To get full access to the Kademi Hub existing customers can login here, or new customers can register here.
Performs a Diffie-Hellman key exchange: generates a local key pair, combines it with a peer's public key to agree a shared secret, and exposes the public key, generator and prime so the peer can complete the exchange. Created by CryptoImpl.createDiffieHellman, either with a randomly generated 1024-bit prime or with a prime supplied by the caller. A new instance holds one key pair for the lifetime of a single exchange; it is not reused across exchanges.
Properties
| Property | Returns | Description |
|---|---|---|
| generator | byte[] | The DH generator (g) from the local key pair's parameters, as raw bytes. The local key pair must already have been generated with genDHKeyPair. |
| prime | byte[] | The DH prime used to generate this instance's key pair, as raw bytes. Null if this instance was created with the no-argument constructor, which lets the JDK choose the prime internally rather than supplying one explicitly. |
| publicKey | byte[] | This instance's local DH public key, as raw encoded bytes, for sending to the peer. The local key pair must already have been generated with genDHKeyPair. |
Methods
genDHKeyPair() · agreeSecret(PublicKey pbk_peer, boolean lastPhase) · agreeSecret(Object pbk_peer, String encoding, boolean lastPhase) · agreeSecretKey(PublicKey pbk_peer, boolean lastPhase) · getGenerator() · getGenerator(String encoding) · getPublicKey() · getPublicKey(String encoding) · getPrime() · getPrime(String encoding)
genDHKeyPair()
Returns: KeyPair
Generates this instance's local Diffie-Hellman key pair on first call, and returns the same key pair on every subsequent call.
agreeSecret(PublicKey pbk_peer, boolean lastPhase)
Returns: byte[]
Computes the Diffie-Hellman shared secret from the peer's public key and this instance's local private key.
| Parameter | Description |
|---|---|
pbk_peer | the peer's public key |
lastPhase | true if this is the final phase of the key agreement, which for a two-party exchange is always the case |
agreeSecret(Object pbk_peer, String encoding, boolean lastPhase)
Returns: byte[]
Computes the Diffie-Hellman shared secret from the peer's public key and this instance's local private key, the same as agreeSecret(PublicKey, boolean), but accepts the peer's public key in an encoded form rather than as a PublicKey instance.
| Parameter | Description |
|---|---|
pbk_peer | the peer's public key; accepts a PublicKey instance, or a byte array or String encoding the raw public value according to encoding |
encoding | the encoding of pbk_peer when it is not already a PublicKey; base64 or binary |
lastPhase | true if this is the final phase of the key agreement, which for a two-party exchange is always the case |
agreeSecretKey(PublicKey pbk_peer, boolean lastPhase)
Returns: SecretKey
Agrees a Diffie-Hellman shared secret with the peer, the same as agreeSecret, then derives an AES key from it by hashing the secret with SHA-256 and truncating to the AES key size.
| Parameter | Description |
|---|---|
pbk_peer | the peer's public key |
lastPhase | true if this is the final phase of the key agreement, which for a two-party exchange is always the case |
getGenerator()
Returns: byte[]
The DH generator (g) from the local key pair's parameters, as raw bytes. The local key pair must already have been generated with genDHKeyPair.
getGenerator(String encoding)
Returns: Object
The DH generator (g) from the local key pair's parameters, the same as getGenerator, encoded as requested.
| Parameter | Description |
|---|---|
encoding | base64 to get a base64-encoded string, or binary to get the raw bytes |
getPublicKey()
Returns: byte[]
This instance's local DH public key, as raw encoded bytes, for sending to the peer. The local key pair must already have been generated with genDHKeyPair.
getPublicKey(String encoding)
Returns: Object
This instance's local DH public key, the same as getPublicKey, encoded as requested.
| Parameter | Description |
|---|---|
encoding | base64 to get a base64-encoded string, or binary to get the raw bytes |
getPrime()
Returns: byte[]
The DH prime used to generate this instance's key pair, as raw bytes. Null if this instance was created with the no-argument constructor, which lets the JDK choose the prime internally rather than supplying one explicitly.
getPrime(String encoding)
Returns: Object
The DH prime used to generate this instance's key pair, the same as getPrime, encoded as requested.
| Parameter | Description |
|---|---|
encoding | base64 to get a base64-encoded string, or binary to get the raw bytes |
© 2025 Kademi Ltd