multipaz/org.multipaz.certifiedkeys/CertifiedKeyManager

CertifiedKeyManager

class CertifiedKeyManager(val secureArea: SecureArea, val storage: Storage = EphemeralStorage(), val numKeys: Int = 10, val createKeySettings: CreateKeySettings = CreateKeySettings(), val tableName: String = "CertifiedKeys", val replenishThresholdFraction: Double = 0.5, val refreshThresholdFraction: Double = 2.0 / 3.0, val certify: suspend (keys: List<KeyAttestation>) -> List<X509CertChain>)

Manager for a pool of keys generated locally from a SecureArea and certified by a certifying authority.

The manager maintains a pool of certified keys, automatically replenishing them when the number of fresh, valid keys drops below 50% of numKeys. It also handles key expiration, offline resilience, and cleanup of stale keys.

Constructors

CertifiedKeyManager

constructor(secureArea: SecureArea, storage: Storage = EphemeralStorage(), numKeys: Int = 10, createKeySettings: CreateKeySettings = CreateKeySettings(), tableName: String = "CertifiedKeys", replenishThresholdFraction: Double = 0.5, refreshThresholdFraction: Double = 2.0 / 3.0, certify: suspend (keys: List<KeyAttestation>) -> List<X509CertChain>)

Types

object Companion

Properties

val certify: suspend (keys: List<KeyAttestation>) -> List<X509CertChain>

a suspend function that certifies a batch of KeyAttestations and returns their X509CertChains.

createKeySettings

val createKeySettings: CreateKeySettings

settings passed when creating keys in the SecureArea.

val numKeys: Int

the target number of keys to maintain in the pool, defaults to 10.

refreshThresholdFraction

val refreshThresholdFraction: Double

certificate lifetime fraction after which a key is refreshed, defaults to 2/3.

replenishThresholdFraction

val replenishThresholdFraction: Double

pool threshold fraction below which replenishing is triggered, defaults to 0.5.

val secureArea: SecureArea

the SecureArea to generate and hold private keys.

val storage: Storage

the Storage used to persist certification metadata.

val tableName: String

the storage table name for persisting certified keys.

Functions

suspend fun clearKeys()

Clears all managed keys from SecureArea and storage.

suspend fun getKey(atTime: Instant = Clock.System.now()): CertifiedKey

Gets a certified key.

suspend fun markKeyAsUsed(alias: String, atTime: Instant = Clock.System.now())

Marks a key retrieved with getKey as used by its alias.

suspend fun markKeyAsUsed(certifiedKey: CertifiedKey, atTime: Instant = Clock.System.now())

suspend fun markKeyAsUsed(keyInfo: KeyInfo, atTime: Instant = Clock.System.now())

Marks a key retrieved with getKey as used.

suspend fun refreshKeys(atTime: Instant = Clock.System.now()): Int

Refreshes certified keys.