Java KeyPairGenerator类代码示例

import net.i2p.crypto.eddsa.KeyPairGenerator; //导入依赖的package包/类
/**
 * Constructs a new instance of the Ed25519Provider.
 */
public Ed25519Provider() {
	super(NAME, 1.0, "Provider wrapping eddsa classes");

	put("KeyPairGenerator.Ed25519", KeyPairGenerator.class.getName());
	put("KeyFactory.Ed25519", KeyFactory.class.getName());
}
 

import net.i2p.crypto.eddsa.KeyPairGenerator; //导入依赖的package包/类
public KeyManager(_KeyStore store) {
    keySpecs = EdDSANamedCurveTable.getByName(EdDSANamedCurveTable.CURVE_ED25519_SHA512);
    keys = new ArrayList<>();

    String seedBase64 = store.load().orElseGet(() -> {
        KeyPair pair = (new KeyPairGenerator()).generateKeyPair();
        String keyEncoded = MxBase64.encode(pair.getPrivate().getEncoded());
        store.store(keyEncoded);
        return keyEncoded;
    });
    byte[] seed = Base64.getDecoder().decode(seedBase64);
    EdDSAPrivateKeySpec privKeySpec = new EdDSAPrivateKeySpec(seed, keySpecs);
    EdDSAPublicKeySpec pubKeySpec = new EdDSAPublicKeySpec(privKeySpec.getA(), keySpecs);
    keys.add(new KeyPair(new EdDSAPublicKey(pubKeySpec), new EdDSAPrivateKey(privKeySpec)));
}
 

import net.i2p.crypto.eddsa.KeyPairGenerator; //导入依赖的package包/类
@PostConstruct
public void build() {
    try {
        keySpecs = EdDSANamedCurveTable.getByName(EdDSANamedCurveTable.CURVE_ED25519_SHA512);
        signEngine = new EdDSAEngine(MessageDigest.getInstance(keySpecs.getHashAlgorithm()));
        keys = new ArrayList<>();

        Path privKey = Paths.get(keyCfg.getPath());

        if (!Files.exists(privKey)) {
            KeyPair pair = (new KeyPairGenerator()).generateKeyPair();
            String keyEncoded = Base64.getEncoder().encodeToString(pair.getPrivate().getEncoded());
            FileUtils.writeStringToFile(privKey.toFile(), keyEncoded, StandardCharsets.ISO_8859_1);
            keys.add(pair);
        } else {
            if (Files.isDirectory(privKey)) {
                throw new RuntimeException("Invalid path for private key: " + privKey.toString());
            }

            if (Files.isReadable(privKey)) {
                byte[] seed = Base64.getDecoder().decode(FileUtils.readFileToString(privKey.toFile(), StandardCharsets.ISO_8859_1));
                EdDSAPrivateKeySpec privKeySpec = new EdDSAPrivateKeySpec(seed, keySpecs);
                EdDSAPublicKeySpec pubKeySpec = new EdDSAPublicKeySpec(privKeySpec.getA(), keySpecs);
                keys.add(new KeyPair(new EdDSAPublicKey(pubKeySpec), new EdDSAPrivateKey(privKeySpec)));
            }
        }
    } catch (NoSuchAlgorithmException | IOException e) {
        throw new RuntimeException(e);
    }
}
 

import net.i2p.crypto.eddsa.KeyPairGenerator; //导入依赖的package包/类
@Before
public void setup() throws InvalidAlgorithmParameterException {

    config = new SqrlConfig();
    config.setSqrlVersion(SQRL_VERSION);
    config.setNutExpirationSeconds(NUT_EXPIRATION);
    config.setSfn(SFN);
    config.setSqrlBaseUri(SQRL_BASE);

    jSqrlServer = new JSqrlServer(userService, sqrlAuthenticationService, config, nutService);

    when(nutService.createNutFromString(NUT_STRING)).thenReturn(sqrlNut);
    when(nutService.getNutString(sqrlNut)).thenReturn(NUT_STRING);
    when(sqrlNut.getCreated()).thenReturn(LocalDateTime.now().minus(10, ChronoUnit.SECONDS));
    when(sqrlNut.isQr()).thenReturn(true);

    when(nutService.createNut(IP_ADDRESS, true)).thenReturn(sqrlNut2);
    when(nutService.getNutString(sqrlNut2)).thenReturn(NUT_STRING_2);

    when(sqrlUser.sqrlEnabled()).thenReturn(true);

    edDsaSpec = EdDSANamedCurveTable.getByName(EdDSANamedCurveTable.CURVE_ED25519_SHA512);
    KeyPairGenerator generator = new KeyPairGenerator();
    generator.initialize(edDsaSpec, new SecureRandom());

    KeyPair keyPair = generator.generateKeyPair();
    clientPrivateKey = keyPair.getPrivate();
    clientPublicKey = keyPair.getPublic();
    byte[] pke = clientPublicKey.getEncoded();
    idk = Arrays.copyOfRange(pke, pke.length - 32, pke.length);
    idkEncoded = SqrlUtil.unpaddedBase64UrlEncoded(idk);
}
 

import net.i2p.crypto.eddsa.KeyPairGenerator; //导入依赖的package包/类
@Test
public void testHandleClientRequest_ident_by_pidk() throws Exception {

    //Generate a new key pair so we can sign the pidk
    KeyPairGenerator generator = new KeyPairGenerator();
    generator.initialize(edDsaSpec, new SecureRandom());

    KeyPair keyPair = generator.generateKeyPair();
    PrivateKey pidkPrivate = keyPair.getPrivate();
    PublicKey pidkPublic = keyPair.getPublic();
    String pidkEncoded = getEncodedPublicKeyString(pidkPublic);

    when(userService.getUserBySqrlKey(idkEncoded)).thenReturn(null);
    when(userService.getUserBySqrlKey(pidkEncoded)).thenReturn(sqrlUser);

    String clientRequestString = createClientRequestMapString(SQRL_VERSION,
            "ident",
            SqrlUtil.unpaddedBase64UrlEncoded(idk),
            pidkEncoded,
            "suk",
            SERVER_UNLOCK_KEY,
            VERIFY_UNLOCK_KEY);

    SqrlClientRequest request = createClientRequest(clientRequestString, SERVER, clientPrivateKey);

    byte[] pids = signRequest(request.getClient(), request.getServer(), pidkPrivate);
    request.setPids(SqrlUtil.unpaddedBase64UrlEncoded(pids));

    SqrlAuthResponse response = jSqrlServer.handleClientRequest(request, NUT_STRING, IP_ADDRESS);

    assertThat(response.getNut()).isEqualTo(NUT_STRING_2);
    assertThat(response.getVer()).isEqualTo(SQRL_VERSION);
    assertThat(response.getQry()).isEqualTo(SQRL_BASE + "?nut=" + NUT_STRING_2);
    assertResponseTifs(response, TransactionInformationFlag.PREVIOUS_ID_MATCH, TransactionInformationFlag.ID_MATCH);

    verify(sqrlAuthenticationService).linkNut(NUT_STRING, NUT_STRING_2);
    verify(userService).getUserBySqrlKey(idkEncoded);
    verify(userService).getUserBySqrlKey(pidkEncoded);
    verify(userService).updateIdentityKey(pidkEncoded, idkEncoded);
}
 

import net.i2p.crypto.eddsa.KeyPairGenerator; //导入依赖的package包/类
@Test
public void testHandleClientRequest_ident_by_pidk_invalid_pidk_sig() throws Exception {

    //Generate a new key pair so we can sign the pidk
    KeyPairGenerator generator = new KeyPairGenerator();
    generator.initialize(edDsaSpec, new SecureRandom());

    KeyPair keyPair = generator.generateKeyPair();
    PublicKey pidkPublic = keyPair.getPublic();
    String pidkEncoded = getEncodedPublicKeyString(pidkPublic);

    when(userService.getUserBySqrlKey(idkEncoded)).thenReturn(null);
    when(userService.getUserBySqrlKey(pidkEncoded)).thenReturn(sqrlUser);

    String clientRequestString = createClientRequestMapString(SQRL_VERSION,
            "ident",
            SqrlUtil.unpaddedBase64UrlEncoded(idk),
            pidkEncoded,
            "suk",
            SERVER_UNLOCK_KEY,
            VERIFY_UNLOCK_KEY);

    SqrlClientRequest request = createClientRequest(clientRequestString, SERVER, clientPrivateKey);

    //Just use the original ids, it won't be valid
    request.setPids(request.getIds());

    SqrlAuthResponse response = jSqrlServer.handleClientRequest(request, NUT_STRING, IP_ADDRESS);

    assertThat(response.getNut()).isEqualTo(NUT_STRING_2);
    assertThat(response.getVer()).isEqualTo(SQRL_VERSION);
    assertThat(response.getQry()).isEqualTo(SQRL_BASE + "?nut=" + NUT_STRING_2);
    assertResponseTifs(response, TransactionInformationFlag.CLIENT_FAILURE);

    verify(sqrlAuthenticationService, never()).linkNut(NUT_STRING, NUT_STRING_2);
    verify(userService, never()).getUserBySqrlKey(anyString());
    verify(userService, never()).updateIdentityKey(anyString(), anyString());
}
 

import net.i2p.crypto.eddsa.KeyPairGenerator; //导入依赖的package包/类
@Test
public void testHandleClientRequest_enable_existing_user() throws Exception {

    //Generate a new key pair so we can sign the unlock request
    KeyPairGenerator generator = new KeyPairGenerator();
    generator.initialize(edDsaSpec, new SecureRandom());

    KeyPair keyPair = generator.generateKeyPair();
    PublicKey vukPublic = keyPair.getPublic();
    PrivateKey vukPrivate = keyPair.getPrivate();

    String vuk = getEncodedPublicKeyString(vukPublic);

    when(userService.getUserBySqrlKey(idkEncoded)).thenReturn(sqrlUser);
    when(sqrlUser.getVerifyUnlockKey()).thenReturn(vuk);

    String clientRequestString = createClientRequestMapString(SQRL_VERSION,
            "enable",
            SqrlUtil.unpaddedBase64UrlEncoded(idk),
            null,
            "suk",
            null,
            null);

    SqrlClientRequest request = createClientRequest(clientRequestString, SERVER, clientPrivateKey);

    byte[] urs = signRequest(request.getClient(), request.getServer(), vukPrivate);
    request.setUrs(SqrlUtil.unpaddedBase64UrlEncoded(urs));

    SqrlAuthResponse response = jSqrlServer.handleClientRequest(request, NUT_STRING, IP_ADDRESS);

    assertThat(response.getNut()).isEqualTo(NUT_STRING_2);
    assertThat(response.getVer()).isEqualTo(SQRL_VERSION);
    assertThat(response.getQry()).isEqualTo(SQRL_BASE + "?nut=" + NUT_STRING_2);
    assertThat(response.getTif()).isEqualTo(TransactionInformationFlag.ID_MATCH.getHexValue());

    verify(sqrlAuthenticationService).linkNut(NUT_STRING, NUT_STRING_2);
    verify(userService).getUserBySqrlKey(idkEncoded);
    verify(userService).enableSqrlUser(idkEncoded);
}
 

import net.i2p.crypto.eddsa.KeyPairGenerator; //导入依赖的package包/类
@Test
public void testHandleClientRequest_remove_existing_user() throws Exception {

    //Generate a new key pair so we can sign the unlock request
    KeyPairGenerator generator = new KeyPairGenerator();
    generator.initialize(edDsaSpec, new SecureRandom());

    KeyPair keyPair = generator.generateKeyPair();
    PublicKey vukPublic = keyPair.getPublic();
    PrivateKey vukPrivate = keyPair.getPrivate();

    String vuk = getEncodedPublicKeyString(vukPublic);

    when(userService.getUserBySqrlKey(idkEncoded)).thenReturn(sqrlUser);
    when(sqrlUser.getVerifyUnlockKey()).thenReturn(vuk);

    String clientRequestString = createClientRequestMapString(SQRL_VERSION,
            "remove",
            SqrlUtil.unpaddedBase64UrlEncoded(idk),
            null,
            "suk",
            null,
            null);

    SqrlClientRequest request = createClientRequest(clientRequestString, SERVER, clientPrivateKey);

    byte[] urs = signRequest(request.getClient(), request.getServer(), vukPrivate);
    request.setUrs(SqrlUtil.unpaddedBase64UrlEncoded(urs));

    SqrlAuthResponse response = jSqrlServer.handleClientRequest(request, NUT_STRING, IP_ADDRESS);

    assertThat(response.getNut()).isEqualTo(NUT_STRING_2);
    assertThat(response.getVer()).isEqualTo(SQRL_VERSION);
    assertThat(response.getQry()).isEqualTo(SQRL_BASE + "?nut=" + NUT_STRING_2);
    assertThat(response.getTif()).isEqualTo(TransactionInformationFlag.ID_MATCH.getHexValue());

    verify(sqrlAuthenticationService).linkNut(NUT_STRING, NUT_STRING_2);
    verify(userService).getUserBySqrlKey(idkEncoded);
    verify(userService).removeSqrlUser(idkEncoded);
}
 

import net.i2p.crypto.eddsa.KeyPairGenerator; //导入依赖的package包/类
@Test
public void testUnverifiedSignature() throws Exception {

    //Generate a new key pair so we generate a valid signature, just one
    //that won't be verified against the original request
    KeyPairGenerator generator = new KeyPairGenerator();
    generator.initialize(edDsaSpec, new SecureRandom());

    KeyPair keyPair = generator.generateKeyPair();
    PrivateKey invalidPrivateKey = keyPair.getPrivate();

    when(userService.getUserBySqrlKey(idkEncoded)).thenReturn(null);

    String clientRequestString = createClientRequestMapString(SQRL_VERSION,
            "query",
            SqrlUtil.unpaddedBase64UrlEncoded(idk),
            "suk",
            null,
            null,
            null);

    SqrlClientRequest request = createClientRequest(clientRequestString, SERVER, invalidPrivateKey);

    SqrlAuthResponse response = jSqrlServer.handleClientRequest(request, NUT_STRING, IP_ADDRESS);

    assertThat(response.getNut()).isEqualTo(NUT_STRING_2);
    assertThat(response.getVer()).isEqualTo(SQRL_VERSION);
    assertThat(response.getQry()).isEqualTo(SQRL_BASE + "?nut=" + NUT_STRING_2);
    assertResponseTifs(response, TransactionInformationFlag.CLIENT_FAILURE);

    /**TODO Is it valid to assume we shouldn't link a request with a bad signature to one that had a good signature?*/
    verify(sqrlAuthenticationService, never()).linkNut(NUT_STRING, NUT_STRING_2);
    verify(userService, never()).getUserBySqrlKey(idkEncoded);
}
 

import net.i2p.crypto.eddsa.KeyPairGenerator; //导入依赖的package包/类
/**
 * Generates a random Stellar keypair.
 * @return a random Stellar keypair.
 */
public static KeyPair random() {
  java.security.KeyPair keypair = new KeyPairGenerator().generateKeyPair();
  return new KeyPair((EdDSAPublicKey) keypair.getPublic(), (EdDSAPrivateKey) keypair.getPrivate());
}
 

import net.i2p.crypto.eddsa.KeyPairGenerator; //导入依赖的package包/类
/**
 * Use this method once to generated an "authToken" which is the
 * combination of a random "user" and the hash of an EdDSA-key.
 * Persist the authToken somewhere, either in a static final, inside a property etc.
 *
 * @return An authToken to be used with the constructor of AirPlayAuth.
 */
public static String generateNewAuthToken() {
    String clientId = AuthUtils.randomString(16);

    return clientId + "@" + net.i2p.crypto.eddsa.Utils.bytesToHex(new KeyPairGenerator().generateKeyPair().getPrivate().getEncoded());
}