com.iizix.server.push.engine.transport.P256Keys

public final class P256Keys extends Object

The P-256 key material of Web Push, loaded, generated and encoded with java.base only: the raw forms the wire carries - the 65-byte uncompressed point 0x04 || X || Y of a public key and the 32-byte scalar of a private key, both base64url without padding - to and from the JDK's own ECPublicKey and ECPrivateKey.

No provider is named, deliberately. The former loaders in com.iizix.push.vapid.Utils hand BouncyCastle key specs to a KeyFactory obtained from the "BC" provider by name. Under Equinox the spec class from the com.iizix.core bundle and the provider's own copy come from different class loaders, and the factory answers "key spec not recognized" - measured in the Designer on 2026-09-08 with a key pair that is correct. The Designer's debug server is where the Push Notification acceptance test runs, so the transports cannot depend on that path. java.security.interfaces and java.security.spec live in java.base, one loader for the whole VM, and SunEC supplies EC key generation, ECDSA and ECDH there. This is the same reasoning VAPIDKeys.generateKeys() records for the generator.

Thread-safe: no state.

Author:: Christopher Mindus

Field Summary
Fields
Modifier and Type
Field
Description
static final String
CURVE
The curve name the JDK knows P-256 by.
Method Summary
Modifier and Type
Method
Description
static byte[]
encodePublicKey(ECPublicKey key)
Encodes a public key as the uncompressed point, each coordinate fixed at 32 bytes so a coordinate with leading zero bytes never encodes shorter.
static KeyPair
generateKeyPair(SecureRandom random)
Generates a P-256 key pair.
static ECPrivateKey
loadPrivateKey(byte[] scalar)
Loads a private key from its raw scalar.
static ECPrivateKey
loadPrivateKey(String base64url)
Loads a private key from its base64url form, the VPrivKey of an application.
static ECPublicKey
loadPublicKey(byte[] point)
Loads a public key from its raw uncompressed point.
static ECPublicKey
loadPublicKey(String base64url)
Loads a public key from its base64url form, the VPubKey of an application or the p256dh of a browser subscription.
static ECParameterSpec
p256()
Gets the P-256 domain parameters from the JDK.
Methods inherited from class Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details
- CURVE
  public static final String CURVE
  The curve name the JDK knows P-256 by. secp256r1 is prime256v1 is NIST P-256.
  See Also:
  Constant Field Values
Method Details
- p256
  public static ECParameterSpec p256() throws GeneralSecurityException
  Gets the P-256 domain parameters from the JDK.
  Returns:
  The parameters.
  Throws:
  GeneralSecurityException - If the JDK has no EC support, which cannot happen on a supported JVM.
- loadPrivateKey
  public static ECPrivateKey loadPrivateKey(byte[] scalar) throws GeneralSecurityException
  Loads a private key from its raw scalar.
  Parameters:
  scalar - The unsigned big-endian scalar, VAPIDKeys.PRIVATE_KEY_LENGTH bytes.
  Returns:
  The key.
  Throws:
  IllegalArgumentException - If the scalar has the wrong length.
  GeneralSecurityException - If the scalar is not a valid private key.
- loadPrivateKey
  public static ECPrivateKey loadPrivateKey(String base64url) throws GeneralSecurityException
  Loads a private key from its base64url form, the VPrivKey of an application.
  Parameters:
  base64url - The scalar, base64url with or without padding.
  Returns:
  The key.
  Throws:
  IllegalArgumentException - If the text is not base64url or the scalar has the wrong length.
  GeneralSecurityException - If the scalar is not a valid private key.
- loadPublicKey
  public static ECPublicKey loadPublicKey(byte[] point) throws GeneralSecurityException
  Loads a public key from its raw uncompressed point.
  Parameters:
  point - The point 0x04 || X || Y, VAPIDKeys.PUBLIC_KEY_LENGTH bytes.
  Returns:
  The key.
  Throws:
  IllegalArgumentException - If the point has the wrong length or is not uncompressed.
  GeneralSecurityException - If the point is not on the curve.
- loadPublicKey
  public static ECPublicKey loadPublicKey(String base64url) throws GeneralSecurityException
  Loads a public key from its base64url form, the VPubKey of an application or the p256dh of a browser subscription.
  Parameters:
  base64url - The point, base64url with or without padding.
  Returns:
  The key.
  Throws:
  IllegalArgumentException - If the text is not base64url or the point is malformed.
  GeneralSecurityException - If the point is not on the curve.
- encodePublicKey
  public static byte[] encodePublicKey(ECPublicKey key)
  Encodes a public key as the uncompressed point, each coordinate fixed at 32 bytes so a coordinate with leading zero bytes never encodes shorter.
  Parameters:
  key - The key.
  Returns:
  0x04 || X || Y, VAPIDKeys.PUBLIC_KEY_LENGTH bytes.
- generateKeyPair
  public static KeyPair generateKeyPair(SecureRandom random) throws GeneralSecurityException
  Generates a P-256 key pair.
  Parameters:
  random - The random source, null for the JDK default.
  Returns:
  The pair, JDK keys.
  Throws:
  GeneralSecurityException - If the JDK cannot generate it.

Class P256Keys

Field Summary

Method Summary

Methods inherited from class Object

Field Details

CURVE

Method Details

p256

loadPrivateKey

loadPrivateKey

loadPublicKey

loadPublicKey

encodePublicKey

generateKeyPair