diff --git a/src/main/java/com/amazonaws/encryptionsdk/CommitmentPolicy.java b/src/main/java/com/amazonaws/encryptionsdk/CommitmentPolicy.java index d17c078b4..94477cb35 100644 --- a/src/main/java/com/amazonaws/encryptionsdk/CommitmentPolicy.java +++ b/src/main/java/com/amazonaws/encryptionsdk/CommitmentPolicy.java @@ -3,11 +3,30 @@ package com.amazonaws.encryptionsdk; +/** + * Governs how a AwsCrypto behaves during configuration, encryption, and decryption, with respect to + * key commitment. + */ public enum CommitmentPolicy { + /** + * On encrypty, algorithm suite must NOT support key commitment; On decrypt, if a key commitment + * is present on the ciphertext, then the key commitment must be valid. Key commitment will NOT be + * included in ciphertext on encrypt. + */ ForbidEncryptAllowDecrypt, + /** + * On encrypt, algorithm suite must support key commitment; On decrypt, if a key commitment is + * present on the ciphertext, then the key commitment must be valid. Key commitment will be + * included in ciphertext on encrypt. + */ RequireEncryptAllowDecrypt, + /** + * Algorithm suite must support key commitment. Key commitment will be included in ciphertext on + * encrypt. Valid key commitment must be present in ciphertext on decrypt. + */ RequireEncryptRequireDecrypt; + /** Validates that an algorithm meets the Policy's On encrypt key commitment. */ public boolean algorithmAllowedForEncrypt(CryptoAlgorithm algorithm) { switch (this) { case ForbidEncryptAllowDecrypt: @@ -21,6 +40,7 @@ public boolean algorithmAllowedForEncrypt(CryptoAlgorithm algorithm) { } } + /** Validates that an algorithm meets the Policy's On decrypt key commitment. */ public boolean algorithmAllowedForDecrypt(CryptoAlgorithm algorithm) { switch (this) { case ForbidEncryptAllowDecrypt: