Package io.getlime.security.powerauth.crypto.lib.generator

Class KeyGenerator

java.lang.Object
io.getlime.security.powerauth.crypto.lib.generator.KeyGenerator
public class KeyGenerator extends Object
An implementation of a high-level key generator class. Keys are generated using elliptic curves (EC) and unless explicitly stated otherwise, they have 128b length.
Author:
Petr Dvorak

  • Constructor Details

    • KeyGenerator

      public KeyGenerator()

  • Method Details

    • generateKeyPair

      public KeyPair generateKeyPair() throws CryptoProviderException
      Generate a new ECDH key pair using P256r1 curve.
      Returns:
      A new key pair instance, or null in case of an error.
      Throws:
      CryptoProviderException - In case key cryptography provider is incorrectly initialized.

    • computeSharedKey

      public SecretKey computeSharedKey(PrivateKey privateKey, PublicKey publicKey, boolean keep32b) throws InvalidKeyException, CryptoProviderException
      Computes a pre-shared key for given private key and public key (ECDH).
      Parameters:
      privateKey - A private key.
      publicKey - A public key.
      keep32b - Flag that indicates if the key should be kept 32 byte long (in case value is true), or shortened to 16 byte key using byte-by-byte xor operation.
      Returns:
      A new instance of the pre-shared key.
      Throws:
      InvalidKeyException - One of the provided keys are not valid keys.
      CryptoProviderException - In case cryptography provider is incorrectly initialized.

    • computeSharedKey

      public SecretKey computeSharedKey(PrivateKey privateKey, PublicKey publicKey) throws InvalidKeyException, CryptoProviderException
      Computes a pre-shared key for given private key and public key (ECDH). This method calls computeSharedKey(PrivateKey, PublicKey, boolean) with the 'keep32b' parameter set to false. As a result, the key that is returned by this function has only 16B. The key is obtained using byte-by-byte xor operation on the original 32B key (0th byte with 15th, 1st byte with 16th, etc.)
      Parameters:
      privateKey - A private key.
      publicKey - A public key.
      Returns:
      A new instance of the pre-shared key.
      Throws:
      InvalidKeyException - One of the provided keys are not valid keys.
      CryptoProviderException - In case cryptography provider is incorrectly initialized.

    • convert32Bto16B

      public byte[] convert32Bto16B(byte[] original) throws IllegalArgumentException
      Convert 32B byte long array to 16B long array by applying xor between first half and second half values.
      Parameters:
      original - Original byte array, 32B long.
      Returns:
      Result byte array, 16B long.
      Throws:
      IllegalArgumentException

    • generateRandomBytes

      public byte[] generateRandomBytes(int len) throws CryptoProviderException
      Generate a new random byte array with given length.
      Parameters:
      len - Number of random bytes to be generated.
      Returns:
      An array with len random bytes.
      Throws:
      CryptoProviderException - In case key cryptography provider is incorrectly initialized.

    • generateRandomSecretKey

      public SecretKey generateRandomSecretKey() throws CryptoProviderException
      Generate a new random symmetric key.
      Returns:
      A new instance of a symmetric key.
      Throws:
      CryptoProviderException - In case key cryptography provider is incorrectly initialized.

    • deriveSecretKey

      public SecretKey deriveSecretKey(SecretKey secret, byte[] index) throws InvalidKeyException, GenericCryptoException, CryptoProviderException
      Derive a new secret key KEY_SHARED from a master secret key KEY_MASTER based on following KDF: 
       BYTES = index, total 16 bytes
 KEY_SHARED[BYTES] = AES(BYTES, KEY_MASTER)
      Parameters:
      secret - A master shared key.
      index - A byte array index of the key.
      Returns:
      A new derived key from a master key with given index.
      Throws:
      InvalidKeyException - In case secret key is invalid.
      GenericCryptoException - In case key derivation fails.
      CryptoProviderException - In case cryptography provider is incorrectly initialized.

    • deriveSecretKeyHmacLegacy

      @Deprecated public SecretKey deriveSecretKeyHmacLegacy(SecretKey secret, byte[] index) throws GenericCryptoException, CryptoProviderException
      Deprecated.
      Derive a new secret key KEY_SHARED from a master secret key KEY_MASTER based on following KDF: 
       BYTES = index, total 16 bytes
 KEY_SHARED[BYTES] = 32B_TO_16B(HMAC-SHA256(KEY_MASTER, BYTES))
      Note that this function is deprecated and should not be used for a new functionality.
      Parameters:
      secret - A master shared key.
      index - A byte array index of the key.
      Returns:
      A new derived key from a master key with given index.
      Throws:
      GenericCryptoException - In case key derivation fails.
      CryptoProviderException - In case cryptography provider is incorrectly initialized.

    • deriveSecretKeyHmac

      public SecretKey deriveSecretKeyHmac(SecretKey secret, byte[] index) throws GenericCryptoException, CryptoProviderException
      Derive a new secret key KEY_SHARED from a master secret key KEY_MASTER based on following KDF: 
       BYTES = index, total 16 bytes
 KEY_SHARED[BYTES] = 32B_TO_16B(HMAC-SHA256(BYTES, KEY_MASTER))
      Parameters:
      secret - A master shared key.
      index - A byte array index of the key.
      Returns:
      A new derived key from a master key with given index.
      Throws:
      GenericCryptoException - In case key derivation fails.
      CryptoProviderException - In case cryptography provider is incorrectly initialized.

    • deriveSecretKeyFromPassword

      public SecretKey deriveSecretKeyFromPassword(String password, byte[] salt) throws CryptoProviderException
      Derive a long AES suitable key from a password and salt. Uses PBKDF with 10 000 iterations.
      Parameters:
      password - A password used for key derivation.
      salt - A salt used for key derivation.
      Returns:
      A new secret key derived from the password.
      Throws:
      CryptoProviderException - In case cryptography provider is incorrectly initialized.

    • deriveSecretKeyFromPassword

      public SecretKey deriveSecretKeyFromPassword(String password, byte[] salt, int iterations) throws CryptoProviderException
      Derive a long AES suitable key from a password and salt. Uses PBKDF with specified number of iterations.
      Parameters:
      password - A password used for key derivation.
      salt - A salt used for key derivation.
      iterations - Number of iterations used in PBKDF.
      Returns:
      A new secret key derived from the password.
      Throws:
      CryptoProviderException - In case cryptography provider is incorrectly initialized.