Class PublicKeyIdentity

java.lang.Object
zeroecho.pkix.PublicKeyIdentity
public final class PublicKeyIdentity extends Object
Immutable mathematical public-key identity for enrollment separation checks. Supports rsaEncryption keys with absent or NULL parameters and named P-256, P-384 and P-521 keys with standard compressed or uncompressed SEC1 points. PSS-restricted RSA, explicit/implicit EC domains and other algorithms are rejected. This identity does not authorize a key, enforce a security strength, or replace verification of its original encoding and algorithm restrictions.

The canonical commitment hashes a canonical SPKI: RSA uses DER NULL parameters; EC uses its named-curve OID and uncompressed point. The finite equivalent-encoding commitments are solely for exclusion against existing hash-only mappings. They must never broaden authentication matching.

Instances are thread-safe. Input is bounded at 16 KiB. Parsing and retained storage are linear in the input size, plus bounded curve-point validation.

  • Field Details

    • MAXIMUM_SPKI_BYTES

      public static final int MAXIMUM_SPKI_BYTES
      Maximum accepted encoded SPKI size.
      See Also:

  • Method Details

    • fromSubjectPublicKeyInfo

      public static PublicKeyIdentity fromSubjectPublicKeyInfo(byte[] encoded)
      Parses and validates one supported mathematical key without retaining input.
      Parameters:
      encoded - exact DER SubjectPublicKeyInfo, defensively copied
      Returns:
      normalized immutable key identity
      Throws:
      IllegalArgumentException - if input is null, oversized, malformed or unsupported

    • canonicalSubjectPublicKeyInfo

      public byte[] canonicalSubjectPublicKeyInfo()
      Returns the canonical encoding used solely for identity comparison.
      Returns:
      a defensive copy of the canonical identity-only SPKI

    • canonicalSha256

      public String canonicalSha256()
      Returns the stable mathematical key commitment.
      Returns:
      lowercase SHA-256 of the canonical SPKI, never an authentication grant

    • equivalentSubjectPublicKeyInfoSha256

      public Set<String> equivalentSubjectPublicKeyInfoSha256()
      Returns immutable, sorted legacy SPKI hashes of both supported encodings. These hashes are exclusively for conservative alias exclusion. Certificate hashes and issuer/serial hashes occupy separate commitment domains.
      Returns:
      finite equivalent-encoding hashes

    • toString

      public String toString()
      Overrides:
      toString in class Object
      Returns:
      redacted diagnostic description