net.i2p.data

Class SigningPublicKey

java.lang.Object

net.i2p.data.SimpleDataStructure

net.i2p.data.SigningPublicKey

All Implemented Interfaces:

DataStructure

public class SigningPublicKey
extends SimpleDataStructure

Cryptographic public key for digital signature verification in I2P.

SigningPublicKey provides signature verification capabilities:

• Default Algorithm: DSA-SHA1 (128 bytes)
• Modern Support: Variable length and type support since 0.9.8
• Key Structure: Contains only public exponent/coordinates
• Verification: Used to verify signatures and identities

Supported Algorithms:

• DSA-SHA1: Legacy algorithm, 128-byte keys
• ECDSA-P256: Modern algorithm, variable length keys
• EdDSA-Ed25519: Modern algorithm, 32-byte keys
• Future Types: Extensible design for new algorithms

Key Format:

• DSA: 128-byte public parameters (p, q, g, y)
• ECDSA: Variable length elliptic curve coordinates
• EdDSA: 32-byte compressed curve point
• Type Encoding: Algorithm type embedded in data

Usage:

• Signature Verification: Verify signatures from SigningPrivateKey
• Identity Verification: Part of Destination identity
• LeaseSet Verification: Verify LeaseSet authenticity
• Router Identity: Verify router signatures in NetDb

Performance Features:

• LRU Caching: Frequently used keys cached for efficiency
• Factory Methods: Static creation methods for cache access
• Efficient Storage: Optimized byte representation
• Fast Comparison: Optimized equals() and hashCode()

Security Considerations:

• Algorithm Choice: Prefer modern algorithms (Ed25519, ECDSA-P256)
• Key Validation: Verify key parameters before use
• Signature Verification: Always verify with correct algorithm
• Key Distribution: Safely transmit public keys

Blinding Support:

• Key Blinding: Support for blinded key variants
• Privacy: Enable anonymous service endpoints
• BlindData: Integration with BlindData for blinding

Migration Path:

• Legacy: DSA-SHA1 for backward compatibility
• Modern: Ed25519 for better performance and security
• Transition: Mixed algorithm support during migration

Thread Safety:

• Immutable Data: Key data cannot be modified after creation
• Thread-Safe Cache: Static factory methods are thread-safe
• Safe Sharing: Instances can be safely shared between threads

Field Summary

Fields

Modifier and Type	Field and Description
static int	KEYSIZE_BYTES

Fields inherited from class net.i2p.data.SimpleDataStructure

_data

Constructor Summary

Constructors

Constructor and Description
SigningPublicKey()
SigningPublicKey(byte[] data)
SigningPublicKey(SigType type)
SigningPublicKey(SigType type, byte[] data)
SigningPublicKey(String base64Data) constructs from base64

Method Summary

Modifier and Type	Method and Description
SigningPublicKey	blind(SigningPrivateKey alpha) Only for SigType EdDSA_SHA512_Ed25519
static void	clearCache() Clears the public key cache.
static SigningPublicKey	create(byte[] data, int off) Pull from cache or return new.
static SigningPublicKey	create(InputStream in) Pull from cache or return new
boolean	equals(Object obj) Warning - this returns true for two different classes with the same size and same data, e.g.
byte[]	getPadding(KeyCertificate kcert) Get the portion of this (type 0) SPK that is really padding based on the Key Cert type given, if any
SigType	getType() Gets the signature type of this public key.
int	hashCode() We assume the data has enough randomness in it, so use the first 4 bytes for speed.
int	length() The legal length of the byte array in this data structure
String	toString()
(package private) SigningPublicKey	toTypedKey(KeyCertificate kcert) Up-convert this from an untyped (type 0) SPK to a typed SPK based on the Key Cert given.
(package private) void	writeTruncatedBytes(OutputStream out) Write the data up to a max of 128 bytes.

Methods inherited from class net.i2p.data.SimpleDataStructure

calculateHash, fromBase64, fromByteArray, getData, read, readBytes, setData, toBase64, toByteArray, writeBytes

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, wait, wait, wait

Field Detail

KEYSIZE_BYTES

public static final int KEYSIZE_BYTES

Constructor Detail

SigningPublicKey

public SigningPublicKey()

SigningPublicKey

public SigningPublicKey(byte[] data)

SigningPublicKey

public SigningPublicKey(SigType type)

Parameters:

type - if null, type is unknown

SigningPublicKey

public SigningPublicKey(SigType type,
                        byte[] data)

Parameters:

type - if null, type is unknown

SigningPublicKey

public SigningPublicKey(String base64Data)
                 throws DataFormatException

constructs from base64

Parameters:

base64Data - a string of base64 data (the output of .toBase64() called on a prior instance of SigningPublicKey

Throws:

DataFormatException

Method Detail

blind

public SigningPublicKey blind(SigningPrivateKey alpha)

Only for SigType EdDSA_SHA512_Ed25519

Parameters:

alpha - the secret data

Throws:

UnsupportedOperationException - unless supported

clearCache

public static void clearCache()

Clears the public key cache.

create

public static SigningPublicKey create(byte[] data,
                                      int off)

Pull from cache or return new. Deprecated - used only by deprecated Destination.readBytes(data, off)

Throws:

DataFormatException - if not enough bytes

create

public static SigningPublicKey create(InputStream in)
                               throws IOException

Pull from cache or return new

Throws:

IOException

equals

public boolean equals(Object obj)

Description copied from class: SimpleDataStructure

Warning - this returns true for two different classes with the same size and same data, e.g. SessionKey and SessionTag, but you wouldn't put them in the same Set, would you?

Overrides:

equals in class SimpleDataStructure

getPadding

public byte[] getPadding(KeyCertificate kcert)

Get the portion of this (type 0) SPK that is really padding based on the Key Cert type given, if any

Returns:

leading padding length > 0 or null if no padding or type is unknown

Throws:

IllegalArgumentException - if this is already typed to a different type

getType

public SigType getType()

Gets the signature type of this public key.

Returns:

null if unknown

hashCode

public int hashCode()

Description copied from class: SimpleDataStructure

We assume the data has enough randomness in it, so use the first 4 bytes for speed. If this is not the case, override in the extending class.

Overrides:

hashCode in class SimpleDataStructure

length

public int length()

Description copied from class: SimpleDataStructure

The legal length of the byte array in this data structure

Specified by:

length in class SimpleDataStructure

Returns:

if type unknown, the length of the data, or 128 if no data

toString

public String toString()

Overrides:

toString in class SimpleDataStructure

toTypedKey

SigningPublicKey toTypedKey(KeyCertificate kcert)

Up-convert this from an untyped (type 0) SPK to a typed SPK based on the Key Cert given. The type of the returned key will be null if the kcert sigtype is null.

Throws:

IllegalArgumentException - if this is already typed to a different type

writeTruncatedBytes

void writeTruncatedBytes(OutputStream out)
                  throws DataFormatException,
                         IOException

Write the data up to a max of 128 bytes. If longer, the rest will be written in the KeyCertificate.

Throws:

DataFormatException

IOException