Class CertGenerator

java.lang.Object

pt.unl.fct.di.novasys.babel2.ssl.CertGenerator

public class CertGenerator
extends Object

Generator for ephemeral X.509 certificates carrying a long-term peer identity extension.

Following the libp2p TLS specification pattern (RFC 9364), nodes generate an ephemeral EC key pair and certificate for the TLS session (QUIC or TCP). The certificate embeds a critical custom X.509 extension (OID "2.25.143997576564619623049175376840488616895") containing:

1. The node's long-term static public key.
2. A digital signature of the ephemeral TLS public key produced by the long-term private key.

During connection establishment, the remote peer verifies that the certificate was signed by the ephemeral key, extracts the identity extension, verifies the signature using the static public key, and authenticates the peer ID against authorized identities.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final record	CertGenerator.KeyMaterial	Key material containing the ephemeral private key, the generated self-signed certificate, and the long-term identity public key.

Field Summary

Fields

Modifier and Type	Field	Description
static final String	BABEL2_TLS_OID	Custom X.509 extension OID used to carry the node's long-term identity public key and signature over the ephemeral TLS public key.

Method Summary

Modifier and Type	Method	Description
static CertGenerator.KeyMaterial	generate()	Generates an ephemeral key pair and self-signed certificate using a newly created identity key pair.
static CertGenerator.KeyMaterial	generate(KeyPair identityKeyPair)	Generates an ephemeral EC key pair and a self-signed certificate embedding the given long-term identity public key and its signature over the ephemeral key.
static KeyPair	generateIdentityKeyPair()	Generates a new long-term identity key pair defined by CryptoUtils.DEFAULT_KEY_ALGORITHM.
static String	getSignatureAlgorithm(String keyAlgorithm)	Resolves the appropriate signature algorithm corresponding to a private or public key algorithm.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

BABEL2_TLS_OID

public static final String BABEL2_TLS_OID

Custom X.509 extension OID used to carry the node's long-term identity public key and signature over the ephemeral TLS public key.

See Also:

• Constant Field Values

Method Details

generateIdentityKeyPair

public static KeyPair generateIdentityKeyPair()

Generates a new long-term identity key pair defined by CryptoUtils.DEFAULT_KEY_ALGORITHM.

Returns:

a newly generated KeyPair

Throws:

IllegalStateException - if CryptoUtils.DEFAULT_KEY_ALGORITHM is not supported by the environment

generate

public static CertGenerator.KeyMaterial generate()
                                          throws Exception

Generates an ephemeral key pair and self-signed certificate using a newly created identity key pair.

Returns:

the generated CertGenerator.KeyMaterial containing ephemeral private key and certificate

Throws:

Exception - if key generation or certificate building fails

generate

public static CertGenerator.KeyMaterial generate(KeyPair identityKeyPair)
                                          throws Exception

Generates an ephemeral EC key pair and a self-signed certificate embedding the given long-term identity public key and its signature over the ephemeral key.

Parameters:

identityKeyPair - the node's long-term static identity key pair

Returns:

the generated CertGenerator.KeyMaterial

Throws:

Exception - if cryptographic operations fail

getSignatureAlgorithm

public static String getSignatureAlgorithm(String keyAlgorithm)

Resolves the appropriate signature algorithm corresponding to a private or public key algorithm.

Parameters:

keyAlgorithm - the algorithm name of the key (e.g. "Ed25519", "EC", "RSA")

Returns:

the matching signature algorithm string