Add an "interactive" token resealing protocol and basic tooling support

Implements a protocol for delegated access to a shared secret key
of a token whose private key we do not possess. This builds directly
on top of the existing token resealing mechanisms.

The primary benefit of the resealing protocol is that none of the
data exchanged can reveal anything about the underlying secret.

Security note: neither resealing requests nor responses are explicitly
authenticated (this is a property inherited from the sealed shared
key tokens themselves). It is assumed that an attacker can observe
all requests and responses in transit, but cannot modify them.

1 files changed, 4 insertions, 4 deletions

diff --git a/security-utils/src/main/java/com/yahoo/security/hpke/Hpke.java b/security-utils/src/main/java/com/yahoo/security/hpke/Hpke.java
index 133798faa99..51f41ab7da7 100644
--- a/security-utils/src/main/java/com/yahoo/security/hpke/Hpke.java
+++ b/security-utils/src/main/java/com/yahoo/security/hpke/Hpke.java
@@ -175,7 +175,7 @@ public final class Hpke {
         }
     }
 
-    private static record ContextBase(byte[] key, byte[] nonce, long seqNum, byte[] exporterSecret) { }
+    private record ContextBase(byte[] key, byte[] nonce, long seqNum, byte[] exporterSecret) { }
 
     /**
      * Section 5.1 Creating the Encryption Context:
@@ -219,8 +219,8 @@ public final class Hpke {
         return new ContextBase(key, baseNonce, 0, exporterSecret);
     }
 
-    private static record ContextS(byte[] enc, ContextBase base) {}
-    private static record ContextR(ContextBase base) {}
+    private record ContextS(byte[] enc, ContextBase base) {}
+    private record ContextR(ContextBase base) {}
 
     /**
      * Section 5.1.1 Encryption to a Public Key:
@@ -253,7 +253,7 @@ public final class Hpke {
         return new ContextR(keySchedule(MODE_BASE, sharedSecret, info, DEFAULT_PSK, DEFAULT_PSK_ID));
     }
 
-    public static record Sealed(byte[] enc, byte[] ciphertext) {}
+    public record Sealed(byte[] enc, byte[] ciphertext) {}
 
     /**
      * Section 6.1 Encryption and Decryption: