Class PepperApplicator

java.lang.Object

com.svenruppert.jsentinel.credential.password.pepper.PepperApplicator

public final class PepperApplicator
extends Object

Applies the optional post-KDF pepper as HMAC-SHA-256(pepperKey, kdfOutput).

The construction is the one the Konzept §11 recommends: a stored hash on its own is useless to an attacker who does not also exfiltrate the pepper key. The key never travels with the password database.

When the supplied PepperReference is absent, the KDF output is returned verbatim — the pepper application is a pure no-op so the envelope shape stays the same.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final class	PepperApplicator.PepperApplicationException	Control-flow exception for pepper-application failures.

Method Summary

Modifier and Type	Method	Description
static byte[]	apply(byte[] kdfOutput, Optional<PepperReference> pepper)	Returns HMAC-SHA-256(pepper.key, kdfOutput) when pepper is present, otherwise a copy of the KDF output.
static byte[]	generateKey()	Generates a fresh 32-byte pepper key from SecureRandom.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

apply

public static byte[] apply(byte[] kdfOutput,
 Optional<PepperReference> pepper)

Returns HMAC-SHA-256(pepper.key, kdfOutput) when pepper is present, otherwise a copy of the KDF output.

The supplied kdfOutput array is not zeroed here; the caller still owns it.

generateKey

public static byte[] generateKey()

Generates a fresh 32-byte pepper key from SecureRandom. Helper for tests and bootstrap tools — never auto-rotate keys at runtime through this method (rotation arrives in Prompt 018).