ccrypto-java 0.1.0 → 0.2.0

data/lib/ccrypto/java/engines/cipher_engine.rb

@@ -7,159 +7,512 @@ module Ccrypto
       include TR::CondUtils
       include DataConversion
 
-      include TeLogger::TeLogHelper
+      def self.supported_ciphers
 
-      teLogger_tag :j_cipher
+        if @supported.nil?
 
-      def self.supported_ciphers
-        res = java.security.Security.getAlgorithms("Cipher").to_a.delete_if { |e| e.include?(".") }.sort
+          if is_refresh_always?
+            logger.debug "Refresh due to env flag" 
+            @supported = SupportedCipherList.new
+          else
+            logger.debug "Load support cipher from storage" 
+            @supported = SupportedCipherList.load_from_storage("#{Ccrypto::Java::Provider.provider_name}_supported_cipher")
+          end
+
+          if @supported.empty?
+            logger.debug "Supported cipher list is empty. Probe for supported algo and save to cache"
+            @supported = load_algo_into_cache(@supported)
+            @supported.save_to_storage("#{Ccrypto::Java::Provider.provider_name}_supported_cipher")
+          end
+        end
+
+        @supported
       end
 
-      def self.is_supported_cipher?(c)
-        case c
-        when String, java.lang.String
-          javax.crypto.Cipher.getInstance(c)
-        when Hash
-          spec = to_spec(c)
-          javax.crypto.Cipher.getInstance(spec)
-        else
-          raise CipherEngineException, "Unsupported input #{c} to check supported cipher"
+      def self.is_refresh_always?
+        ENV['CC_J_SUPCIPHER_REFRESH_ALWAYS'] == "true"
+      end
+
+      def self.load_algo_into_cache(list)
+        
+        skipped = []
+
+        java.security.Security.getAlgorithms("Cipher").to_a.delete_if { |e| e.include?(".") }.sort.each do |c|
+
+          #next if skipped.map { |e|
+          #  if c.downcase =~ /#{e}/i
+          #    1
+          #  else
+          #    0
+          #  end
+          #}.include?(1)
+
+          testSpec = c
+          loop do
+
+            begin
+
+              kg = javax.crypto.KeyGenerator.getInstance(testSpec, JCEProvider::DEFProv)
+              logger.debug "#{testSpec} is good!"
+
+              native = { keygen_algo: testSpec, require_init_keysize: true }
+              opts = { fixed_input_length_in_byte: -1 }
+
+              #if ["chacha20-poly1305","xsalsa20","salsa20","chacha20","chacha","chacha7539"].include?(testSpec.downcase)
+              if ["chacha20-poly1305","xsalsa20","salsa20"].include?(testSpec.downcase)
+
+                begin
+                  kg = javax.crypto.KeyGenerator.getInstance(testSpec, JCEProvider::DEFProv)
+                  tkey = kg.generateKey
+                  opts[:keysize] = tkey.encoded.length*8
+                  native[:require_init_keysize] = false
+
+                  cspec = [testSpec]
+                  if ["chacha20-poly1305", "chacha20","chacha7539"].include?(testSpec.downcase)
+                    ivLen = 12
+                    iv = Ccrypto::Java::SecureRandomEngine.random_bytes(ivLen)
+                    ivParam = javax.crypto.spec.IvParameterSpec.new(iv) # 12 bytes
+
+                  elsif ["xsalsa20"].include?(testSpec.downcase)
+                    ivLen = 24
+                    iv = Ccrypto::Java::SecureRandomEngine.random_bytes(ivLen)
+                    ivParam = javax.crypto.spec.IvParameterSpec.new(iv) # 24 bytes
+
+                  elsif ["salsa20","chacha"].include?(testSpec.downcase)
+                    ivLen = 8
+                    iv = Ccrypto::Java::SecureRandomEngine.random_bytes(ivLen)
+                    ivParam = javax.crypto.spec.IvParameterSpec.new(iv) # 8 bytes
+                  end
+
+                  decSuss, blocksize = test_encrypt_decrypt(cspec.join("/"), tkey, ivParam)
+
+                  if decSuss
+
+                    opts[:block_size] = blocksize
+
+                    begin
+                      test_encrypt_decrypt(cspec.join("/"), tkey, ivParam, blocksize+1)
+                    rescue Exception => ex
+                      opts[:mandatory_block_size] = blocksize
+                    end
+
+                    opts[:ivLength] = ivLen
+
+                    opts[:authMode] = ["chacha20-poly1305"].include?(testSpec.downcase)
+
+                    opts[:mode] = nil
+                    opts[:padding] = nil
+
+                    native[:cipher_str] = testSpec
+                    # key generated from this provider
+                    native[:key_jce_provider] = JCEProvider::DEFProv.name
+                    # tested with cipher using this provider
+                    native[:cipher_jce_provider] = JCEProvider::DEFProv.name
+
+                    # construct the key config too as key config not depending on cipher
+                    # but cipher depending on key config
+                    kconf = Ccrypto::KeyConfig.new(testSpec, opts[:keysize])
+                    kconf.provider_config = { keygen_algo: native[:keygen_algo], keysize: opts[:keysize], key_jce_provider: native[:key_jce_provider] }
+
+                    conf = Ccrypto::CipherConfig.new(testSpec, opts)
+                    conf.provider_config = native.clone
+                    conf.key_config = kconf
+
+                    logger.debug "Registering : #{testSpec}/#{opts[:keysize]}"
+
+                    list.register(conf.clone)
+
+                  end
+
+
+                rescue Exception => ex
+                  logger.debug "Special algo '#{testSpec}' failed : #{ex}"
+                  logger.debug ex.backtrace.join("\n")
+                end
+
+                break
+
+              else  # other algo except those special one
+
+                goodKz = []
+                [128,192,224,256,384,512].each do |kz|
+                  begin
+
+                    kg = javax.crypto.KeyGenerator.getInstance(testSpec, JCEProvider::DEFProv)
+                    kg.init(kz)
+                    kg.generateKey
+
+                    goodKz << kz
+
+                  rescue Exception => ex
+                    #logger.debug "Failed probing for cipher algo #{testSpec}/#{kz} : #{ex}"
+                  end
+                end # keysize loop
+
+                authMode = [:gcm,:ccm]
+                [:none,:cbc,:cfb,:ecb,:gcm,:ofb,:ctr,:ccm].each do |mode|
+
+                  goodKz.each do |kz|
+
+                    begin
+
+                      kg = javax.crypto.KeyGenerator.getInstance(testSpec, JCEProvider::DEFProv)
+                      kg.init(kz)
+                      tkey = kg.generateKey
+
+                      [:NoPadding, :PKCS5Padding, :PKCS7Padding].each do |pad|
+
+                        if [:gcm, :ccm].include?(mode) and pad != :NoPadding
+                          next
+                        end
+
+                        begin
+
+                          jceAlgo = [testSpec,mode,pad]
+                          cs = jceAlgo.join("/")
+                          logger.debug "Testing cipher with spec : #{cs} (#{kz})"
+                          tc = javax.crypto.Cipher.getInstance(cs, JCEProvider::DEFProv)
+
+                          ivParam = nil
+                          ivLen = 0
+                          if mode == :gcm
+                            ivLen = 12
+                            iv = Ccrypto::Java::SecureRandomEngine.random_bytes(ivLen)
+                            ivParam = javax.crypto.spec.GCMParameterSpec.new(iv.length*8, iv) # 16 bytes
+
+                          elsif ["blowfish","cast5","gost28147","idea","skipjack","tea","xtea","des","desede", "gost3412-2015","rc2","rc5"].include?(testSpec.downcase)
+                            if mode != :ecb
+                              ivLen = 8
+                              iv = Ccrypto::Java::SecureRandomEngine.random_bytes(ivLen)
+                              ivParam = javax.crypto.spec.IvParameterSpec.new(iv) # 16 bytes
+                            end
+
+                          elsif ["shacal-2","shacal2"].include?(testSpec.downcase)
+                            if mode != :ecb
+                              ivLen = 32
+                              iv = Ccrypto::Java::SecureRandomEngine.random_bytes(ivLen)
+                              ivParam = javax.crypto.spec.IvParameterSpec.new(iv) # 16 bytes
+                              opts[:min_input_length] = 32
+                            end
+
+                          elsif ["threefish-1024"].include?(testSpec.downcase)
+                            if mode != :ecb
+                              ivLen = 128
+                              iv = Ccrypto::Java::SecureRandomEngine.random_bytes(ivLen)
+                              ivParam = javax.crypto.spec.IvParameterSpec.new(iv) # 16 bytes
+                            end
+
+                          elsif ["threefish-256"].include?(testSpec.downcase)
+                            if mode != :ecb
+                              ivLen = 32
+                              iv = Ccrypto::Java::SecureRandomEngine.random_bytes(ivLen)
+                              ivParam = javax.crypto.spec.IvParameterSpec.new(iv) # 16 bytes
+                            end
+
+                          elsif ["threefish-512"].include?(testSpec.downcase)
+                            if mode != :ecb
+                              ivLen = 64
+                              iv = Ccrypto::Java::SecureRandomEngine.random_bytes(ivLen)
+                              ivParam = javax.crypto.spec.IvParameterSpec.new(iv) # 64 bytes
+                            end
+
+                          elsif ["chacha20","chacha7539"].include?(testSpec.downcase)
+                            ivLen = 12
+                            iv = Ccrypto::Java::SecureRandomEngine.random_bytes(ivLen)
+                            ivParam = javax.crypto.spec.IvParameterSpec.new(iv) # 12 bytes
+
+                          elsif ["xsalsa20"].include?(testSpec.downcase)
+                            ivLen = 24
+                            iv = Ccrypto::Java::SecureRandomEngine.random_bytes(ivLen)
+                            ivParam = javax.crypto.spec.IvParameterSpec.new(iv) # 24 bytes
+
+                          elsif ["salsa20","chacha"].include?(testSpec.downcase)
+                            ivLen = 8
+                            iv = Ccrypto::Java::SecureRandomEngine.random_bytes(ivLen)
+                            ivParam = javax.crypto.spec.IvParameterSpec.new(iv) # 8 bytes
+
+                          elsif testSpec.downcase[0...3] == "des"
+                            ivLen = 8
+                            iv = Ccrypto::Java::SecureRandomEngine.random_bytes(ivLen)
+                            ivParam = javax.crypto.spec.IvParameterSpec.new(iv) # 8 bytes
+
+                          elsif ["grain128","grainv1", "hc128","hc256","vmpc","vmpc-ksa3","zuc-128","zuc-256"].include?(testSpec.downcase)
+                            ivLen = 16
+                            iv = Ccrypto::Java::SecureRandomEngine.random_bytes(ivLen)
+                            ivParam = javax.crypto.spec.IvParameterSpec.new(iv) # 8 bytes
+
+
+                          elsif mode == :ccm
+                            ivLen = 7
+                            iv = Ccrypto::Java::SecureRandomEngine.random_bytes(ivLen)
+                            ivParam = javax.crypto.spec.IvParameterSpec.new(iv) # 7 bytes
+
+                          elsif mode != :ecb  
+                            #if not ["hc128","hc256"].include?(testSpec.downcase)
+                              ivLen = 16
+                              iv = Ccrypto::Java::SecureRandomEngine.random_bytes(ivLen)
+                              ivParam = javax.crypto.spec.IvParameterSpec.new(iv) # 16 bytes
+                            #end
+
+                          else
+                            ivLen = 0
+
+                          end
+
+                          decSuccess, blocksize = test_encrypt_decrypt(cs, tkey, ivParam)
+
+                          if decSuccess
+
+                            opts[:block_size] = blocksize
+
+                            if blocksize > 0
+                              opts[:mandatory_block_size] = -1
+                              begin
+                                test_encrypt_decrypt(cs, tkey, ivParam, blocksize+1)
+                              rescue Exception => ex
+                                logger.debug "Config #{cs} must work on block size"
+                                opts[:mandatory_block_size] = blocksize
+                              end
+                            end
+
+                            opts[:keysize] = kz
+                            opts[:mode] = mode.to_s
+                            opts[:ivLength] = ivLen
+                            opts[:padding] = pad.to_s
+
+                            opts[:authMode] = authMode.include?(mode)
+
+                            native[:cipher_str] = cs
+                            # key generated from this provider
+                            native[:key_jce_provider] = JCEProvider::DEFProv.name
+                            # tested with cipher using this provider
+                            native[:cipher_jce_provider] = JCEProvider::DEFProv.name
+
+                            # construct the key config too as key config not depending on cipher
+                            # but cipher depending on key config
+                            kconf = Ccrypto::KeyConfig.new(testSpec, opts[:keysize])
+                            kconf.provider_config = { keygen_algo: native[:keygen_algo], keysize: opts[:keysize], key_jce_provider: native[:key_jce_provider] }
+
+                            conf = Ccrypto::CipherConfig.new(testSpec, opts)
+                            conf.provider_config = native.clone
+                            conf.key_config = kconf
+
+                            logger.debug "Registering : #{testSpec}/#{kz}/#{mode}/#{pad}"
+
+                            list.register(conf.clone)
+
+                          end # decryption successful!
+
+                        rescue Exception => ex
+                          logger.debug "Failed for cipher algo #{testSpec}/#{kz}/#{mode}/#{pad} : #{ex}"
+                          if ex.message =~ /array length/
+                            puts ex.backtrace.join("\n")
+                          end
+                          Ccrypto::Java.on_detail_debug ex.backtrace.join("\n")
+                          #logger.debug ex.backtrace.join("\n")
+                        end
+
+                      end
+
+
+                    rescue Exception => ex
+                      #p ex
+                      logger.debug "Failed for cipher algo #{testSpec}/#{kz}/#{mode} : #{ex}"
+                      #logger.error ex.backtrace.join("\n")
+                    end
+
+                  end
+
+                end # mode loop
+
+                break
+
+              end
+            rescue Exception => ex
+              logger.debug "Probing for cipher algo : #{ex}"
+              #logger.error ex.backtrace.join("\n")
+              break
+            end
+
+          end # loop key type
+
         end
+
+        list
       end
 
-      def self.to_spec(hash)
-        res = []
-        res << hash[:algo].to_s
-        res << hash[:mode].to_s
-        res << hash[:padding].to_s
-        res.join("/")
+      def self.get_cipher_config(algo, keysize = nil, mode = nil, padding = nil)
+        params = { algo: algo }
+        params[:keysize] = keysize if not_empty?(keysize)
+        params[:mode] = mode if not_empty?(mode)
+        params[:padding] = padding if not_empty?(padding)
+
+        supported_ciphers.find(params).map { |c| c.dup }
       end
 
-      def supported_ciphers
-        self.class.supported_ciphers
+      private
+      def self.logger
+        Ccrypto::Java.logger(:cipher_eng)
       end
 
-      def initialize(*args, &block)
+      def self.test_encrypt_decrypt(spec, tkey, ivParam, testDataLen = nil)
 
-        @spec = args.first
+        tc = javax.crypto.Cipher.getInstance(spec, JCEProvider::DEFProv)
+        if ivParam.nil?
+          tc.init(javax.crypto.Cipher::ENCRYPT_MODE, tkey)
+        else
+          tc.init(javax.crypto.Cipher::ENCRYPT_MODE, tkey, ivParam)
+        end
 
-        case @spec
-        when String, java.lang.String, Hash
-          @spec = Ccrypto::DirectCipherConfig.new(@spec)
-        when Ccrypto::CipherConfig
+        blocksize = tc.blockSize
+        if testDataLen.nil?
+          # stream cipher might have no block size
+          if blocksize > 0
+            data = Ccrypto::Java::SecureRandomEngine.random_bytes(blocksize)
+          else
+            data = Ccrypto::Java::SecureRandomEngine.random_bytes(16)
+          end
         else
-          raise Ccrypto::CipherEngineException, "Unsupported config type #{@spec.class}"
+          data = Ccrypto::Java::SecureRandomEngine.random_bytes(testDataLen)
         end
 
+        encOut = java.io.ByteArrayOutputStream.new
+        encOut.write(tc.doFinal(data))
 
-        if block
-          @cipherJceProvider = block.call(:cipher_jceProvider)
-          @keygenJceProvider = block.call(:keygen_jceProvider)
+        tc2 = javax.crypto.Cipher.getInstance(spec, JCEProvider::DEFProv)
+        if ivParam.nil?
+          tc2.init(javax.crypto.Cipher::DECRYPT_MODE, tkey)
+        else
+          tc2.init(javax.crypto.Cipher::DECRYPT_MODE, tkey, ivParam)
         end
 
-        cSpec = to_cipher_spec(@spec)
+        decOut = java.io.ByteArrayOutputStream.new
+        decOut.write(tc2.doFinal(encOut.toByteArray))
+
+        [decOut.toByteArray == (data), blocksize]
+
+      end
+
+
+      public
+      ## 
+      # Instance variable
+      ##
+
+      #
+      # Design is by the object is initialized (new)
+      # all the parameter to setup the cipher shall need to be available
+      # including those aux data such as auth_data for GCM mode for example
+      #
+      def initialize(*args, &block)
+
+        @spec = args.first
+
+        raise Ccrypto::CipherEngineException, "Unsupported config type #{@spec.class}" if not @spec.is_a?(Ccrypto::CipherConfig)
+
+        @keyJceProvider = @spec.provider_config[:key_jce_provider] || JCEProvider::DEFProv
+        @cipherJceProvider = @spec.provider_config[:cipher_jce_provider] || JCEProvider::DEFProv
+
+        raise Ccrypto::CipherEngineException, "Key JCE provider '#{@keyJceProvider}' not registered." if not_empty?(@keyJceProvider) and not JCEProvider.instance.is_provider_registered?(@keyJceProvider)
+        raise Ccrypto::CipherEngineException, "Cipher JCE provider '#{@cipherJceProvider}' not registered." if not_empty?(@cipherJceProvider) and not JCEProvider.instance.is_provider_registered?(@cipherJceProvider)
+
+        cSpec = @spec.provider_config[:cipher_str]
         if @cipherJceProvider.nil?
           begin
-            teLogger.debug "Cipher instance #{cSpec} with null provider"
+            logger.debug "Cipher instance #{cSpec} with null provider"
             @cipher = javax.crypto.Cipher.getInstance(cSpec)
           rescue Exception => ex
-            teLogger.debug "Error #{ex.message} for spec '#{cSpec}' using null provider. Retest with BC provider"
+            logger.debug "Error #{ex.message} for spec '#{cSpec}' using null provider. Retest with BC provider"
             @cipher = javax.crypto.Cipher.getInstance(cSpec, Ccrypto::Java::JCEProvider::BCProv.name)
           end
         else
-          teLogger.debug "Cipher instance #{cSpec} with provider '#{@cipherJceProvider.is_a?(String) ? @cipherJceProvider : @cipherJceProvider.name}'"
+          logger.debug "Cipher instance #{cSpec} with provider '#{@cipherJceProvider.is_a?(String) ? @cipherJceProvider : @cipherJceProvider.name}'"
           @cipher = javax.crypto.Cipher.getInstance(cSpec, @cipherJceProvider)
         end
 
 
         if @spec.has_key?
-          teLogger.debug "Using given cipher key"
+          keyLen = @spec.ccrypto_key.length
+          logger.debug "Using given cipher key of length #{keyLen} bytes / #{keyLen*8}"
 
         else
           
-          teLogger.debug "Generating cipher key"
+          logger.debug "Generating cipher key #{@spec.inspect}"
           if @keygenJceProvider.nil?
-            kg = javax.crypto.KeyGenerator.getInstance(to_algo(@spec.algo))
+            kg = javax.crypto.KeyGenerator.getInstance(@spec.provider_config[:keygen_algo])
           else
-            kg = javax.crypto.KeyGenerator.getInstance(to_algo(@spec.algo), @keygenJceProvider)
+            kg = javax.crypto.KeyGenerator.getInstance(@spec.provider_config[:keygen_algo], @keygenJceProvider)
           end
 
-          kg.init(@spec.keysize.to_i)
-          @spec.key = kg.generateKey
+          if @spec.provider_config[:require_init_keysize]
+            kg.init(@spec.keysize.to_i)
+            logger.debug "Init with keysize ; #{@spec.provider_config[:keygen_algo]} / #{@spec.keysize.to_i} bits / #{@spec.keysize.to_i/8} bytes"
+          end
 
-        end
+          @spec.ccrypto_key = Ccrypto::SecretKey.new(@spec.algo, @spec.keysize, kg.generateKey)
+          @spec.ccrypto_key.provider_config = @spec.provider_config
 
-        if @spec.iv.is_a?(String)
-          @spec.iv = to_java_bytes(@spec.iv)
         end
 
-        if @spec.is_mode?(:gcm) or @spec.is_algo?(:chacha20)
+        if @spec.iv_required?
+          logger.debug "IV required of length #{@spec.ivLength}"
           if is_empty?(@spec.iv)
-            teLogger.debug "Generating 12 bytes of IV"
-            @spec.iv = Ccrypto::Java::SecureRandomEngine.random_bytes(12)
+            @spec.iv = Ccrypto::Java::SecureRandomEngine.random_bytes(@spec.ivLength)
+            logger.debug "Generated IV of length #{to_hex(@spec.iv)}"
           else
-            teLogger.debug "Using given IV"
+            if @spec.iv.is_a?(String)
+              @spec.iv = to_java_bytes(@spec.iv)
+              logger.debug "Converting IV into  #{to_hex(@spec.iv)}"
+            end
           end
 
           if @spec.is_mode?(:gcm)
-            ivParam = javax.crypto.spec.GCMParameterSpec.new(@spec.iv.length*8, @spec.iv) # 16 bytes
-          else
-            ivParam = javax.crypto.spec.IvParameterSpec.new(@spec.iv) # 16 bytes
-          end
-
-        elsif @spec.is_algo?(:blowfish)
-          if is_empty?(@spec.iv)
-            teLogger.debug "Generating 8 bytes of IV"
-            @spec.iv = Ccrypto::Java::SecureRandomEngine.random_bytes(8)
+            ivParam = javax.crypto.spec.GCMParameterSpec.new(@spec.iv.length*8, @spec.iv) # 12 bytes
           else
-            teLogger.debug "Using given IV"
+            ivParam = javax.crypto.spec.IvParameterSpec.new(@spec.iv) 
           end
-          ivParam = javax.crypto.spec.IvParameterSpec.new(@spec.iv)
 
-        elsif @spec.is_mode?(:cbc) or @spec.is_mode?(:ctr) or @spec.is_mode?(:cfb) or @spec.is_mode?(:ofb)
-          if is_empty?(@spec.iv)
-            teLogger.debug "Generating 16 bytes of IV" 
-            @spec.iv = Ccrypto::Java::SecureRandomEngine.random_bytes(16)
-          else
-            teLogger.debug "Using given IV"
-          end
-          ivParam = javax.crypto.spec.IvParameterSpec.new(@spec.iv)
+        else
+          logger.debug "IV is not required"
 
         end
 
-        #teLogger.debug "IV : #{@spec.iv}"
+        logger.debug "spec key : #{@spec.ccrypto_key.inspect}"
 
-        case @spec.key
+        case @spec.ccrypto_key
         when Ccrypto::SecretKey
-          skey = @spec.key.key
+          logger.debug "Given secret key"
+          skey = @spec.ccrypto_key.native_key
         when ::Java::byte[]
-          skey = javax.crypto.spec.SecretKeySpec.new(@spec.key, @spec.algo.to_s)
+          logger.debug "Given byte array key"
+          skey = javax.crypto.spec.SecretKeySpec.new(@spec.ccrypto_key, @spec.algo.to_s)
         when String
-          skey = javax.crypto.spec.SecretKeySpec.new(to_java_bytes(@spec.key), @spec.algo.to_s)
+          logger.debug "Given ruby string key"
+          skey = javax.crypto.spec.SecretKeySpec.new(to_java_bytes(@spec.ccrypto_key), @spec.algo.to_s)
         when javax.crypto.spec.SecretKeySpec
-          skey = @spec.key
+          logger.debug "Given Java SecretKeySpec"
+          skey = @spec.ccrypto_key
         else
-          raise CipherEngineException, "Unknown key type '#{@spec.key}'"
+          raise CipherEngineException, "Unknown key type '#{@spec.ccrypto_key}'"
         end
 
-        #teLogger.debug "SKey : #{skey.encoded}"
+        #logger.debug "SKey : #{to_hex(skey.encoded)}"
 
-        case @spec.cipherOps
-        when :encrypt, :enc
+        if @spec.is_encrypt_cipher_mode?
           if ivParam.nil?
-            teLogger.debug "Encryption mode"
+            logger.debug "Encryption mode"
             @cipher.init(javax.crypto.Cipher::ENCRYPT_MODE, skey)
           else
-            teLogger.debug "Encryption mode with IV"
+            logger.debug "Encryption mode with IV"
             @cipher.init(javax.crypto.Cipher::ENCRYPT_MODE, skey, ivParam)
           end
 
-        when :decrypt, :dec
+        elsif @spec.is_decrypt_cipher_mode?
           if ivParam.nil?
-            teLogger.debug "Decryption mode"
+            logger.debug "Decryption mode"
             @cipher.init(javax.crypto.Cipher::DECRYPT_MODE, skey)
           else
-            teLogger.debug "Decryption mode with IV"
+            logger.debug "Decryption mode with IV"
             @cipher.init(javax.crypto.Cipher::DECRYPT_MODE, skey, ivParam)
           end
 
@@ -167,20 +520,30 @@ module Ccrypto
           raise Ccrypto::CipherEngineException, "Cipher operation must be given"
         end
 
-        if @spec.is_mode?(:gcm) and not_empty?(@spec.auth_data)
-          teLogger.debug "Adding additional authenticated data for GCM mode"
-          @cipher.updateAAD(to_java_bytes(@spec.auth_data))
+        if @spec.is_auth_mode_cipher? 
+
+          # AAD can be added anytime before cipher final
+          # Special instance method for AAD capable cipher
+          instance_eval <<-END
+
+      def update_aad(val)
+          logger.debug "Adding Additional Authenticated Data of length : \#{val.length}"
+          @cipher.updateAAD(to_java_bytes(val))
+      end
+
+          END
+
         end
 
       end
 
       def update(val)
-        teLogger.debug "Passing #{val.length} bytes to cipher"
+        logger.debug "Passing #{val.length} / #{to_java_bytes(val).length} bytes to cipher"
         res = @cipher.update(to_java_bytes(val))  
         if res.nil?
-          teLogger.debug "Cipher update returns nothing"
+          logger.debug "Cipher update returns nothing"
         else
-          teLogger.debug "Cipher update output length #{res.length}"
+          logger.debug "Cipher update output length #{res.length}"
         end
         res
       end
@@ -188,23 +551,20 @@ module Ccrypto
       def final(val = nil, &block)
         baos = java.io.ByteArrayOutputStream.new
         if not_empty?(val)
-          res = update(val)
+          res = update(to_java_bytes(val))
           baos.write(res) if not_empty?(res)
         end
 
         begin
           res = @cipher.doFinal
 
-          teLogger.debug "Final output length : #{res.length}"
-
-          if @spec.is_mode?(:gcm) and @spec.is_encrypt_cipher_mode?
-            # extract auth_tag
-            @spec.auth_tag = res[-16..-1]
-            @spec.auth_tag = String.from_java_bytes(@spec.auth_tag) if not_empty?(@spec.auth_tag)
-          end 
+          logger.debug "Final output length : #{res.length}"
 
           baos.write(res) if not_empty?(res)
-          baos.toByteArray
+          cres = baos.toByteArray
+          logger.debug "Cipher length : #{cres.length}"
+
+          cres
 
         rescue Exception => ex
           raise Ccrypto::CipherEngineException, ex
@@ -212,42 +572,14 @@ module Ccrypto
       end
 
       def reset
-        #@cipher.reset
+        if not @spec.nil?
+          @cipher = javax.crypto.Cipher.getInstance(@spec.provider_config[:cipher_str])
+        end
       end
 
       private
-      def to_algo(algo)
-        algo.to_s.gsub("_","-")
-      end
-
-      def to_cipher_spec(spec)
-        res = []
-
-        res << spec.algo.to_s.gsub("_","-")
-
-        res << spec.mode if not_empty?(spec.mode)
-
-        if spec.algo.to_s.downcase == "aria" and spec.mode.to_s.downcase == "gcm"
-          # for some reasons only aria gcm trigger this error
-          res << "NoPadding"
-        elsif spec.mode.to_s.downcase != "poly1305"
-          case spec.padding 
-          when :pkcs5
-            res << "PKCS5Padding"
-          when :pkcs7
-            res << "PKCS7Padding"
-          when :nopadding
-            res << "NOPadding"
-          end
-        end
-
-        if spec.is_algo?(:chacha20)
-          res.join("-")
-        elsif spec.is_algo?(:blowfish)
-          res[0]
-        else
-          res.join("/")
-        end
+      def logger
+        Ccrypto::Java.logger(:cipher_eng)
       end
 
     end