Package zeroecho.pki.impl.core

package zeroecho.pki.impl.core
Default store-backed PKI core service implementations and supporting internal contracts.

This package contains the primary runtime implementations of the PKI core services declared in zeroecho.pki.api. The classes in this package coordinate PKI operations by combining:

  • persistent state and lookup through PkiStore,
  • format-specific credential, request, and status-object processing through CredentialFramework,
  • key indirection through KeyRef, and
  • delegated signing through the asynchronous signing boundary used by the PKI runtime.

The package intentionally acts as an orchestration layer rather than as the location of cryptographic primitive implementations. It validates service-side invariants, prepares runtime input for downstream framework backends, persists resulting domain objects, and enforces explicit failure behavior when required runtime capabilities are unavailable.

Contained responsibilities

The current package content covers default implementations for:

  • certification authority lifecycle operations,
  • certification request fingerprinting, parsing, optional persistence, and proof-of-possession verification orchestration,
  • end-entity issuance orchestration and minimal bundle construction,
  • revocation record creation and lookup,
  • status object generation and listing,
  • public key information resolution through internal runtime contracts.

Architectural boundaries

  • This package is part of the PKI core runtime implementation and is not the primary public extension surface for consumers.
  • Domain contracts remain defined in zeroecho.pki.api.
  • Framework-specific issuance, request parsing, proof-of-possession verification, and status object generation remain delegated to CredentialFramework.
  • Persistent state remains delegated to PkiStore.
  • Private key operations are not performed directly by these classes and are instead routed through key references and signing boundaries.

Security considerations

  • Private key material is never loaded, returned, or persisted by the classes in this package.
  • Implementations must not log private keys, seed material, plaintext payloads, raw signatures, shared secrets, or equivalent sensitive operational material.
  • The correctness and assurance level of PKI outcomes depend on the configured store, framework, and signing runtime honoring their respective contracts.
  • Some operations intentionally expose contract methods that are not yet implemented in the current runtime build; such cases fail explicitly rather than silently degrading behavior.

Implementation style

Implementations in this package favor explicit validation, deterministic control flow, limited hidden behavior, and straightforward failure semantics. The design goal is operational auditability and predictable service behavior rather than compact or implicit programming style.