public static Key unwrapKey(Configuration conf, byte[] keyBytes) throws IOException {
    Key key;
    String masterKeyName =
      conf.get(HConstants.CRYPTO_MASTERKEY_NAME_CONF_KEY, User.getCurrent().getShortName());
    try {
      // First try the master key
      key = unwrapKey(conf, masterKeyName, keyBytes);
    } catch (KeyException e) {
      // If the current master key fails to unwrap, try the alternate, if
      // one is configured
      if (LOG.isDebugEnabled()) {
        LOG.debug("Unable to unwrap key with current master key '" + masterKeyName + "'");
      }
      String alternateKeyName = conf.get(HConstants.CRYPTO_MASTERKEY_ALTERNATE_NAME_CONF_KEY);
      if (alternateKeyName != null) {
        try {
          key = unwrapKey(conf, alternateKeyName, keyBytes);
        } catch (KeyException ex) {
          throw new IOException(ex);
        }
      } else {
        throw new IOException(e);
      }
    }
    return key;
  }
Helper for {@link #unwrapKey(Configuration, String, byte[])} which automatically uses the
configured master and alternative keys, rather than having to specify a key type to unwrap
with. The configuration must be set up correctly for key alias resolution.
@param conf     the current configuration
@param keyBytes the key encrypted by master (or alternative) to unwrap
@return the key bytes, decrypted
@throws IOException if the key cannot be unwrapped
hbase-client/src/main/java/org/apache/hadoop/hbase/security/EncryptionUtil.java