Client API. The Codename One framework your app is built on: this runs on the device, not in a backend.

public final class VaultSigner

Object
VaultSigner

ImplementsSigner

A Signer whose mnemonic is sealed in a Vault, so it is at rest only as ciphertext under the user’s password, and on a remembered device under the platform key store (which on iOS and Android can require biometrics to release). It signs only while the vault is unlocked: the first signature after an unlock reads the mnemonic and derives the seed, and the seed is wiped as soon as a call finds the vault locked again.

Vault vault = Vault.named("wallet");
char[] password = "what the user typed".toCharArray();
vault.unlockWithPassword(password).get();
VaultSigner.store(vault, "main", Mnemonic.generate(256), "").get();
Wallet wallet = new Wallet(new VaultSigner(vault, "main"));

Client only: the backend keeps keys in a key service, not a user vault. A mnemonic passes through a String on its way to the seed derivation, which the garbage collector, not this class, eventually clears.

Constructors

public VaultSigner(Vault vault, String name) A signer over the mnemonic stored in a vault under a name by store.

Methods

`public static` `AsyncResource<Boolean> store(Vault vault, String name, String mnemonic, String passphrase)`	Seals a mnemonic and its BIP-39 passphrase into an unlocked vault under a name.
`public` `AsyncResource<char[]> revealMnemonic()`	The stored mnemonic, for the user to write down.
`public void forget()`	Wipes the derived seed now; the next signature reads it from the vault again.
`public int getMasterFingerprint()`	The fingerprint of the BIP-32 master key, which PSBTs record to say whose keys they want.
`public byte[] getSecp256k1PublicKey(DerivationPath path)`	The compressed 33-byte secp256k1 public key at a BIP-32 path.
`public` `Secp256k1.EcdsaSignature signSecp256k1(DerivationPath path, byte[] hash32)`	An ECDSA signature over a 32-byte hash with the secp256k1 key at a path: RFC 6979 deterministic, low-S, with its recovery id.
`public byte[] signTaproot(DerivationPath path, byte[] sighash, byte[] merkleRoot)`	A BIP-340 signature over a 32-byte Taproot sighash with the secp256k1 key at a path, tweaked by BIP-341 for `merkleRoot` (`null` for a key-path-only output).
`public byte[] getEd25519PublicKey(DerivationPath path)`	The 32-byte Ed25519 public key at a SLIP-10 path; every index is hardened.
`public byte[] signEd25519(DerivationPath path, byte[] message)`	An Ed25519 signature over a message with the SLIP-10 key at a path.

Inherited methods

From Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait, clone, finalize

Constructor details

VaultSigner

public VaultSigner(Vault vault, String name)

A signer over the mnemonic stored in a vault under a name by store.

Method details

store

public static AsyncResource<Boolean> store(Vault vault, String name, String mnemonic, String passphrase)

Seals a mnemonic and its BIP-39 passphrase into an unlocked vault under a name.

Throws

IllegalArgumentException: for a mnemonic whose words or checksum are wrong

revealMnemonic

public AsyncResource<char[]> revealMnemonic()

The stored mnemonic, for the user to write down. The caller should clear the array.

forget

public void forget()

Wipes the derived seed now; the next signature reads it from the vault again.

getMasterFingerprint

public int getMasterFingerprint()

The fingerprint of the BIP-32 master key, which PSBTs record to say whose keys they want.

getSecp256k1PublicKey

public byte[] getSecp256k1PublicKey(DerivationPath path)

The compressed 33-byte secp256k1 public key at a BIP-32 path.

signSecp256k1

public Secp256k1.EcdsaSignature signSecp256k1(DerivationPath path, byte[] hash32)

An ECDSA signature over a 32-byte hash with the secp256k1 key at a path: RFC 6979 deterministic, low-S, with its recovery id.

signTaproot

public byte[] signTaproot(DerivationPath path, byte[] sighash, byte[] merkleRoot)

A BIP-340 signature over a 32-byte Taproot sighash with the secp256k1 key at a path, tweaked by BIP-341 for merkleRoot (null for a key-path-only output).

getEd25519PublicKey

public byte[] getEd25519PublicKey(DerivationPath path)

The 32-byte Ed25519 public key at a SLIP-10 path; every index is hardened.

signEd25519

public byte[] signEd25519(DerivationPath path, byte[] message)

An Ed25519 signature over a message with the SLIP-10 key at a path.