Package io.github.mahmoudimus.quic.token

Class TokenKey

java.lang.Object
io.github.mahmoudimus.quic.token.TokenKey
public final class TokenKey extends Object
The server's secret for sealing address validation tokens, as quinn does it: an HKDF-SHA256 pseudorandom key from a master key, from which each token derives a one-time AES-256-GCM key using its random nonce as the HKDF info. Since every key seals one token, the AEAD nonce is zero.

Immutable and thread-safe: each operation uses its own Cipher.

  • Field Details

    • TAG_LENGTH

      public static final int TAG_LENGTH
      The AES-GCM tag length, in bytes.
      See Also:

  • Constructor Details

    • TokenKey

      public TokenKey(byte[] masterKey)
      A key from a master secret.
      Parameters:
      masterKey - at least 32 random bytes; endpoints that must accept each other's tokens share it
      Throws:
      IllegalArgumentException - if the key is shorter than 32 bytes

  • Method Details

    • random

      public static TokenKey random(SecureRandom random)
      A key from a fresh random master secret of 64 bytes.
      Parameters:
      random - the source of randomness
      Returns:
      the key