Package com.privatechain.crypto

Class KeyPairGenerator

java.lang.Object
com.privatechain.crypto.KeyPairGenerator
public final class KeyPairGenerator extends Object
Factory for generating and reconstructing elliptic-curve key pairs on the secp256k1 curve.

All random number generation uses SecureRandom sourced from the operating-system entropy pool, as mandated by NFR-SEC-05. The class is a utility and cannot be instantiated.

Usage


 // Generate a fresh key pair
 ECKeyPair fresh = KeyPairGenerator.generateECKeyPair();

 // Reconstruct from a stored private key
 ECKeyPair restored = KeyPairGenerator.fromPrivateKeyHex(storedHex);
Since:
1.0.0
See Also:

  • Method Details

    • generateECKeyPair

      public static ECKeyPair generateECKeyPair()
      Generates a fresh secp256k1 EC key pair using a SecureRandom entropy source.

      The returned ECKeyPair contains both the private and public key. Callers must protect the private key and never expose it in logs or serialized form without encryption (NFR-SEC-01).

      Returns:
      a new, cryptographically random ECKeyPair
      Throws:
      IllegalStateException - if the JCA provider is missing (should not occur in practice)

    • fromPrivateKeyHex

      public static ECKeyPair fromPrivateKeyHex(String privateKeyHex)
      Reconstructs an ECKeyPair from a hex-encoded PKCS#8 private key.

      The public key is re-derived from the private scalar via the secp256k1 generator point, so only the private key bytes are required as input.

      Security note: callers must ensure the privateKeyHex string is handled securely (e.g., read from an encrypted keystore, not hard-coded).

      Parameters:
      privateKeyHex - lowercase hex-encoded PKCS#8 private key (non-null, non-blank)
      Returns:
      the reconstructed ECKeyPair
      Throws:
      NullPointerException - if privateKeyHex is null
      IllegalArgumentException - if privateKeyHex is blank or not valid hex
      IllegalStateException - if the BouncyCastle provider fails

    • fromRawPrivateScalar

      public static ECKeyPair fromRawPrivateScalar(String rawPrivateScalarHex)
      Reconstructs an ECKeyPair from a raw 32-byte private scalar (big-integer, big-endian).

      This overload is useful when working with wallets that store the raw private scalar rather than the full PKCS#8 structure (e.g., Bitcoin-style WIF / raw hex).

      Parameters:
      rawPrivateScalarHex - 64-character (32-byte) lowercase hex private scalar (non-null, non-blank)
      Returns:
      the reconstructed ECKeyPair
      Throws:
      NullPointerException - if rawPrivateScalarHex is null
      IllegalArgumentException - if rawPrivateScalarHex is blank, not valid hex, or not a valid secp256k1 scalar
      IllegalStateException - if the BouncyCastle provider fails