java.lang.Object
net.i2p.crypto.KeyGenerator
public final class KeyGeneratorextends Object
Comprehensive key generation facility for I2P cryptographic operations.

This class provides methods to generate various types of cryptographic keys used throughout the I2P network, including:

  • Asymmetric key pairs (ElGamal, DSA, ECDSA, EdDSA, RSA)
  • Symmetric session keys (AES)
  • Key derivation and conversion utilities

Supports both legacy algorithms (DSA, ElGamal) and modern cryptographic schemes (EdDSA, ECDSA) with configurable parameters for security and performance optimization.

  • Field Details

    • _context

      private final I2PAppContext _context
      Supplies the random used to generate keys.

    • PBE_ROUNDS

      private static final int PBE_ROUNDS
      New rounds (1M) - OWASP compliant.
      See Also:

    • PBE_ROUNDS_LEGACY

      private static final int PBE_ROUNDS_LEGACY
      Legacy rounds (1K) - for migration.
      See Also:

    • PUBKEY_EXPONENT_SIZE_FULL

      private static final int PUBKEY_EXPONENT_SIZE_FULL
      Standard exponent size.
      See Also:

    • PUBKEY_EXPONENT_SIZE_SHORT

      private static final int PUBKEY_EXPONENT_SIZE_SHORT
      Short exponent size, considered safe for use with Oakley primes. Per "On Diffie-Hellman Key Agreement with Short Exponents" - van Oorschot, Weiner at EuroCrypt 96, and crypto++'s benchmarks Also, "Koshiba & Kurosawa: Short Exponent Diffie-Hellman Problems" (PKC 2004, LNCS 2947, pp. 173-186) apparently supports this, according to sci.crypt discussion
      See Also:

    • DEFAULT_USE_LONG_EXPONENT

      private static final boolean DEFAULT_USE_LONG_EXPONENT
      Use long ElGamal exponents unless the CPU is slow.

    • PROP_LONG_EXPONENT

      private static final String PROP_LONG_EXPONENT
      Property asking for a 2048-bit ElGamal key.
      See Also:

  • Constructor Details

    • KeyGenerator

      public KeyGenerator(I2PAppContext context)
      Create a new KeyGenerator.
      Parameters:
      context - the I2P app context

  • Method Details

    • getInstance

      public static KeyGenerator getInstance()
      The global KeyGenerator instance.
      Returns:
      The global instance.

    • generateSessionKey

      public SessionKey generateSessionKey()
      Generate a private 256 bit session key.
      Returns:
      session key

    • generateSessionKey

      public SessionKey generateSessionKey(byte[] salt, byte[] passphrase)
      PBE the passphrase with the salt. Warning - SLOW.
      Parameters:
      salt - the random salt; only the first 16 bytes are mixed in
      passphrase - the password bytes stretched into the session key
      Returns:
      the session key

    • generateSessionKey

      public SessionKey generateSessionKey(byte[] salt, byte[] passphrase, int rounds)
      PBE the passphrase with the salt using specified rounds. Warning - SLOW.
      Parameters:
      salt - 16 bytes
      passphrase - the password bytes, appended whole after the 16-byte salt prefix
      rounds - iteration count (1000 for legacy, 1000000 for current)
      Returns:
      derived key

    • getPBERT

      public int getPBERT()
      Get current rounds for new encryptions.
      Returns:
      1000000

    • getPBERTLegacy

      public int getPBERTLegacy()
      Get legacy rounds for migration.
      Returns:
      1000

    • useLongElGamalExponent

      public boolean useLongElGamalExponent()
      Whether to use a long (2048-bit) ElGamal exponent.
      Returns:
      true if using long exponent

    • getElGamalExponentSize

      public int getElGamalExponentSize()
      Size of the ElGamal exponent in bits.
      Returns:
      the size in bits

    • generatePKIKeypair

      public Object[] generatePKIKeypair()
      ElGamal only. Generate a pair of keys, where index 0 is a PublicKey, and index 1 is a PrivateKey.
      Returns:
      pair of keys

    • generatePKIKeys

      public SimpleDataStructure[] generatePKIKeys()
      ElGamal only. Same as generatePKIKeypair() but different return type.
      Returns:
      pair of keys

    • generatePKIKeys

      public KeyPair generatePKIKeys(EncType type)
      Supports EncTypes.
      Parameters:
      type - the encryption type
      Returns:
      the key pair

    • getPublicKey

      public static PublicKey getPublicKey(PrivateKey priv)
      Convert a PrivateKey to its corresponding PublicKey. As of 0.9.38, supports EncTypes.
      Parameters:
      priv - PrivateKey object
      Returns:
      the corresponding PublicKey object
      Throws:
      IllegalArgumentException - on bad key

    • generateSigningKeypair

      public Object[] generateSigningKeypair()
      Generate a pair of DSA keys, where index 0 is a SigningPublicKey, and index 1 is a SigningPrivateKey. DSA-SHA1 only.
      Returns:
      pair of keys

    • generateSigningKeys

      public SimpleDataStructure[] generateSigningKeys()
      DSA-SHA1 only.

      Same as above but different return type.

      Returns:
      pair of keys

    • generateSigningKeys

      public SimpleDataStructure[] generateSigningKeys(SigType type) throws GeneralSecurityException
      Generic signature type, supports DSA, RSA, ECDSA, EdDSA.
      Parameters:
      type - the signature type
      Returns:
      the key pair
      Throws:
      GeneralSecurityException - if key generation fails

    • getSigningPublicKey

      public static SigningPublicKey getSigningPublicKey(SigningPrivateKey priv)
      Convert a SigningPrivateKey to a SigningPublicKey. As of 0.9.16, supports all key types.
      Parameters:
      priv - a SigningPrivateKey object
      Returns:
      a SigningPublicKey object
      Throws:
      IllegalArgumentException - on bad key or unknown type

    • main

      public static void main(String[] args)
      Usage: KeyGenerator [sigtype...].
      Parameters:
      args - command line arguments

    • main2

      private static void main2(String[] args)
      Usage: KeyGenerator [sigtype...].
      Parameters:
      args - signature type names to generate keys for, or none for the default set

    • testSig

      private static void testSig(SigType type, int runs) throws GeneralSecurityException
      Times signing and verifying with one type.
      Parameters:
      type - the signature type to test
      runs - how many signatures to make
      Throws:
      GeneralSecurityException - if the type is unusable