Skip to content

feat(java): add Google Tink AEAD detection rules#406

Closed
Chennamma-Hotkar wants to merge 3 commits into
cbomkit:mainfrom
Chennamma-Hotkar:feature/java-tink-detection-rules
Closed

feat(java): add Google Tink AEAD detection rules#406
Chennamma-Hotkar wants to merge 3 commits into
cbomkit:mainfrom
Chennamma-Hotkar:feature/java-tink-detection-rules

Conversation

@Chennamma-Hotkar
Copy link
Copy Markdown

@Chennamma-Hotkar Chennamma-Hotkar commented May 7, 2026

Summary

Adds detection rules for Google Tink's AEAD (Authenticated Encryption
with Associated Data) primitive in Java. Tink is one of the most widely
used Java cryptography libraries and currently has no detection coverage
in this plugin.

Changes

  • TinkAead.java: detect KeysetHandle.generateNew() for four AEAD
    key templates with Aead.encrypt() and Aead.decrypt() as depending rules
  • TinkDetectionRules.java: aggregates all Tink detection rules
  • TinkAeadTestFile.java: Java test file using real Tink 1.21.0 API
  • TinkAeadTest.java: unit test verifying detection and translation
  • JavaDetectionRules.java: registers TinkDetectionRules in rule aggregator
  • JavaAbstractLibraryTranslator.java: adds "Tink" bundle dispatch
  • JavaCipherContextTranslator.java: maps Tink AEAD templates to AES model nodes
  • java/pom.xml: adds com.google.crypto.tink:tink:1.21.0 as test dependency

Key templates detected

  • AeadKeyTemplates.AES128_GCM
  • AeadKeyTemplates.AES256_GCM
  • AeadKeyTemplates.AES128_CTR_HMAC_SHA256
  • AeadKeyTemplates.AES256_CTR_HMAC_SHA256

Testing

  • 157 tests pass (was 156 before)
  • mvn spotless:check passes
  • mvn -B clean package -pl java passes
Screenshot 2026-05-08 041741

Follow-up PR

  • Mac.computeMac() / Mac.verifyMac() — HMAC detection
  • HybridEncrypt.encrypt() / HybridDecrypt.decrypt() — hybrid encryption
  • PublicKeySign.sign() / PublicKeyVerify.verify() — digital signatures
  • DeterministicAead operations
  • Additional key templates (ChaCha20Poly1305, AES-SIV, hybrid templates)

@Chennamma-Hotkar
Copy link
Copy Markdown
Author

Closing in favor of #407, which now contains all Tink detection
rules (AEAD, Mac, Hybrid, Signature) in a single self-contained
commit. No code is lost — #407 is the complete Tink contribution.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant