Package io.getlime.security.powerauth.crypto.server.keyfactory

Class PowerAuthServerKeyFactory

java.lang.Object

io.getlime.security.powerauth.crypto.server.keyfactory.PowerAuthServerKeyFactory

public class PowerAuthServerKeyFactory
extends Object

Key factory used on server side to generate PowerAuth related keys.

Author:

Petr Dvorak, petr@wultra.com

Constructor Summary

Constructors

Constructor	Description
PowerAuthServerKeyFactory()

Method Summary

Modifier and Type	Method	Description
SecretKey	deriveTransportKey(PrivateKey serverPrivateKey, PublicKey devicePublicKey)	Derive transport key KEY_TRANSPORT in two steps: 1.
SecretKey	generateServerEncryptedVaultKey(SecretKey masterSecretKey)	Generate a transport key KEY_ENCRYPTED_VAULT from master secret key KEY_MASTER_SECRET using KDF.
SecretKey	generateServerMasterSecretKey(PrivateKey serverPrivateKey, PublicKey devicePublicKey)	Generate a master secret key KEY_MASTER_SECRET using the server private key KEY_SERVER_PRIVATE and device public key KEY_DEVICE_PUBLIC.
SecretKey	generateServerSignatureBiometryKey(SecretKey masterSecretKey)	Generate a signature key KEY_SIGNATURE_BIOMETRY from master secret key KEY_MASTER_SECRET using KDF.
SecretKey	generateServerSignatureKnowledgeKey(SecretKey masterSecretKey)	Generate a signature key KEY_SIGNATURE_KNOWLEDGE from master secret key KEY_MASTER_SECRET using KDF.
SecretKey	generateServerSignaturePossessionKey(SecretKey masterSecretKey)	Generate a signature key KEY_SIGNATURE_POSSESSION from master secret key KEY_MASTER_SECRET using KDF.
SecretKey	generateServerTransportKey(SecretKey masterSecretKey)	Generate a transport key KEY_TRANSPORT from master secret key KEY_MASTER_SECRET using KDF.
List<SecretKey>	keysForSignatureType(PowerAuthSignatureTypes signatureType, SecretKey masterSecretKey)	Generate a list with signature keys for given signature type and master secret

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

PowerAuthServerKeyFactory

public PowerAuthServerKeyFactory()

Method Details

keysForSignatureType

public List<SecretKey> keysForSignatureType(PowerAuthSignatureTypes signatureType,
 SecretKey masterSecretKey)
                                     throws InvalidKeyException,
GenericCryptoException,
CryptoProviderException

Generate a list with signature keys for given signature type and master secret

Parameters:

signatureType - Requested signature type

masterSecretKey - Master Key Secret

Returns:

List with keys constructed from master secret that are needed to get requested signature type.

Throws:

InvalidKeyException - In case master secret key is invalid.

GenericCryptoException - In case key derivation fails.

CryptoProviderException - In case cryptography provider is incorrectly initialized.

generateServerEncryptedVaultKey

public SecretKey generateServerEncryptedVaultKey(SecretKey masterSecretKey)
                                          throws InvalidKeyException,
GenericCryptoException,
CryptoProviderException

Generate a transport key KEY_ENCRYPTED_VAULT from master secret key KEY_MASTER_SECRET using KDF.

Parameters:

masterSecretKey - Master secret key KEY_MASTER_SECRET.

Returns:

An instance of signature key KEY_ENCRYPTED_VAULT.

Throws:

InvalidKeyException - In case master secret key is invalid.

GenericCryptoException - In case key derivation fails.

CryptoProviderException - In case cryptography provider is incorrectly initialized.

See Also:

• KeyGenerator.deriveSecretKey(SecretKey, byte[])

generateServerMasterSecretKey

public SecretKey generateServerMasterSecretKey(PrivateKey serverPrivateKey,
 PublicKey devicePublicKey)
                                        throws InvalidKeyException,
CryptoProviderException

Generate a master secret key KEY_MASTER_SECRET using the server private key KEY_SERVER_PRIVATE and device public key KEY_DEVICE_PUBLIC.

Parameters:

serverPrivateKey - Server private key KEY_SERVER_PRIVATE.

devicePublicKey - Device public key KEY_DEVICE_PUBLIC.

Returns:

Computed symmetric key KEY_MASTER_SECRET.

Throws:

InvalidKeyException - In case some provided key is invalid.

CryptoProviderException - In case cryptography provider is incorrectly initialized.

generateServerSignatureBiometryKey

public SecretKey generateServerSignatureBiometryKey(SecretKey masterSecretKey)
                                             throws InvalidKeyException,
GenericCryptoException,
CryptoProviderException

Generate a signature key KEY_SIGNATURE_BIOMETRY from master secret key KEY_MASTER_SECRET using KDF.

Parameters:

masterSecretKey - Master secret key KEY_MASTER_SECRET.

Returns:

An instance of signature key KEY_SIGNATURE_BIOMETRY.

Throws:

InvalidKeyException - In case master secret key is invalid.

GenericCryptoException - In case key derivation fails.

CryptoProviderException - In case cryptography provider is incorrectly initialized.

See Also:

• KeyGenerator.deriveSecretKey(SecretKey, byte[])

generateServerSignatureKnowledgeKey

public SecretKey generateServerSignatureKnowledgeKey(SecretKey masterSecretKey)
                                              throws InvalidKeyException,
GenericCryptoException,
CryptoProviderException

Generate a signature key KEY_SIGNATURE_KNOWLEDGE from master secret key KEY_MASTER_SECRET using KDF.

Parameters:

masterSecretKey - Master secret key KEY_MASTER_SECRET.

Returns:

An instance of signature key KEY_SIGNATURE_KNOWLEDGE.

Throws:

InvalidKeyException - In case master secret key is invalid.

GenericCryptoException - In case key derivation fails.

CryptoProviderException - In case cryptography provider is incorrectly initialized.

See Also:

• KeyGenerator.deriveSecretKey(SecretKey, byte[])

generateServerSignaturePossessionKey

public SecretKey generateServerSignaturePossessionKey(SecretKey masterSecretKey)
                                               throws InvalidKeyException,
GenericCryptoException,
CryptoProviderException

Generate a signature key KEY_SIGNATURE_POSSESSION from master secret key KEY_MASTER_SECRET using KDF.

Parameters:

masterSecretKey - Master secret key KEY_MASTER_SECRET.

Returns:

An instance of signature key KEY_SIGNATURE_POSSESSION.

Throws:

InvalidKeyException - In case master secret key is invalid.

GenericCryptoException - In case key derivation fails.

CryptoProviderException - In case cryptography provider is incorrectly initialized.

See Also:

• KeyGenerator.deriveSecretKey(SecretKey, byte[])

generateServerTransportKey

public SecretKey generateServerTransportKey(SecretKey masterSecretKey)
                                     throws InvalidKeyException,
GenericCryptoException,
CryptoProviderException

Generate a transport key KEY_TRANSPORT from master secret key KEY_MASTER_SECRET using KDF.

Parameters:

masterSecretKey - Master secret key KEY_MASTER_SECRET.

Returns:

An instance of signature key KEY_TRANSPORT.

Throws:

InvalidKeyException - In case master secret key is invalid.

GenericCryptoException - In case key derivation fails.

CryptoProviderException - In case cryptography provider is incorrectly initialized.

See Also:

• KeyGenerator.deriveSecretKey(SecretKey, byte[])

deriveTransportKey

public SecretKey deriveTransportKey(PrivateKey serverPrivateKey,
 PublicKey devicePublicKey)
                             throws InvalidKeyException,
GenericCryptoException,
CryptoProviderException

Derive transport key KEY_TRANSPORT in two steps: 1. Generate KEY_MASTER_SECRET using KEY_SERVER_PRIVATE and KEY_DEVICE_PUBLIC. 2. Generate KEY_TRANSPORT from previously generated KEY_MASTER_SECRET using KDF.

Parameters:

serverPrivateKey - Server private key KEY_SERVER_PRIVATE.

devicePublicKey - Device public key KEY_DEVICE_PUBLIC.

Returns:

Derived transport key KEY_TRANSPORT.

Throws:

InvalidKeyException - In case key is invalid.

GenericCryptoException - In case key derivation fails.

CryptoProviderException - In case cryptography provider is incorrectly initialized.