KeyPair

Holds a Stellar keypair consisting of a public key and optionally a private key (secret seed).

Cryptographic Implementation

This class uses production-ready, platform-specific cryptographic implementations:

JVM/Android

• Library: BouncyCastle (org.bouncycastle:bcprov-jdk18on)

• Algorithm: Ed25519 (RFC 8032 compliant)

• Security: Mature, widely-audited implementation

• Provider: Registered as JCA security provider

iOS/macOS

• Library: libsodium (via C interop)

• Algorithm: Ed25519 (crypto_sign_*)

• Security: Audited, constant-time operations, memory-safe

• Distribution: Requires libsodium via Swift Package Manager or static linking

JavaScript/Web

• Library: libsodium-wrappers (WebAssembly)

• Algorithm: Ed25519 (crypto_sign_*)

• Security: Same audited libsodium implementation compiled to WebAssembly

• Distribution: Bundled via npm/webpack

Security Considerations

1. Memory Management:

• Secret seeds are stored as ByteArray and should be zeroed after use

• Use fromSecretSeed with CharArray when possible for better memory control

• All returned arrays are defensive copies to prevent external modification

2. Side-Channel Protection:

• All implementations use constant-time operations for signing/verification

• No timing-based attacks on key operations

3. Validation:

• All inputs are validated for correct length and format

• Invalid keys/seeds throw IllegalArgumentException immediately

Thread Safety

KeyPair instances are immutable and thread-safe. The underlying cryptographic operations are also thread-safe.

See also