This comprehensive guide covers secure key pair generation, storage, and management practices in Java for various cryptographic algorithms.

Project Setup and Dependencies

Maven Configuration

<!-- pom.xml --> <properties> <bouncycastle.version>1.76</bouncycastle.version> </properties> <dependencies> <!-- Bouncy Castle Provider for additional algorithms --> <dependency> <groupId>org.bouncycastle</groupId> <artifactId>bcprov-jdk18on</artifactId> <version>${bouncycastle.version}</version> </dependency> <!-- Bouncy Castle PKIX for X.509 certificate handling --> <dependency> <groupId>org.bouncycastle</groupId> <artifactId>bcpkix-jdk18on</artifactId> <version>${bouncycastle.version}</version> </dependency> <!-- Logging --> <dependency> <groupId>org.slf4j</groupId> <artifactId>slf4j-api</artifactId> <version>2.0.9</version> </dependency> <dependency> <groupId>org.slf4j</groupId> <artifactId>slf4j-simple</artifactId> <version>2.0.9</version> </dependency> </dependencies>

Core KeyPair Generation Service

Secure KeyPair Generator

package com.security.crypto; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import javax.crypto.KeyGenerator; import java.security.*; import java.security.spec.ECGenParameterSpec; import java.security.spec.RSAKeyGenParameterSpec; import java.util.HashMap; import java.util.Map; public class SecureKeyPairGenerator { private static final Logger logger = LoggerFactory.getLogger(SecureKeyPairGenerator.class); // Secure random instance - reuse for better performance private static final SecureRandom SECURE_RANDOM = new SecureRandom(); static { // Initialize security providers Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider()); // Seed the secure random seedSecureRandom(); } /** * Seed the secure random with additional entropy */ private static void seedSecureRandom() { try { // Add system entropy byte[] seed = new byte[32]; new SecureRandom().nextBytes(seed); // System random for initial seed SECURE_RANDOM.setSeed(seed); // Add thread timing entropy SECURE_RANDOM.setSeed(System.nanoTime()); SECURE_RANDOM.setSeed(Thread.currentThread().getId()); logger.info("SecureRandom seeded successfully"); } catch (Exception e) { logger.warn("Failed to seed SecureRandom: {}", e.getMessage()); } } /** * Generate RSA key pair with secure parameters */ public KeyPair generateRSAKeyPair(int keySize) throws GeneralSecurityException { validateRSAKeySize(keySize); try { KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA", "BC"); // Use secure parameters for RSA key generation RSAKeyGenParameterSpec spec = new RSAKeyGenParameterSpec( keySize, RSAKeyGenParameterSpec.F4 // 65537 - standard public exponent ); keyGen.initialize(spec, SECURE_RANDOM); KeyPair keyPair = keyGen.generateKeyPair(); logger.info("Generated RSA-{} key pair successfully", keySize); logKeyStrength(keyPair.getPublic()); return keyPair; } catch (GeneralSecurityException e) { logger.error("Failed to generate RSA-{} key pair: {}", keySize, e.getMessage()); throw e; } } /** * Generate Elliptic Curve key pair */ public KeyPair generateECKeyPair(String curveName) throws GeneralSecurityException { validateECCurveName(curveName); try { KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC", "BC"); // Use named curve for better interoperability ECGenParameterSpec ecSpec = new ECGenParameterSpec(curveName); keyGen.initialize(ecSpec, SECURE_RANDOM); KeyPair keyPair = keyGen.generateKeyPair(); logger.info("Generated EC key pair with curve {} successfully", curveName); logKeyStrength(keyPair.getPublic()); return keyPair; } catch (GeneralSecurityException e) { logger.error("Failed to generate EC key pair with curve {}: {}", curveName, e.getMessage()); throw e; } } /** * Generate DSA key pair */ public KeyPair generateDSAKeyPair(int keySize) throws GeneralSecurityException { validateDSAKeySize(keySize); try { KeyPairGenerator keyGen = KeyPairGenerator.getInstance("DSA", "BC"); keyGen.initialize(keySize, SECURE_RANDOM); KeyPair keyPair = keyGen.generateKeyPair(); logger.info("Generated DSA-{} key pair successfully", keySize); logKeyStrength(keyPair.getPublic()); return keyPair; } catch (GeneralSecurityException e) { logger.error("Failed to generate DSA-{} key pair: {}", keySize, e.getMessage()); throw e; } } /** * Generate EdDSA key pair (Ed25519/Ed448) */ public KeyPair generateEdDSAKeyPair(String algorithm) throws GeneralSecurityException { if (!algorithm.equalsIgnoreCase("Ed25519") && !algorithm.equalsIgnoreCase("Ed448")) { throw new IllegalArgumentException("Unsupported EdDSA algorithm: " + algorithm); } try { KeyPairGenerator keyGen = KeyPairGenerator.getInstance(algorithm, "BC"); keyGen.initialize(null, SECURE_RANDOM); // EdDSA doesn't need explicit parameters KeyPair keyPair = keyGen.generateKeyPair(); logger.info("Generated {} key pair successfully", algorithm); logKeyStrength(keyPair.getPublic()); return keyPair; } catch (GeneralSecurityException e) { logger.error("Failed to generate {} key pair: {}", algorithm, e.getMessage()); throw e; } } /** * Validate RSA key size */ private void validateRSAKeySize(int keySize) { if (keySize < 2048) { throw new IllegalArgumentException( "RSA key size must be at least 2048 bits for security. Provided: " + keySize); } // Check if key size is a power of two for optimal performance if ((keySize & (keySize - 1)) != 0) { logger.warn("RSA key size {} is not a power of two, which may impact performance", keySize); } // NIST recommendations if (keySize < 3072) { logger.warn("RSA key size {} is below NIST recommended 3072 bits for new systems", keySize); } } /** * Validate EC curve name */ private void validateECCurveName(String curveName) { Map<String, Integer> standardCurves = new HashMap<>(); standardCurves.put("secp256r1", 256); // NIST P-256 standardCurves.put("secp384r1", 384); // NIST P-384 standardCurves.put("secp521r1", 521); // NIST P-521 standardCurves.put("brainpoolP256r1", 256); standardCurves.put("brainpoolP384r1", 384); standardCurves.put("brainpoolP512r1", 512); if (!standardCurves.containsKey(curveName)) { throw new IllegalArgumentException( "Unsupported EC curve: " + curveName + ". Supported: " + standardCurves.keySet()); } logger.debug("Using EC curve: {} ({} bits security)", curveName, standardCurves.get(curveName)); } /** * Validate DSA key size */ private void validateDSAKeySize(int keySize) { if (keySize < 2048) { throw new IllegalArgumentException( "DSA key size must be at least 2048 bits for security. Provided: " + keySize); } // DSA key sizes should be multiples of 64 if (keySize % 64 != 0) { throw new IllegalArgumentException("DSA key size must be a multiple of 64. Provided: " + keySize); } } /** * Log key strength information */ private void logKeyStrength(PublicKey publicKey) { String algorithm = publicKey.getAlgorithm(); int keySize = getKeySize(publicKey); String strength; if (keySize >= 3072 || (algorithm.equals("EC") && keySize >= 256)) { strength = "STRONG"; } else if (keySize >= 2048) { strength = "ADEQUATE"; } else { strength = "WEAK"; } logger.info("Key strength: {} - {}-bit {}", strength, keySize, algorithm); } /** * Estimate key size from public key */ private int getKeySize(PublicKey publicKey) { String algorithm = publicKey.getAlgorithm(); if (algorithm.equals("RSA") || algorithm.equals("DSA")) { // For RSA and DSA, key size is explicit in the encoding return publicKey.getEncoded().length * 8; // Rough estimate } else if (algorithm.equals("EC")) { // For EC, we need to parse the curve parameters java.security.interfaces.ECPublicKey ecKey = (java.security.interfaces.ECPublicKey) publicKey; return ecKey.getParams().getCurve().getField().getFieldSize(); } else if (algorithm.equals("Ed25519")) { return 255; } else if (algorithm.equals("Ed448")) { return 448; } return -1; // Unknown } /** * Get secure random instance */ public SecureRandom getSecureRandom() { return SECURE_RANDOM; } }

Key Storage and Management

Secure Key Storage Service

package com.security.crypto; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import javax.crypto.*; import javax.crypto.spec.GCMParameterSpec; import javax.crypto.spec.PBEKeySpec; import javax.crypto.spec.SecretKeySpec; import java.io.*; import java.nio.file.*; import java.security.*; import java.security.spec.PKCS8EncodedKeySpec; import java.security.spec.X509EncodedKeySpec; import java.util.Base64; public class SecureKeyStorage { private static final Logger logger = LoggerFactory.getLogger(SecureKeyStorage.class); // Encryption parameters private static final String KEY_ENCRYPTION_ALGORITHM = "AES/GCM/NoPadding"; private static final int GCM_TAG_LENGTH = 128; // bits private static final int GCM_IV_LENGTH = 12; // bytes private static final int SALT_LENGTH = 32; // bytes private static final int ITERATION_COUNT = 210000; // OWASP recommended /** * Store key pair securely to files */ public void storeKeyPair(KeyPair keyPair, String basePath, char[] password) throws GeneralSecurityException, IOException { validateStoragePath(basePath); // Create directory if it doesn't exist Path directory = Paths.get(basePath).getParent(); if (directory != null) { Files.createDirectories(directory); } // Store private key encrypted String privateKeyPath = basePath + ".private"; storePrivateKey(keyPair.getPrivate(), privateKeyPath, password); // Store public key in plain text (it's public) String publicKeyPath = basePath + ".public"; storePublicKey(keyPair.getPublic(), publicKeyPath); logger.info("Key pair stored successfully: {}", basePath); } /** * Store encrypted private key */ private void storePrivateKey(PrivateKey privateKey, String filePath, char[] password) throws GeneralSecurityException, IOException { // Encrypt private key byte[] encryptedKey = encryptKey(privateKey.getEncoded(), password); // Write to file with secure permissions Path path = Paths.get(filePath); Files.write(path, encryptedKey, StandardOpenOption.CREATE, StandardOpenOption.TRUNCATE_EXISTING); // Set secure file permissions (Unix-like systems) try { path.toFile().setReadable(false, false); // No global read path.toFile().setReadable(true, true); // Owner read only path.toFile().setWritable(true, true); // Owner write only } catch (SecurityException e) { logger.warn("Could not set secure file permissions: {}", e.getMessage()); } logger.debug("Private key stored encrypted: {}", filePath); } /** * Store public key */ private void storePublicKey(PublicKey publicKey, String filePath) throws IOException { // Public key doesn't need encryption byte[] publicKeyBytes = publicKey.getEncoded(); // Write to file Files.write(Paths.get(filePath), publicKeyBytes, StandardOpenOption.CREATE, StandardOpenOption.TRUNCATE_EXISTING); logger.debug("Public key stored: {}", filePath); } /** * Load key pair from storage */ public KeyPair loadKeyPair(String basePath, char[] password, String keyAlgorithm) throws GeneralSecurityException, IOException { validateStoragePath(basePath); // Load private key String privateKeyPath = basePath + ".private"; PrivateKey privateKey = loadPrivateKey(privateKeyPath, password, keyAlgorithm); // Load public key String publicKeyPath = basePath + ".public"; PublicKey publicKey = loadPublicKey(publicKeyPath, keyAlgorithm); KeyPair keyPair = new KeyPair(publicKey, privateKey); logger.info("Key pair loaded successfully: {}", basePath); return keyPair; } /** * Load and decrypt private key */ private PrivateKey loadPrivateKey(String filePath, char[] password, String keyAlgorithm) throws GeneralSecurityException, IOException { // Read encrypted key byte[] encryptedKey = Files.readAllBytes(Paths.get(filePath)); // Decrypt private key byte[] privateKeyBytes = decryptKey(encryptedKey, password); // Reconstruct private key KeyFactory keyFactory = KeyFactory.getInstance(keyAlgorithm, "BC"); PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(privateKeyBytes); return keyFactory.generatePrivate(keySpec); } /** * Load public key */ private PublicKey loadPublicKey(String filePath, String keyAlgorithm) throws GeneralSecurityException, IOException { byte[] publicKeyBytes = Files.readAllBytes(Paths.get(filePath)); KeyFactory keyFactory = KeyFactory.getInstance(keyAlgorithm, "BC"); X509EncodedKeySpec keySpec = new X509EncodedKeySpec(publicKeyBytes); return keyFactory.generatePublic(keySpec); } /** * Encrypt key using password-based encryption */ private byte[] encryptKey(byte[] keyData, char[] password) throws GeneralSecurityException { // Generate salt byte[] salt = new byte[SALT_LENGTH]; new SecureRandom().nextBytes(salt); // Generate IV for GCM byte[] iv = new byte[GCM_IV_LENGTH]; new SecureRandom().nextBytes(iv); // Derive encryption key from password SecretKey secretKey = deriveKey(password, salt); // Initialize cipher Cipher cipher = Cipher.getInstance(KEY_ENCRYPTION_ALGORITHM, "BC"); GCMParameterSpec gcmSpec = new GCMParameterSpec(GCM_TAG_LENGTH, iv); cipher.init(Cipher.ENCRYPT_MODE, secretKey, gcmSpec); // Encrypt key data byte[] encryptedKey = cipher.doFinal(keyData); // Combine salt + iv + encrypted data byte[] result = new byte[salt.length + iv.length + encryptedKey.length]; System.arraycopy(salt, 0, result, 0, salt.length); System.arraycopy(iv, 0, result, salt.length, iv.length); System.arraycopy(encryptedKey, 0, result, salt.length + iv.length, encryptedKey.length); // Clear sensitive data from memory Arrays.fill(salt, (byte) 0); Arrays.fill(iv, (byte) 0); return result; } /** * Decrypt key using password-based encryption */ private byte[] decryptKey(byte[] encryptedData, char[] password) throws GeneralSecurityException { // Extract components byte[] salt = new byte[SALT_LENGTH]; byte[] iv = new byte[GCM_IV_LENGTH]; byte[] encryptedKey = new byte[encryptedData.length - SALT_LENGTH - GCM_IV_LENGTH]; System.arraycopy(encryptedData, 0, salt, 0, SALT_LENGTH); System.arraycopy(encryptedData, SALT_LENGTH, iv, 0, GCM_IV_LENGTH); System.arraycopy(encryptedData, SALT_LENGTH + GCM_IV_LENGTH, encryptedKey, 0, encryptedKey.length); // Derive decryption key SecretKey secretKey = deriveKey(password, salt); // Initialize cipher Cipher cipher = Cipher.getInstance(KEY_ENCRYPTION_ALGORITHM, "BC"); GCMParameterSpec gcmSpec = new GCMParameterSpec(GCM_TAG_LENGTH, iv); cipher.init(Cipher.DECRYPT_MODE, secretKey, gcmSpec); // Decrypt key data byte[] decryptedKey = cipher.doFinal(encryptedKey); // Clear sensitive data from memory Arrays.fill(salt, (byte) 0); Arrays.fill(iv, (byte) 0); return decryptedKey; } /** * Derive encryption key from password using PBKDF2 */ private SecretKey deriveKey(char[] password, byte[] salt) throws GeneralSecurityException { PBEKeySpec keySpec = new PBEKeySpec(password, salt, ITERATION_COUNT, 256); SecretKeyFactory keyFactory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256", "BC"); byte[] keyBytes = keyFactory.generateSecret(keySpec).getEncoded(); SecretKey secretKey = new SecretKeySpec(keyBytes, "AES"); // Clear sensitive data keySpec.clearPassword(); Arrays.fill(keyBytes, (byte) 0); return secretKey; } /** * Validate storage path */ private void validateStoragePath(String basePath) { if (basePath == null || basePath.trim().isEmpty()) { throw new IllegalArgumentException("Storage path cannot be null or empty"); } // Check for path traversal attempts if (basePath.contains("..") || basePath.contains("~")) { throw new IllegalArgumentException("Invalid storage path: " + basePath); } } /** * Export public key to PEM format */ public String exportPublicKeyToPEM(PublicKey publicKey) { byte[] encoded = publicKey.getEncoded(); String base64 = Base64.getEncoder().encodeToString(encoded); StringBuilder pem = new StringBuilder(); pem.append("-----BEGIN PUBLIC KEY-----\n"); // Split into 64-character lines for (int i = 0; i < base64.length(); i += 64) { int end = Math.min(i + 64, base64.length()); pem.append(base64, i, end).append("\n"); } pem.append("-----END PUBLIC KEY-----\n"); return pem.toString(); } /** * Import public key from PEM format */ public PublicKey importPublicKeyFromPEM(String pem, String algorithm) throws GeneralSecurityException { // Remove PEM headers and whitespace String base64 = pem.replaceAll("-----BEGIN PUBLIC KEY-----", "") .replaceAll("-----END PUBLIC KEY-----", "") .replaceAll("\\s", ""); byte[] encoded = Base64.getDecoder().decode(base64); KeyFactory keyFactory = KeyFactory.getInstance(algorithm, "BC"); X509EncodedKeySpec keySpec = new X509EncodedKeySpec(encoded); return keyFactory.generatePublic(keySpec); } }

Key Rotation and Lifecycle Management

Key Rotation Service

package com.security.crypto; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import java.security.KeyPair; import java.security.PublicKey; import java.time.LocalDateTime; import java.time.format.DateTimeFormatter; import java.util.HashMap; import java.util.Map; import java.util.concurrent.ConcurrentHashMap; import java.util.concurrent.Executors; import java.util.concurrent.ScheduledExecutorService; import java.util.concurrent.TimeUnit; public class KeyRotationService { private static final Logger logger = LoggerFactory.getLogger(KeyRotationService.class); private final SecureKeyPairGenerator keyGenerator; private final SecureKeyStorage keyStorage; private final ScheduledExecutorService scheduler; // Key rotation policies private final Map<String, RotationPolicy> rotationPolicies; private final Map<String, KeyVersion> activeKeys; public KeyRotationService() { this.keyGenerator = new SecureKeyPairGenerator(); this.keyStorage = new SecureKeyStorage(); this.scheduler = Executors.newScheduledThreadPool(2); this.rotationPolicies = new ConcurrentHashMap<>(); this.activeKeys = new ConcurrentHashMap<>(); // Start background rotation tasks startRotationMonitor(); } /** * Key rotation policy */ public static class RotationPolicy { private final String keyId; private final int maxLifetimeDays; private final int warningPeriodDays; private final String algorithm; private final int keySize; private final String curveName; public RotationPolicy(String keyId, int maxLifetimeDays, int warningPeriodDays, String algorithm, int keySize, String curveName) { this.keyId = keyId; this.maxLifetimeDays = maxLifetimeDays; this.warningPeriodDays = warningPeriodDays; this.algorithm = algorithm; this.keySize = keySize; this.curveName = curveName; } // Getters public String getKeyId() { return keyId; } public int getMaxLifetimeDays() { return maxLifetimeDays; } public int getWarningPeriodDays() { return warningPeriodDays; } public String getAlgorithm() { return algorithm; } public int getKeySize() { return keySize; } public String getCurveName() { return curveName; } } /** * Key version information */ public static class KeyVersion { private final String keyId; private final String version; private final LocalDateTime creationTime; private final LocalDateTime expirationTime; private final KeyPair keyPair; private boolean active; public KeyVersion(String keyId, String version, LocalDateTime creationTime, LocalDateTime expirationTime, KeyPair keyPair) { this.keyId = keyId; this.version = version; this.creationTime = creationTime; this.expirationTime = expirationTime; this.keyPair = keyPair; this.active = true; } // Getters public String getKeyId() { return keyId; } public String getVersion() { return version; } public LocalDateTime getCreationTime() { return creationTime; } public LocalDateTime getExpirationTime() { return expirationTime; } public KeyPair getKeyPair() { return keyPair; } public boolean isActive() { return active; } public boolean isExpired() { return LocalDateTime.now().isAfter(expirationTime); } public boolean isExpiringSoon() { return LocalDateTime.now().isAfter(expirationTime.minusDays(7)); } public void deactivate() { this.active = false; } } /** * Register a key rotation policy */ public void registerRotationPolicy(RotationPolicy policy) { rotationPolicies.put(policy.getKeyId(), policy); logger.info("Registered rotation policy for key: {}", policy.getKeyId()); } /** * Generate initial key pair with rotation policy */ public KeyVersion generateInitialKey(String keyId, char[] storagePassword) throws GeneralSecurityException { RotationPolicy policy = rotationPolicies.get(keyId); if (policy == null) { throw new IllegalArgumentException("No rotation policy found for key: " + keyId); } // Generate key pair KeyPair keyPair = generateKeyPair(policy); // Create key version String version = generateVersionId(); LocalDateTime now = LocalDateTime.now(); LocalDateTime expiration = now.plusDays(policy.getMaxLifetimeDays()); KeyVersion keyVersion = new KeyVersion(keyId, version, now, expiration, keyPair); // Store key String storagePath = buildStoragePath(keyId, version); keyStorage.storeKeyPair(keyPair, storagePath, storagePassword); // Set as active activeKeys.put(keyId, keyVersion); logger.info("Generated initial key version {} for key: {}", version, keyId); return keyVersion; } /** * Rotate key to new version */ public KeyVersion rotateKey(String keyId, char[] storagePassword) throws GeneralSecurityException { RotationPolicy policy = rotationPolicies.get(keyId); if (policy == null) { throw new IllegalArgumentException("No rotation policy found for key: " + keyId); } // Generate new key pair KeyPair newKeyPair = generateKeyPair(policy); // Create new version String newVersion = generateVersionId(); LocalDateTime now = LocalDateTime.now(); LocalDateTime expiration = now.plusDays(policy.getMaxLifetimeDays()); KeyVersion newKeyVersion = new KeyVersion(keyId, newVersion, now, expiration, newKeyPair); // Store new key String storagePath = buildStoragePath(keyId, newVersion); keyStorage.storeKeyPair(newKeyPair, storagePath, storagePassword); // Deactivate old key KeyVersion oldKeyVersion = activeKeys.get(keyId); if (oldKeyVersion != null) { oldKeyVersion.deactivate(); logger.info("Deactivated old key version {} for key: {}", oldKeyVersion.getVersion(), keyId); } // Activate new key activeKeys.put(keyId, newKeyVersion); logger.info("Rotated key {} to new version: {}", keyId, newVersion); return newKeyVersion; } /** * Get active key for a key ID */ public KeyVersion getActiveKey(String keyId) { KeyVersion keyVersion = activeKeys.get(keyId); if (keyVersion == null || !keyVersion.isActive()) { throw new IllegalArgumentException("No active key found for: " + keyId); } return keyVersion; } /** * Check if key needs rotation */ public boolean needsRotation(String keyId) { KeyVersion keyVersion = activeKeys.get(keyId); if (keyVersion == null) return true; return keyVersion.isExpiringSoon() || keyVersion.isExpired(); } /** * Generate key pair based on policy */ private KeyPair generateKeyPair(RotationPolicy policy) throws GeneralSecurityException { switch (policy.getAlgorithm().toUpperCase()) { case "RSA": return keyGenerator.generateRSAKeyPair(policy.getKeySize()); case "EC": return keyGenerator.generateECKeyPair(policy.getCurveName()); case "DSA": return keyGenerator.generateDSAKeyPair(policy.getKeySize()); case "ED25519": case "ED448": return keyGenerator.generateEdDSAKeyPair(policy.getAlgorithm()); default: throw new IllegalArgumentException("Unsupported algorithm: " + policy.getAlgorithm()); } } /** * Generate version ID based on timestamp */ private String generateVersionId() { return DateTimeFormatter.ofPattern("yyyyMMdd_HHmmss").format(LocalDateTime.now()); } /** * Build storage path for key version */ private String buildStoragePath(String keyId, String version) { return String.format("keys/%s/%s", keyId, version); } /** * Start background rotation monitoring */ private void startRotationMonitor() { // Check for expiring keys every hour scheduler.scheduleAtFixedRate(() -> { try { monitorKeyExpiration(); } catch (Exception e) { logger.error("Error in key rotation monitor", e); } }, 1, 1, TimeUnit.HOURS); logger.info("Key rotation monitor started"); } /** * Monitor key expiration and send alerts */ private void monitorKeyExpiration() { for (Map.Entry<String, KeyVersion> entry : activeKeys.entrySet()) { String keyId = entry.getKey(); KeyVersion keyVersion = entry.getValue(); if (keyVersion.isExpired()) { logger.error("KEY EXPIRED: Key {} version {} has expired!", keyId, keyVersion.getVersion()); sendExpirationAlert(keyId, keyVersion, "EXPIRED"); } else if (keyVersion.isExpiringSoon()) { logger.warn("KEY EXPIRING: Key {} version {} expires in less than 7 days", keyId, keyVersion.getVersion()); sendExpirationAlert(keyId, keyVersion, "EXPIRING_SOON"); } } } /** * Send expiration alert */ private void sendExpirationAlert(String keyId, KeyVersion keyVersion, String severity) { // In a real implementation, this would send email, Slack message, etc. String message = String.format( "Key Rotation Alert [%s] - Key: %s, Version: %s, Expires: %s", severity, keyId, keyVersion.getVersion(), keyVersion.getExpirationTime().format(DateTimeFormatter.ISO_LOCAL_DATE_TIME) ); logger.warn("KEY ROTATION ALERT: {}", message); // Example: Integrate with monitoring system // monitoringService.alert("KeyRotation", severity, message); } /** * Shutdown the rotation service */ public void shutdown() { scheduler.shutdown(); try { if (!scheduler.awaitTermination(5, TimeUnit.SECONDS)) { scheduler.shutdownNow(); } } catch (InterruptedException e) { scheduler.shutdownNow(); Thread.currentThread().interrupt(); } logger.info("Key rotation service shutdown complete"); } }

Key Validation and Testing

Key Validation Service

```java
package com.security.crypto;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import java.security.; import java.security.interfaces.;
import java.util.ArrayList;
import java.util.List;

public class KeyValidationService {
private static final Logger logger = LoggerFactory.getLogger(KeyValidationService.class);

/** * Validate key pair for correctness and security */ public ValidationResult validateKeyPair(KeyPair keyPair) { List<String> errors = new ArrayList<>(); List<String> warnings = new ArrayList<>(); try { // Basic validation validateNotNull(keyPair, errors); validateKeyComponents(keyPair, errors); // Algorithm-specific validation String algorithm = keyPair.getPublic().getAlgorithm(); switch (algorithm.toUpperCase()) { case "RSA": validateRSAKeyPair((RSAPublicKey) keyPair.getPublic(), (RSAPrivateKey) keyPair.getPrivate(), errors, warnings); break; case "EC": validateECKeyPair((ECPublicKey) keyPair.getPublic(), (ECPrivateKey) keyPair.getPrivate(), errors, warnings); break; case "DSA": validateDSAKeyPair((DSAPublicKey) keyPair.getPublic(), (DSAPrivateKey) keyPair.getPrivate(), errors, warnings); break; default: warnings.add("Unsupported algorithm for detailed validation: " + algorithm); } // Perform cryptographic test if (errors.isEmpty()) { testKeyPairFunctionality(keyPair, errors); } } catch (Exception e) { errors.add("Validation failed with exception: " + e.getMessage()); } return new ValidationResult(errors, warnings); } /** * Validate RSA key pair */ private void validateRSAKeyPair(RSAPublicKey publicKey, RSAPrivateKey privateKey, List<String> errors, List<String> warnings) { // Check key sizes int keySize = publicKey.getModulus().bitLength(); if (keySize < 2048) { errors.add("RSA key size too small: " + keySize + " bits (minimum 2048)"); } else if (keySize < 3072) { warnings.add("RSA key size " + keySize + " bits is below NIST recommended 3072 bits"); } // Check public exponent if (!publicKey.getPublicExponent().equals(RSAPublicKeySpec.F4)) { warnings.add("RSA public exponent is not 65537 (F4)"); } // Check modulus properties if (!publicKey.getModulus().isProbablePrime(100)) { errors.add("RSA modulus is not prime"); } // Verify public/private key relationship try { if (!publicKey.getModulus().equals(privateKey.getModulus())) { errors.add("RSA public and private key moduli do not match"); } } catch (Exception e) { errors.add("Failed to verify RSA key relationship: " + e.getMessage()); } } /** * Validate EC key pair */ private void validateECKeyPair(ECPublicKey publicKey, ECPrivateKey privateKey, List<String> errors, List<String> warnings) { // Check curve strength int fieldSize = publicKey.getParams().getCurve().getField().getFieldSize(); if (fieldSize < 256) { errors.add("EC key curve too weak: " + fieldSize + " bits (minimum 256)"); } // Verify public key is on curve try { if (!isPointOnCurve(publicKey)) { errors.add("EC public key point is not on the curve"); } } catch (Exception e) { errors.add("Failed to validate EC point: " + e.getMessage()); } // Check private key range if (privateKey.getS().signum() <= 0) { errors.add("EC private key is not positive"); } } /** * Validate DSA key pair */ private void validateDSAKeyPair(DSAPublicKey publicKey, DSAPrivateKey privateKey, List<String> errors, List<String> warnings) { int keySize = publicKey.getParams().getP().bitLength(); if (keySize < 2048) { errors.add("DSA key size too small: " + keySize + " bits (minimum 2048)"); } // Verify parameter consistency if (!publicKey.getParams().equals(privateKey.getParams())) { errors.add("DSA public and private key parameters do not match"); } } /** * Basic validation checks */ private void validateNotNull(KeyPair keyPair, List<String> errors) { if (keyPair == null) { errors.add("Key pair is null"); return; } if (keyPair.getPublic() == null) { errors.add("Public key is null"); } if (keyPair.getPrivate() == null) { errors.add("Private key is null"); }