authenticationKeyPairFor method

({SigningAlgoType algorithm, String privateKey, String publicKey})? authenticationKeyPairFor(String? enrollmentId)

The authentication keypair enrollmentId proves possession of, and the algorithm that signs with it.

The typed form of authenticationFor, resolving the same way and on the same terms: typed material wherever this keyfile holds it for enrollmentId, the flat apkamPublicKey/apkamPrivateKey under rsa2048 only where it holds none. authenticationFor documents why that order matters on a retrofitted keyfile. Both halves are base64 of the raw key bytes.

Null when the keyfile holds no authentication keypair for enrollmentId at all. Throws AtKeyNotFoundException when its typed material names an algorithm this build cannot sign with, rather than answering from the flat fields, which on such a keyfile are a different enrollment's.

Implementation

({SigningAlgoType algorithm, String publicKey, String privateKey})?
    authenticationKeyPairFor(String? enrollmentId) {
  final algorithm = authenticationAlgorithmFor(enrollmentId);
  if (algorithm != null) {
    final materials = keysForEnrollment(enrollmentId!);
    final private = materials
        .where((m) =>
            m.role == CryptographicMaterialRole.privateAuthentication &&
            m.status == CryptographicMaterialStatus.active)
        .firstOrNull;
    final public = materials
        .where((m) =>
            m.role == CryptographicMaterialRole.publicAuthentication &&
            m.status == CryptographicMaterialStatus.active)
        .firstOrNull;
    if (private == null || public == null) {
      throw AtKeyNotFoundException(
          'AtKeys holds no active authentication keypair for enrollment '
          '$enrollmentId');
    }
    return (
      algorithm: algorithm,
      publicKey: public.bytes.toString(),
      privateKey: private.bytes.toString(),
    );
  }
  // ignore: deprecated_member_use_from_same_package
  final flatPublic = apkamPublicKey;
  // ignore: deprecated_member_use_from_same_package
  final flatPrivate = apkamPrivateKey;
  if (flatPublic == null || flatPrivate == null) return null;
  return (
    algorithm: SigningAlgoType.rsa2048,
    publicKey: flatPublic.toString(),
    privateKey: flatPrivate.toString(),
  );
}