Package com.hierynomus.sshj.userauth.fido

Class SecurityKeyPrivateKey

java.lang.Object

com.hierynomus.sshj.userauth.fido.SecurityKeyPrivateKey

All Implemented Interfaces:

Serializable, Key, PrivateKey, Destroyable

public class SecurityKeyPrivateKey
extends Object
implements PrivateKey

The "private" half of an OpenSSH FIDO/U2F security key.

Unlike a normal private key this holds no secret scalar: the secret never leaves the hardware authenticator. What an sk-* private key file actually stores - and what this class carries - is the application, the key handle (credential id) and the authenticator flags. Signing is delegated to a SecurityKeySigner, which drives the hardware.

See Also:

• SecurityKeySigner
• Serialized Form

Constructor Summary

Constructors

Constructor	Description
SecurityKeyPrivateKey(String keyTypeName, SecurityKeyPublicKey publicKey, byte flags, byte[] keyHandle, SecurityKeySigner signer)

Method Summary

Modifier and Type	Method	Description
String	getAlgorithm()
String	getApplication()
byte[]	getEncoded()
byte	getFlags()
String	getFormat()
byte[]	getKeyHandle()
String	getKeyTypeName()
SecurityKeyPublicKey	getPublicKey()
SecurityKeySigner	getSigner()

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface javax.security.auth.Destroyable

destroy, isDestroyed

Constructor Details

SecurityKeyPrivateKey

public SecurityKeyPrivateKey(String keyTypeName,
 SecurityKeyPublicKey publicKey,
 byte flags,
 byte[] keyHandle,
 SecurityKeySigner signer)

Method Details

getKeyTypeName

public String getKeyTypeName()

Returns:

the SSH key type, e.g. sk-ssh-ed25519@openssh.com.

getPublicKey

public SecurityKeyPublicKey getPublicKey()

getApplication

public String getApplication()

getFlags

public byte getFlags()

Returns:

the authenticator flags the key was created with (user-presence / user-verification).

getKeyHandle

public byte[] getKeyHandle()

getSigner

public SecurityKeySigner getSigner()

Returns:

the bridge to the hardware authenticator, or null if none was attached.

getAlgorithm

public String getAlgorithm()

Specified by:

getAlgorithm in interface Key

getFormat

public String getFormat()

Specified by:

getFormat in interface Key

getEncoded

public byte[] getEncoded()

Specified by:

getEncoded in interface Key