Class VaultSigner

java.lang.Object
com.codename1.crypto.wallet.VaultSigner
All Implemented Interfaces:
Signer
public final class VaultSigner extends Object implements Signer

A Signer whose mnemonic is sealed in a Vault, so it is at rest only as ciphertext under the user's password, and on a remembered device under the platform key store (which on iOS and Android can require biometrics to release). It signs only while the vault is unlocked: the first signature after an unlock reads the mnemonic and derives the seed, and the seed is wiped as soon as a call finds the vault locked again.

Vault vault = Vault.named("wallet");
char[] password = "what the user typed".toCharArray();
vault.unlockWithPassword(password).get();
VaultSigner.store(vault, "main", Mnemonic.generate(256), "").get();
Wallet wallet = new Wallet(new VaultSigner(vault, "main"));

Client only: the backend keeps keys in a key service, not a user vault. A mnemonic passes through a String on its way to the seed derivation, which the garbage collector, not this class, eventually clears.

  • Constructor Details

  • Method Details

    • store

      public static AsyncResource<Boolean> store(Vault vault, String name, String mnemonic, String passphrase)

      Seals a mnemonic and its BIP-39 passphrase into an unlocked vault under a name.

      Throws
      • IllegalArgumentException: for a mnemonic whose words or checksum are wrong

    • revealMnemonic

      public AsyncResource<char[]> revealMnemonic()
      The stored mnemonic, for the user to write down. The caller should clear the array.

    • forget

      public void forget()
      Wipes the derived seed now; the next signature reads it from the vault again.

    • getMasterFingerprint

      public int getMasterFingerprint()
      Description copied from interface: Signer
      The fingerprint of the BIP-32 master key, which PSBTs record to say whose keys they want.
      Specified by:
      getMasterFingerprint in interface Signer

    • getSecp256k1PublicKey

      public byte[] getSecp256k1PublicKey(DerivationPath path)
      Description copied from interface: Signer
      The compressed 33-byte secp256k1 public key at a BIP-32 path.
      Specified by:
      getSecp256k1PublicKey in interface Signer

    • signSecp256k1

      public Secp256k1.EcdsaSignature signSecp256k1(DerivationPath path, byte[] hash32)
      Description copied from interface: Signer
      An ECDSA signature over a 32-byte hash with the secp256k1 key at a path: RFC 6979 deterministic, low-S, with its recovery id.
      Specified by:
      signSecp256k1 in interface Signer

    • signTaproot

      public byte[] signTaproot(DerivationPath path, byte[] sighash, byte[] merkleRoot)
      Description copied from interface: Signer
      A BIP-340 signature over a 32-byte Taproot sighash with the secp256k1 key at a path, tweaked by BIP-341 for merkleRoot (null for a key-path-only output).
      Specified by:
      signTaproot in interface Signer

    • getEd25519PublicKey

      public byte[] getEd25519PublicKey(DerivationPath path)
      Description copied from interface: Signer
      The 32-byte Ed25519 public key at a SLIP-10 path; every index is hardened.
      Specified by:
      getEd25519PublicKey in interface Signer

    • signEd25519

      public byte[] signEd25519(DerivationPath path, byte[] message)
      Description copied from interface: Signer
      An Ed25519 signature over a message with the SLIP-10 key at a path.
      Specified by:
      signEd25519 in interface Signer