Package io.getlime.security.powerauth.crypto.server.activation

Class PowerAuthServerActivation

java.lang.Object
io.getlime.security.powerauth.crypto.server.activation.PowerAuthServerActivation
public class PowerAuthServerActivation extends Object
Class implementing cryptography used on a server side in order to assure PowerAuth Server activation related processes.
Author:
Petr Dvorak

  • Constructor Details

    • PowerAuthServerActivation

      public PowerAuthServerActivation()

  • Method Details

    • generateActivationId

      public String generateActivationId()
      Generate a pseudo-unique activation ID. Technically, this is UUID level 4 identifier. PowerAuth Server implementation should validate uniqueness in database, for the very unlikely case of collision.
      Returns:
      A new activation ID (UUID level 4).

    • generateActivationCode

      public String generateActivationCode() throws CryptoProviderException
      Generate a pseudo-unique activation code. The format of activation code is "ABCDE-FGHIJ-KLMNO-PQRST".
      Returns:
      A new activation code.
      Throws:
      CryptoProviderException - In case key cryptography provider is incorrectly initialized.

    • generateServerKeyPair

      public KeyPair generateServerKeyPair() throws CryptoProviderException
      Generate a server related activation key pair.
      Returns:
      A new server key pair.
      Throws:
      CryptoProviderException - In case cryptography provider is incorrectly initialized.

    • generateActivationSignature

      public byte[] generateActivationSignature(String activationCode, PrivateKey masterPrivateKey) throws InvalidKeyException, GenericCryptoException, CryptoProviderException
      Generate signature for the activation code.

      Signature is then computed using the master private key.

      Parameters:
      activationCode - Short activation ID.
      masterPrivateKey - Master Private Key.
      Returns:
      Signature of activation data using Master Private Key.
      Throws:
      InvalidKeyException - In case Master Private Key is invalid.
      GenericCryptoException - In case signature computation fails.
      CryptoProviderException - In case cryptography provider is incorrectly initialized.

    • generateActivationNonce

      public byte[] generateActivationNonce() throws CryptoProviderException
      Generate a new server activation nonce.
      Returns:
      A new server activation nonce.
      Throws:
      CryptoProviderException - In case key cryptography provider is incorrectly initialized.

    • encryptedStatusBlob

      public byte[] encryptedStatusBlob(ActivationStatusBlobInfo statusBlobInfo, byte[] challenge, byte[] nonce, SecretKey transportKey) throws InvalidKeyException, GenericCryptoException, CryptoProviderException
      Returns an encrypted status blob as described in PowerAuth Specification.
      Parameters:
      statusBlobInfo - ActivationStatusBlobInfo object with activation status data to be encrypted.
      challenge - Challenge for activation status blob encryption. If non-null, then also nonce parameter must be provided.
      nonce - Nonce for activation status blob encryption. If non-null, then also challenge parameter must be provided.
      transportKey - A key used to protect the transport.
      Returns:
      Encrypted status blob
      Throws:
      InvalidKeyException - When invalid key is provided.
      GenericCryptoException - In case encryption fails.
      CryptoProviderException - In case cryptography provider is incorrectly initialized.

    • calculateHashFromHashBasedCounter

      public byte[] calculateHashFromHashBasedCounter(byte[] ctrData, SecretKey transportKey) throws CryptoProviderException, InvalidKeyException, GenericCryptoException
      Calculate hash from value representing the hash based counter. HMAC-SHA256 is currently used as a hashing function.
      Parameters:
      ctrData - Hash-based counter.
      transportKey - Transport key.
      Returns:
      Hash calculated from provided hash-based counter.
      Throws:
      GenericCryptoException - In case that key derivation fails or you provided invalid ctrData.
      CryptoProviderException - In case cryptography provider is incorrectly initialized.
      InvalidKeyException - In case that transport key is not valid.

    • computeServerDataSignature

      public byte[] computeServerDataSignature(String activationId, byte[] C_serverPublicKey, PrivateKey masterPrivateKey) throws InvalidKeyException, GenericCryptoException, CryptoProviderException
      Compute an activation ID and encrypted server public key signature using the Master Private Key.
      Parameters:
      activationId - Activation ID
      C_serverPublicKey - Encrypted server public key.
      masterPrivateKey - Master Private Key.
      Returns:
      Signature of the encrypted server public key.
      Throws:
      InvalidKeyException - If master private key is invalid.
      GenericCryptoException - In case signature computation fails.
      CryptoProviderException - In case cryptography provider is incorrectly initialized.

    • computeActivationFingerprint

      public String computeActivationFingerprint(PublicKey devicePublicKey, PublicKey serverPublicKey, String activationId) throws GenericCryptoException, CryptoProviderException
      Compute a fingerprint for the version 3 activation. The fingerprint can be used for visual validation of exchanged device public key.

      PowerAuth protocol versions:

      • 3.0
      • 3.1
      • 3.2
      Parameters:
      devicePublicKey - Device public key.
      serverPublicKey - Server public key.
      activationId - Activation ID.
      Returns:
      Fingerprint of the public key.
      Throws:
      CryptoProviderException - In case cryptography provider is incorrectly initialized.
      GenericCryptoException - In case fingerprint could not be calculated.

    • computeActivationFingerprint

      public String computeActivationFingerprint(PublicKey devicePublicKey, PublicKey serverPublicKey, String activationId, ActivationVersion activationVersion) throws GenericCryptoException, CryptoProviderException
      Compute a fingerprint for the activation. The fingerprint can be used for visual validation of exchanged public keys.
      Parameters:
      devicePublicKey - Device public key.
      serverPublicKey - Server public key.
      activationId - Activation ID.
      activationVersion - Activation version.
      Returns:
      Fingerprint of the public key.
      Throws:
      CryptoProviderException - In case cryptography provider is incorrectly initialized.
      GenericCryptoException - In case fingerprint could not be calculated.