if (ivHex.length() < IV_HEX_END) {
+            throw new IllegalArgumentException(
+                    "hsmIvAlias hex 길이 부족: 최소 " + IV_HEX_END + "자 필요, 실제=" + ivHex.length()
+                    + " (" + rawIv.length + "바이트)");
+        }
+        byte[] iv = DatatypeConverter.parseHexBinary(ivHex.substring(IV_HEX_OFFSET, IV_HEX_END));
+        return new DerivedKey(keyBytes, keyBytes, iv);
+    }
+
+    @Override
+    public String buildCacheKey(String cryptoName, Map<String, String> params, Map<String, String> runtimeContext) {
+        return cryptoName;
+    }
+}