Class EstKeygen

java.lang.Object

zeroecho.pkix.EstKeygen

public final class EstKeygen
extends Object

Strict RFC 7030 server-key-generation template and recipient validation. Template public-key and signature values are never used as proof of possession; callers separately enforce authenticated subject/SAN policy and verify the generated certification request. Only asymmetric delivery to the authenticated TLS certificate is supported.

This stateless facade retains no caller buffers. Requests are canonical DER bounded at one MiB, with at most 32 attributes and 32 advertised capabilities. Parsing takes linear time and bounded auxiliary storage in the encoded input. Diagnostics omit request, recipient and key content.

Field Summary

Fields

Modifier and Type	Field	Description
static final String	CAPABILITIES_OID	PKCS#9 client key-encipherment capabilities attribute.
static final String	RECIPIENT_KEY_ID_OID	RFC 7030 authenticated asymmetric recipient identifier attribute.

Method Summary

Modifier and Type	Method	Description
static void	requireAttributes(byte[] templateDer)	Validates the two required encryption attributes and the enclosing DER request structure without evaluating its public key or signature.
static void	requireRecipient(byte[] templateDer, X509Certificate authenticatedRecipient)	Requires the requested key identifier and an advertised supported transport to match the actual authenticated TLS certificate.
static byte[]	signedEncryptedPackage(byte[] templateDer, byte[] privateKeyDer, X509Certificate recipient, List<X509Certificate> generatorChain, ContentSigner generatorSigner)	Signs one RFC 5958 asymmetric key package and encrypts that SignedData for the exact negotiated TLS recipient.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

CAPABILITIES_OID

public static final String CAPABILITIES_OID

PKCS#9 client key-encipherment capabilities attribute.

See Also:

• Constant Field Values

RECIPIENT_KEY_ID_OID

public static final String RECIPIENT_KEY_ID_OID

RFC 7030 authenticated asymmetric recipient identifier attribute.

See Also:

• Constant Field Values

Method Details

requireAttributes

public static void requireAttributes(byte[] templateDer)

Validates the two required encryption attributes and the enclosing DER request structure without evaluating its public key or signature. This does not authorize requested subject names or negotiate a recipient.

Parameters:

templateDer - exact original PKCS#10 template DER

Throws:

IllegalArgumentException - for malformed, duplicate or missing attributes

requireRecipient

public static void requireRecipient(byte[] templateDer,
 X509Certificate authenticatedRecipient)

Requires the requested key identifier and an advertised supported transport to match the actual authenticated TLS certificate. A certificate SKI is used when present; otherwise SHA-256 of its exact SPKI is used. RSA transport requires keyEncipherment and named P-256/P-384/P-521 ECDH requires keyAgreement, unless the certificate has no KeyUsage restriction.

Supported capabilities are rsaEncryption with absent/NULL parameters or ECDH-SHA256 with an AES-256-wrap AlgorithmIdentifier. No implicit recipient, algorithm fallback or trust establishment is performed. Callers must check certificate authentication and validity before invoking this method.

Parameters:

templateDer - exact original PKCS#10 template DER

authenticatedRecipient - actual authenticated TLS end-client certificate

Throws:

IllegalArgumentException - if structure, key identifier, usage or negotiation fails

signedEncryptedPackage

public static byte[] signedEncryptedPackage(byte[] templateDer,
 byte[] privateKeyDer,
 X509Certificate recipient,
 List<X509Certificate> generatorChain,
 ContentSigner generatorSigner)

Signs one RFC 5958 asymmetric key package and encrypts that SignedData for the exact negotiated TLS recipient. The package contains one version-zero PKCS#8 private key; the outer CMS EnvelopedData uses AES-256-GCM and the advertised RSA transport or ECDH-SHA256/AES-256-wrap mechanism. ECDH uses the recipient's supported named curve. The resulting DER belongs in a base64 MIME part with smime-type server-generated-key.

The supplied signer must come from lifecycle-owned stateless signing custody (for example Pkix.signer(PrivateKey, AlgorithmIdentifier)); its signature is checked against the first chain certificate. This method does not authorize or validate that chain. Caller-owned input is neither retained nor cleared. Owned plaintext encoding buffers are cleared; the caller must clear its PKCS#8 buffer after the call. Output is bounded at 16 MiB.

Parameters:

templateDer - exact original template, revalidated before cryptographic use

privateKeyDer - generated PKCS#8 DER, at most one MiB

recipient - authenticated TLS recipient certificate

generatorChain - validated generator signer certificate first, at most 32 certificates

generatorSigner - one-use signer bound to the generator certificate

Returns:

caller-owned encrypted CMS DER

Throws:

IllegalArgumentException - if negotiation, encoding, signature or encryption fails