JAVA - Calling JsonKeysetReader::read() more than once invalidates the reader about tink

[thaidn]

Can you tell me why you need to read a reader multiple times? In Tink's design, a reader is a temporary object that should be immediately discarded after it is used to obtain a KeysetHandle.

[spennymac]

Sure. I only brought this up since this was a change that broke my framework when I updated to the latest release. I am fine with your response, makes sense, readers generally are used only use. I just got bit by the fact that a reader instantiated with JSON is able to be reused. If anything, I am abusing this.

Anyways, this is why..

I am reading in a keyset from some source and need to differentiate between NoSecret and Secret containing keysets.

try {
    KeysetHandle keysetHandle = NoSecretKeysetHandle.read(reader); 
     return new TinkPublicKeyset(keysetHandle);
} catch (GeneralSecurityException ex) {
    KeysetHandle keysetHandle = CleartextKeysetHandle.read(reader);
    return new TinkKeyset(keysetHandle);
}

Thanks!

[thaidn]

Oh I see. This is an interesting usage. I guess at some point downstream you'd have to check whether you're dealing with TinkPublicKeyset or TinkKeyset, right? I'd rather separate them completely from the beginning.

How did you fix it?

[spennymac]

Im not sure yet if I can do this a different layer since this is reading a keyset from some source (disk, kms).

But as a temporary fix, I just instantiated my reader with JsonKeysetReader.withJsonObject(json..) instead of JsonKeysetReader.withString(string..)

[spennymac]

Anyways, I will close this as you have already given me a proper response.

Thanks!