KeyManagementService
Keywords: net.corda.core.node.services.KeyManagementService interface
Date: 2023-09-18

net.corda.core.node.services

## Interface KeyManagementService

-     @DoNotImplement
      public KeyManagementService

  The KMS is responsible for storing and using private keys to sign things. An implementation of this may, for example, call out to a hardware security module that enforces various auditing and frequency-of-use requirements.

- - ### Constructor Detail

    - #### KeyManagementService

          public KeyManagementService()

  - ### Method Detail

    - #### getKeys

          @NotNull
          java.util.Set<java.security.PublicKey> getKeys()

      Returns a snapshot of the current signing PublicKeys. For each of these keys a PrivateKey is available, that can be used later for signing.

      See Also:
        PublicKey, PrivateKey

    - #### freshKey

          @Suspendable
           @NotNull
          java.security.PublicKey freshKey()

      Generates a new random KeyPair and adds it to the internal key storage. Returns the public part of the pair.

      See Also:
        KeyPair

    - #### freshKey

          @Suspendable
           @NotNull
          java.security.PublicKey freshKey(@NotNull
                                                                  java.util.UUID externalId)

      Generates a new random KeyPair and adds it to the internal key storage. Associates the public key to an external ID. Returns the public key part of the pair.

      See Also:
        KeyPair

    - #### freshKeyAndCert

          @Suspendable
           @NotNull
          PartyAndCertificate freshKeyAndCert(@NotNull
                                                                     PartyAndCertificate identity,
                                                                     boolean revocationEnabled)

      Generates a new random KeyPair, adds it to the internal key storage, then generates a corresponding X509Certificate and adds it to the identity service. Associates the public key to an external ID. Returns the public part of the pair.

      Parameters:
        `identity` - identity to generate a key and certificate for. Must be an identity this node has CA privileges for.
        `revocationEnabled` - whether to check revocation status of certificates in the certificate path.
      Returns:
        X.509 certificate and path to the trust root.
      See Also:
        KeyPair, X509Certificate

    - #### freshKeyAndCert

          @Suspendable
           @NotNull
          PartyAndCertificate freshKeyAndCert(@NotNull
                                                                     PartyAndCertificate identity,
                                                                     boolean revocationEnabled,
                                                                     @NotNull
                                                                     java.util.UUID externalId)

      Generates a new random KeyPair, adds it to the internal key storage, then generates a corresponding X509Certificate and adds it to the identity service.

      Parameters:
        `identity` - identity to generate a key and certificate for. Must be an identity this node has CA privileges for.
        `revocationEnabled` - whether to check revocation status of certificates in the certificate path.
        `externalId` - ID to associate the newly created PublicKey with.
      Returns:
        X.509 certificate and path to the trust root.
      See Also:
        KeyPair, X509Certificate

    - #### filterMyKeys

          @NotNull
          java.lang.Iterable<java.security.PublicKey> filterMyKeys(@NotNull
                                                                            java.lang.Iterable<? extends java.security.PublicKey> candidateKeys)

      Filter some keys down to the set that this node owns (has private keys for).

      Parameters:
        `candidateKeys` - keys which this node may own.

    - #### sign

          @Suspendable
           @NotNull
          net.corda.core.crypto.DigitalSignature.WithKey sign(@NotNull
                                                                                     kotlin.Array[] bytes,
                                                                                     @NotNull
                                                                                     java.security.PublicKey publicKey)

      Using the provided signing PublicKey internally looks up the matching PrivateKey and signs the data.

      Parameters:
        `bytes` - The data to sign over using the chosen key.
        `publicKey` - The PublicKey partner to an internally held PrivateKey, either derived from the node's primary identity,or previously generated via the `freshKey` method.If the PublicKey is actually a `class CompositeKey` the first leaf signing key hosted by the node is used.
      Throws:
        `IllegalArgumentException` - if the input key is not a member of `keys`.
      See Also:
        PublicKey, PrivateKey

    - #### sign

          @Suspendable
           @NotNull
          TransactionSignature sign(@NotNull
                                                           SignableData signableData,
                                                           @NotNull
                                                           java.security.PublicKey publicKey)

      Using the provided signing PublicKey internally looks up the matching PrivateKey and signs the `class SignableData`.

      Parameters:
        `signableData` - a wrapper over transaction id (Merkle root) and signature metadata.
        `publicKey` - The PublicKey partner to an internally held PrivateKey, either derived from the node's primary identity,or previously generated via the `freshKey` method.If the PublicKey is actually a `class CompositeKey` the first leaf signing key hosted by the node is used.
      Throws:
        `IllegalArgumentException` - if the input key is not a member of `keys`.
      See Also:
        PublicKey, PrivateKey, `class SignableData`