net.i2p.data

## Class BlindData

- java.lang.Object
- - net.i2p.data.BlindData

-     public class BlindData
      extends Object

  Cache data for EdDSA key blinding as specified in Proposal 123: New NetDb Entries.

  BlindData provides the infrastructure for cryptographic key blinding in I2P:

  - Manages blinded and unblinded EdDSA signing key pairs
  - Supports multiple authentication methods for encrypted LeaseSets
  - Caches computed blinded keys and related metadata
  - Handles time-based key rotation and expiration
  - Generates blinded destination addresses (.b32.i2p)

  Key Components:

  - Key Blinding: Transforms clear signing keys into blinded equivalents
  - Authentication: Supports DH, PSK, and no-authentication modes
  - Caching: Stores computed values to avoid expensive recalculation
  - Address Generation: Creates blinded .b32 addresses for services

  Authentication Types:

  - `AUTH_NONE` - No authentication required
  - `AUTH_DH` - Diffie-Hellman key exchange for per-client keys
  - `AUTH_PSK` - Pre-shared key authentication

  Usage Scenarios:

  - Encrypted LeaseSets: Generate blinded keys for restricted access
  - Destination Blinding: Create anonymous service endpoints
  - Access Control: Implement authentication for private services
  - Key Rotation: Manage time-based blinded key updates

  Security Considerations:

  - Blinded keys provide unlinkability between clear and blinded identities
  - Authentication data must be securely stored and transmitted
  - Key rotation intervals should balance security and usability
  - Proper validation of blinded signatures is essential

  Implementation Status: PRELIMINARY - Subject to change as proposal evolves

- - ### Field Summary

    Fields
    Modifier and Type | Field and Description
    --- | ---
    `static int` | `AUTH_DH` bits 3-0 including per-client bit
    `static int` | `AUTH_NONE` bits 3-0 including per-client bit
    `static int` | `AUTH_ON` Enabled, unspecified type
    `static int` | `AUTH_PSK` bits 3-0 including per-client bit

  - ### Constructor Summary

    Constructors
    Constructor and Description
    `BlindData(I2PAppContext ctx, Destination dest, SigType blindType, String secret)` Creates a new BlindData instance for the given destination.
    `BlindData(I2PAppContext ctx, Destination dest, SigType blindType, String secret, int authType, PrivateKey authKey)` Creates a new BlindData instance for the given destination with authentication.
    `BlindData(I2PAppContext ctx, SigningPublicKey spk, SigType blindType, String secret)`
    `BlindData(I2PAppContext ctx, SigningPublicKey spk, SigType blindType, String secret, int authType, PrivateKey authKey)` Creates a new BlindData instance for the given signing public key with authentication.

  - ### Method Summary

    All Methods Instance Methods Concrete Methods
    Modifier and Type | Method and Description
    --- | ---
    `SigningPrivateKey` | `getAlpha()` Gets the alpha value for the current day.
    `PrivateKey` | `getAuthPrivKey()` Gets the authentication private key.
    `boolean` | `getAuthRequired()` Checks if authentication is required.
    `int` | `getAuthType()` Gets the authentication type.
    `Hash` | `getBlindedHash()` Gets the hash of the blinded key for the current day.
    `SigningPublicKey` | `getBlindedPubKey()` Gets the blinded signing public key for the current day.
    `SigType` | `getBlindedSigType()` Gets the type of the blinded signature.
    `long` | `getDate()` Creation date.
    `Hash` | `getDestHash()` Gets the destination hash if known.
    `Destination` | `getDestination()` Gets the destination if known.
    `long` | `getExpiration()` Expiration date.
    `String` | `getSecret()` Gets the secret if set.
    `boolean` | `getSecretRequired()` Checks if a secret is required.
    `SigningPublicKey` | `getUnblindedPubKey()` Gets the unblinded signing public key.
    `void` | `setAuthRequired()` Marks that authentication is required for this blinded key.
    `void` | `setDate(long date)` Creation date.
    `void` | `setDestination(Destination d)` Sets the destination for this blinded data.
    `void` | `setExpiration(long date)` Expiration date.
    `void` | `setSecretRequired()` Marks that a secret is required for this blinded key.
    `String` | `toBase32()` Encodes the blinded key in b33 format.
    `String` | `toString()`

    - ### Methods inherited from class java.lang.Object

      `clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait`

- - ### Field Detail

    - #### AUTH_DH

          public static final int AUTH_DH

      bits 3-0 including per-client bit
      See Also:
        Constant Field Values

    - #### AUTH_NONE

          public static final int AUTH_NONE

      bits 3-0 including per-client bit
      See Also:
        Constant Field Values

    - #### AUTH_ON

          public static final int AUTH_ON

      Enabled, unspecified type
      See Also:
        Constant Field Values

    - #### AUTH_PSK

          public static final int AUTH_PSK

      bits 3-0 including per-client bit
      See Also:
        Constant Field Values

  - ### Constructor Detail

    - #### BlindData

          public BlindData(I2PAppContext ctx,
                           Destination dest,
                           SigType blindType,
                           String secret)

      Creates a new BlindData instance for the given destination.
      Parameters:
        `ctx` - the application context
        `dest` - the destination
        `blindType` - the type of blinded signature
        `secret` - may be null or zero-length
      Throws:
        `IllegalArgumentException` - on various errors

    - #### BlindData

          public BlindData(I2PAppContext ctx,
                           Destination dest,
                           SigType blindType,
                           String secret,
                           int authType,
                           PrivateKey authKey)

      Creates a new BlindData instance for the given destination with authentication.
      Parameters:
        `ctx` - the application context
        `dest` - the destination
        `blindType` - the type of blinded signature
        `secret` - may be null or zero-length
        `authType` - the authentication type
        `authKey` - the authentication key
      Throws:
        `IllegalArgumentException` - on various errors

    - #### BlindData

          public BlindData(I2PAppContext ctx,
                           SigningPublicKey spk,
                           SigType blindType,
                           String secret)

      Parameters:
        `secret` - may be null or zero-length
      Throws:
        `IllegalArgumentException` - on various errors

    - #### BlindData

          public BlindData(I2PAppContext ctx,
                           SigningPublicKey spk,
                           SigType blindType,
                           String secret,
                           int authType,
                           PrivateKey authKey)

      Creates a new BlindData instance for the given signing public key with authentication.
      Parameters:
        `ctx` - the application context
        `spk` - the signing public key
        `blindType` - the type of blinded signature
        `secret` - may be null or zero-length
        `authType` - the authentication type
        `authKey` - the authentication key
      Throws:
        `IllegalArgumentException` - on various errors

  - ### Method Detail

    - #### getAlpha

          public SigningPrivateKey getAlpha()

      Gets the alpha value for the current day.
      Returns:
        Alpha for the current day

    - #### getAuthPrivKey

          public PrivateKey getAuthPrivKey()

      Gets the authentication private key.
      Returns:
        null for no client auth

    - #### getAuthRequired

          public boolean getAuthRequired()

      Checks if authentication is required.
      Returns:
        true if authentication is required

    - #### getAuthType

          public int getAuthType()

      Gets the authentication type.
      Returns:
        0 for no client auth, 1 for DH, 3 for PSK

    - #### getBlindedHash

          public Hash getBlindedHash()

      Gets the hash of the blinded key for the current day.
      Returns:
        The hash of the blinded key for the current day

    - #### getBlindedPubKey

          public SigningPublicKey getBlindedPubKey()

      Gets the blinded signing public key for the current day.
      Returns:
        The blinded key for the current day, non-null

    - #### getBlindedSigType

          public SigType getBlindedSigType()

      Gets the type of the blinded signature.
      Returns:
        The type of the blinded key

    - #### getDate

          public long getDate()

      Creation date. Absolute timestamp. Returns zero if not specified.
      Returns:
        creation date or as overridden by setDate()

    - #### getDestHash

          public Hash getDestHash()

      Gets the destination hash if known.
      Returns:
        The hash of the destination if known, or null

    - #### getDestination

          public Destination getDestination()

      Gets the destination if known.
      Returns:
        null if unknown

    - #### getExpiration

          public long getExpiration()

      Expiration date. Absolute timestamp. Returns zero if not specified.
      Returns:
        expiration date or as overridden by setExpiration()

    - #### getSecret

          public String getSecret()

      Gets the secret if set.
      Returns:
        null if none

    - #### getSecretRequired

          public boolean getSecretRequired()

      Checks if a secret is required.
      Returns:
        true if a secret is required

    - #### getUnblindedPubKey

          public SigningPublicKey getUnblindedPubKey()

      Gets the unblinded signing public key.
      Returns:
        The unblinded SPK, non-null

    - #### setAuthRequired

          public void setAuthRequired()

      Marks that authentication is required for this blinded key.

    - #### setDate

          public void setDate(long date)

      Creation date. Absolute timestamp.
      Parameters:
        `date` - the creation date in milliseconds

    - #### setDestination

          public void setDestination(Destination d)

      Sets the destination for this blinded data.
      Parameters:
        `d` - the destination to set
      Throws:
        `IllegalArgumentException` - on SigningPublicKey mismatch

    - #### setExpiration

          public void setExpiration(long date)

      Expiration date. Absolute timestamp.
      Parameters:
        `date` - the expiration date in milliseconds

    - #### setSecretRequired

          public void setSecretRequired()

      Marks that a secret is required for this blinded key.

    - #### toBase32

          public String toBase32()

      Encodes the blinded key in b33 format. Encodes the blinded key in b33 format.
      Returns:
        the b33 encoded string

    - #### toString

          public String toString()

      Overrides:
        `toString` in class `Object`