import org.apache.hadoop.crypto.Decryptor; //导入依赖的package包/类
@Override
public KeyVersion decryptEncryptedKey(
    EncryptedKeyVersion encryptedKeyVersion) throws IOException,
    GeneralSecurityException {
  // Fetch the encryption key material
  final String encryptionKeyVersionName =
      encryptedKeyVersion.getEncryptionKeyVersionName();
  final KeyVersion encryptionKey =
      keyProvider.getKeyVersion(encryptionKeyVersionName);
  Preconditions.checkNotNull(encryptionKey,
      "KeyVersion name '%s' does not exist", encryptionKeyVersionName);
  Preconditions.checkArgument(
          encryptedKeyVersion.getEncryptedKeyVersion().getVersionName()
                .equals(KeyProviderCryptoExtension.EEK),
            "encryptedKey version name must be '%s', is '%s'",
            KeyProviderCryptoExtension.EEK,
            encryptedKeyVersion.getEncryptedKeyVersion().getVersionName()
        );

  // Encryption key IV is determined from encrypted key's IV
  final byte[] encryptionIV =
      EncryptedKeyVersion.deriveIV(encryptedKeyVersion.getEncryptedKeyIv());

  CryptoCodec cc = CryptoCodec.getInstance(keyProvider.getConf());
  Decryptor decryptor = cc.createDecryptor();
  decryptor.init(encryptionKey.getMaterial(), encryptionIV);
  final KeyVersion encryptedKV =
      encryptedKeyVersion.getEncryptedKeyVersion();
  int keyLen = encryptedKV.getMaterial().length;
  ByteBuffer bbIn = ByteBuffer.allocateDirect(keyLen);
  ByteBuffer bbOut = ByteBuffer.allocateDirect(keyLen);
  bbIn.put(encryptedKV.getMaterial());
  bbIn.flip();
  decryptor.decrypt(bbIn, bbOut);
  bbOut.flip();
  byte[] decryptedKey = new byte[keyLen];
  bbOut.get(decryptedKey);
  return new KeyVersion(encryptionKey.getName(), EK, decryptedKey);
}
 

import org.apache.hadoop.crypto.Decryptor; //导入依赖的package包/类
@Override
public KeyVersion decryptEncryptedKey(
    EncryptedKeyVersion encryptedKeyVersion) throws IOException,
    GeneralSecurityException {
  // Fetch the encryption key material
  final String encryptionKeyVersionName =
      encryptedKeyVersion.getEncryptionKeyVersionName();

  final KeyVersion encryptionKey = keyProvider instanceof KeyPairProvider ?
      ((KeyPairProvider) keyProvider).getKeyPairVersion(encryptionKeyVersionName).privateToKeyVersion() :
      keyProvider.getKeyVersion(encryptionKeyVersionName);

  Preconditions.checkNotNull(encryptionKey,
      "KeyVersion name '%s' does not exist", encryptionKeyVersionName);
  Preconditions.checkArgument(
          encryptedKeyVersion.getEncryptedKeyVersion().getVersionName()
                .equals(KeyProviderCryptoExtension.EEK),
            "encryptedKey version name must be '%s', is '%s'",
            KeyProviderCryptoExtension.EEK,
            encryptedKeyVersion.getEncryptedKeyVersion().getVersionName()
        );

  // Encryption key IV is determined from encrypted key's IV
  final byte[] encryptionIV =
      EncryptedKeyVersion.deriveIV(encryptedKeyVersion.getEncryptedKeyIv());

  Metadata metadata = keyProvider.getMetadata(encryptedKeyVersion.getEncryptionKeyName());

  CryptoCodec cc = CryptoCodec.getInstance(keyProvider.getConf());
  Decryptor decryptor = cc.createDecryptor();
  decryptor.init(encryptionKey.getMaterial(), encryptionIV);
  final KeyVersion encryptedKV =
      encryptedKeyVersion.getEncryptedKeyVersion();

  int encryptedKeyLen = encryptedKV.getMaterial().length;
  int keyLen = metadata.getBitLength() / 8;

  /*
    System.err.println("cc" + cc.getClass().toString() +
      " encryption key " + encryptionKey.getMaterial().length +
      " key material len " + encryptedKeyLen +
    " key meta len " + keyLen + " ecnryption iv " + encryptionIV.length);
    */

  ByteBuffer bbIn = ByteBuffer.allocateDirect(encryptedKeyLen);
  ByteBuffer bbOut = ByteBuffer.allocateDirect(encryptedKeyLen);

  // System.err.println("encrypted len " + encryptedKeyLen + " key len " + keyLen);
  bbIn.put(encryptedKV.getMaterial());
  bbIn.flip();
  decryptor.decrypt(bbIn, bbOut);
  byte[] decryptedKey = new byte[keyLen];
  bbOut.get(decryptedKey);
  return new KeyVersion(encryptionKey.getName(), EK, decryptedKey);
}