Represent identity keys as IdentityKey instances

2026-04-22 10:08:04 +01:00 · 2023-06-08 11:36:58 -04:00
parent 1c8443210a
commit 234707169e
34 changed files with 390 additions and 263 deletions
--- a/service/src/test/java/org/whispersystems/textsecuregcm/auth/CertificateGeneratorTest.java
+++ b/service/src/test/java/org/whispersystems/textsecuregcm/auth/CertificateGeneratorTest.java
@@ -14,7 +14,9 @@ import java.security.InvalidKeyException;
 import java.util.Base64;
 import java.util.UUID;
 import org.junit.jupiter.api.Test;
+import org.signal.libsignal.protocol.IdentityKey;
 import org.signal.libsignal.protocol.ecc.Curve;
+import org.signal.libsignal.protocol.ecc.ECPublicKey;
 import org.whispersystems.textsecuregcm.storage.Account;
 import org.whispersystems.textsecuregcm.storage.Device;

@@ -22,7 +24,7 @@ class CertificateGeneratorTest {

    private static final String SIGNING_CERTIFICATE = "CiUIDBIhBbTz4h1My+tt+vw+TVscgUe/DeHS0W02tPWAWbTO2xc3EkD+go4bJnU0AcnFfbOLKoiBfCzouZtDYMOVi69rE7r4U9cXREEqOkUmU2WJBjykAxWPCcSTmVTYHDw7hkSp/puG";
    private static final String SIGNING_KEY = "ABOxG29xrfq4E7IrW11Eg7+HBbtba9iiS0500YoBjn4=";
-    private static final byte[] IDENTITY_KEY = Base64.getDecoder().decode("BcxxDU9FGMda70E7+Uvm7pnQcEdXQ64aJCpPUeRSfcFo");
+    private static final IdentityKey IDENTITY_KEY = new IdentityKey(ECPublicKey.fromPublicKeyBytes(Base64.getDecoder().decode("BcxxDU9FGMda70E7+Uvm7pnQcEdXQ64aJCpPUeRSfcFo")));

    @Test
    void testCreateFor() throws IOException, InvalidKeyException, org.signal.libsignal.protocol.InvalidKeyException {
--- a/service/src/test/java/org/whispersystems/textsecuregcm/controllers/AccountControllerTest.java
+++ b/service/src/test/java/org/whispersystems/textsecuregcm/controllers/AccountControllerTest.java
@@ -70,6 +70,7 @@ import org.junit.jupiter.params.provider.CsvSource;
 import org.junit.jupiter.params.provider.MethodSource;
 import org.mockito.ArgumentCaptor;
 import org.mockito.stubbing.Answer;
+import org.signal.libsignal.protocol.IdentityKey;
 import org.signal.libsignal.protocol.ecc.Curve;
 import org.signal.libsignal.protocol.ecc.ECKeyPair;
 import org.signal.libsignal.usernames.BaseUsernameException;
@@ -339,7 +340,7 @@ class AccountControllerTest {
    when(changeNumberManager.changeNumber(any(), any(), any(), any(), any(), any(), any())).thenAnswer((Answer<Account>) invocation -> {
      final Account account = invocation.getArgument(0);
      final String number = invocation.getArgument(1);
-      final byte[] pniIdentityKey = invocation.getArgument(2);
+      final IdentityKey pniIdentityKey = invocation.getArgument(2);

      final UUID uuid = account.getUuid();
      final UUID pni = number.equals(account.getNumber()) ? account.getPhoneNumberIdentifier() : UUID.randomUUID();
@@ -362,7 +363,7 @@ class AccountControllerTest {

    when(changeNumberManager.updatePniKeys(any(), any(), any(), any(), any(), any())).thenAnswer((Answer<Account>) invocation -> {
      final Account account = invocation.getArgument(0);
-      final byte[] pniIdentityKey = invocation.getArgument(1);
+      final IdentityKey pniIdentityKey = invocation.getArgument(1);

      final String number = account.getNumber();
      final UUID uuid = account.getUuid();
@@ -1646,7 +1647,7 @@ class AccountControllerTest {
    final String number = "+18005559876";
    final String code = "987654";
    final ECKeyPair pniIdentityKeyPair = Curve.generateKeyPair();
-    final byte[] pniIdentityKey = pniIdentityKeyPair.getPublicKey().serialize();
+    final IdentityKey pniIdentityKey = new IdentityKey(pniIdentityKeyPair.getPublicKey());
    final byte[] sessionId = "session-id".getBytes(StandardCharsets.UTF_8);

    Device device2 = mock(Device.class);
@@ -1700,7 +1701,7 @@ class AccountControllerTest {
  void testChangePhoneNumberSameNumberChangePrekeys() throws Exception {
    final String code = "987654";
    final ECKeyPair pniIdentityKeyPair = Curve.generateKeyPair();
-    final byte[] pniIdentityKey = pniIdentityKeyPair.getPublicKey().serialize();
+    final IdentityKey pniIdentityKey = new IdentityKey(pniIdentityKeyPair.getPublicKey());
    final byte[] sessionId = "session-id".getBytes(StandardCharsets.UTF_8);

    Device device2 = mock(Device.class);
--- a/service/src/test/java/org/whispersystems/textsecuregcm/controllers/AccountControllerV2Test.java
+++ b/service/src/test/java/org/whispersystems/textsecuregcm/controllers/AccountControllerV2Test.java
@@ -61,6 +61,7 @@ import org.junit.jupiter.params.provider.EnumSource;
 import org.junit.jupiter.params.provider.MethodSource;
 import org.mockito.ArgumentCaptor;
 import org.mockito.stubbing.Answer;
+import org.signal.libsignal.protocol.IdentityKey;
 import org.signal.libsignal.protocol.ecc.Curve;
 import org.signal.libsignal.protocol.ecc.ECKeyPair;
 import org.whispersystems.textsecuregcm.auth.AuthenticatedAccount;
@@ -97,6 +98,8 @@ class AccountControllerV2Test {

  private static final long SESSION_EXPIRATION_SECONDS = Duration.ofMinutes(10).toSeconds();

+  private static final IdentityKey IDENTITY_KEY = new IdentityKey(Curve.generateKeyPair().getPublicKey());
+
  private static final String NEW_NUMBER = PhoneNumberUtil.getInstance().format(
      PhoneNumberUtil.getInstance().getExampleNumber("US"),
      PhoneNumberUtil.PhoneNumberFormat.E164);
@@ -140,7 +143,7 @@ class AccountControllerV2Test {
          (Answer<Account>) invocation -> {
            final Account account = invocation.getArgument(0);
            final String number = invocation.getArgument(1);
-            final byte[] pniIdentityKey = invocation.getArgument(2);
+            final IdentityKey pniIdentityKey = invocation.getArgument(2);

            final UUID uuid = account.getUuid();
            final List<Device> devices = account.getDevices();
@@ -180,7 +183,7 @@ class AccountControllerV2Test {
              .header(HttpHeaders.AUTHORIZATION,
                  AuthHelper.getAuthHeader(AuthHelper.VALID_UUID, AuthHelper.VALID_PASSWORD))
              .put(Entity.entity(
-                  new ChangeNumberRequest(encodeSessionId("session"), null, NEW_NUMBER, "123", "123".getBytes(StandardCharsets.UTF_8),
+                  new ChangeNumberRequest(encodeSessionId("session"), null, NEW_NUMBER, "123", new IdentityKey(Curve.generateKeyPair().getPublicKey()),
                      Collections.emptyList(),
                      Collections.emptyMap(), null, Collections.emptyMap()),
                  MediaType.APPLICATION_JSON_TYPE), AccountIdentityResponse.class);
@@ -203,7 +206,7 @@ class AccountControllerV2Test {
                  AuthHelper.getAuthHeader(AuthHelper.VALID_UUID, AuthHelper.VALID_PASSWORD))
              .put(Entity.entity(
                  new ChangeNumberRequest(encodeSessionId("session"), null, AuthHelper.VALID_NUMBER, null, 
-                      "pni-identity-key".getBytes(StandardCharsets.UTF_8),
+                      new IdentityKey(Curve.generateKeyPair().getPublicKey()),
                      Collections.emptyList(),
                      Collections.emptyMap(), null, Collections.emptyMap()),
                  MediaType.APPLICATION_JSON_TYPE), AccountIdentityResponse.class);
@@ -407,12 +410,12 @@ class AccountControllerV2Test {
            "recoveryPassword": "%s",
            "number": "%s",
            "reglock": "1234",
-            "pniIdentityKey": "5678",
+            "pniIdentityKey": "%s",
            "deviceMessages": [],
            "devicePniSignedPrekeys": {},
            "pniRegistrationIds": {}
          }
-          """, encodeSessionId(sessionId), encodeRecoveryPassword(recoveryPassword), newNumber);
+          """, encodeSessionId(sessionId), encodeRecoveryPassword(recoveryPassword), newNumber, Base64.getEncoder().encodeToString(IDENTITY_KEY.serialize()));
    }

    /**
@@ -463,7 +466,7 @@ class AccountControllerV2Test {
      when(changeNumberManager.updatePniKeys(any(), any(), any(), any(), any(), any())).thenAnswer(
          (Answer<Account>) invocation -> {
            final Account account = invocation.getArgument(0);
-            final byte[] pniIdentityKey = invocation.getArgument(1);
+            final IdentityKey pniIdentityKey = invocation.getArgument(1);

            final UUID uuid = account.getUuid();
            final UUID pni = account.getPhoneNumberIdentifier();
@@ -498,7 +501,7 @@ class AccountControllerV2Test {
              AuthHelper.getAuthHeader(AuthHelper.VALID_UUID, AuthHelper.VALID_PASSWORD))
          .put(Entity.json(requestJson()), AccountIdentityResponse.class);

-      verify(changeNumberManager).updatePniKeys(eq(AuthHelper.VALID_ACCOUNT), eq("pni-identity-key".getBytes(StandardCharsets.UTF_8)), any(), any(), any(), any());
+      verify(changeNumberManager).updatePniKeys(eq(AuthHelper.VALID_ACCOUNT), eq(IDENTITY_KEY), any(), any(), any(), any());

      assertEquals(AuthHelper.VALID_UUID, accountIdentityResponse.uuid());
      assertEquals(AuthHelper.VALID_NUMBER, accountIdentityResponse.number());
@@ -562,7 +565,7 @@ class AccountControllerV2Test {
            "devicePniSignedPqPrekeys": {},
            "pniRegistrationIds": {}
          }
-      """, Base64.getEncoder().encodeToString("pni-identity-key".getBytes(StandardCharsets.UTF_8)));
+      """, Base64.getEncoder().encodeToString(IDENTITY_KEY.serialize()));
    }

    /**
@@ -798,8 +801,8 @@ class AccountControllerV2Test {
      account.setUnrestrictedUnidentifiedAccess(unrestrictedUnidentifiedAccess);
      account.setDiscoverableByPhoneNumber(discoverableByPhoneNumber);
      account.setBadges(Clock.systemUTC(), new ArrayList<>(badges));
-      account.setIdentityKey(aciIdentityKeyPair.getPublicKey().serialize());
-      account.setPhoneNumberIdentityKey(pniIdentityKeyPair.getPublicKey().serialize());
+      account.setIdentityKey(new IdentityKey(aciIdentityKeyPair.getPublicKey()));
+      account.setPhoneNumberIdentityKey(new IdentityKey(pniIdentityKeyPair.getPublicKey()));

      assert !devices.isEmpty();

--- a/service/src/test/java/org/whispersystems/textsecuregcm/controllers/ProfileControllerTest.java
+++ b/service/src/test/java/org/whispersystems/textsecuregcm/controllers/ProfileControllerTest.java
@@ -33,12 +33,12 @@ import java.time.Duration;
 import java.time.Instant;
 import java.time.temporal.ChronoUnit;
 import java.util.ArrayList;
-import java.util.Arrays;
 import java.util.Base64;
 import java.util.Collections;
 import java.util.HexFormat;
 import java.util.List;
 import java.util.Map;
+import java.util.Objects;
 import java.util.Optional;
 import java.util.UUID;
 import java.util.concurrent.Executors;
@@ -61,6 +61,8 @@ import org.junit.jupiter.params.provider.Arguments;
 import org.junit.jupiter.params.provider.MethodSource;
 import org.junit.jupiter.params.provider.ValueSource;
 import org.mockito.ArgumentCaptor;
+import org.signal.libsignal.protocol.IdentityKey;
+import org.signal.libsignal.protocol.ecc.Curve;
 import org.signal.libsignal.zkgroup.InvalidInputException;
 import org.signal.libsignal.zkgroup.ServerPublicParams;
 import org.signal.libsignal.zkgroup.ServerSecretParams;
@@ -124,10 +126,10 @@ class ProfileControllerTest {
  private static final ServerZkProfileOperations zkProfileOperations = mock(ServerZkProfileOperations.class);

  private static final byte[] UNIDENTIFIED_ACCESS_KEY = "test-uak".getBytes(StandardCharsets.UTF_8);
-  private static final byte[] ACCOUNT_IDENTITY_KEY = "barz".getBytes(StandardCharsets.UTF_8);
-  private static final byte[] ACCOUNT_PHONE_NUMBER_IDENTITY_KEY = "bazz".getBytes(StandardCharsets.UTF_8);
-  private static final byte[] ACCOUNT_TWO_IDENTITY_KEY = "bar".getBytes(StandardCharsets.UTF_8);
-  private static final byte[] ACCOUNT_TWO_PHONE_NUMBER_IDENTITY_KEY = "baz".getBytes(StandardCharsets.UTF_8);
+  private static final IdentityKey ACCOUNT_IDENTITY_KEY = new IdentityKey(Curve.generateKeyPair().getPublicKey());
+  private static final IdentityKey ACCOUNT_PHONE_NUMBER_IDENTITY_KEY = new IdentityKey(Curve.generateKeyPair().getPublicKey());
+  private static final IdentityKey ACCOUNT_TWO_IDENTITY_KEY = new IdentityKey(Curve.generateKeyPair().getPublicKey());
+  private static final IdentityKey ACCOUNT_TWO_PHONE_NUMBER_IDENTITY_KEY = new IdentityKey(Curve.generateKeyPair().getPublicKey());
  private static final String BASE_64_URL_USERNAME_HASH = "9p6Tip7BFefFOJzv4kv4GyXEYsBVfk_WbjNejdlOvQE";
  private static final byte[] USERNAME_HASH = Base64.getUrlDecoder().decode(BASE_64_URL_USERNAME_HASH);
  @SuppressWarnings("unchecked")
@@ -1170,26 +1172,31 @@ class ProfileControllerTest {

    final Condition<BatchIdentityCheckResponse.Element> isAnExpectedUuid = new Condition<>(element -> {
      if (AuthHelper.VALID_UUID.equals(element.aci())) {
-        return Arrays.equals(ACCOUNT_IDENTITY_KEY, element.identityKey());
+        return Objects.equals(ACCOUNT_IDENTITY_KEY, element.identityKey());
      } else if (AuthHelper.VALID_PNI_TWO.equals(element.uuid())) {
-        return Arrays.equals(ACCOUNT_TWO_PHONE_NUMBER_IDENTITY_KEY, element.identityKey());
+        return Objects.equals(ACCOUNT_TWO_PHONE_NUMBER_IDENTITY_KEY, element.identityKey());
      } else if (AuthHelper.VALID_UUID_TWO.equals(element.uuid())) {
-        return Arrays.equals(ACCOUNT_TWO_IDENTITY_KEY, element.identityKey());
+        return Objects.equals(ACCOUNT_TWO_IDENTITY_KEY, element.identityKey());
      } else {
        return false;
      }
    }, "is an expected UUID with the correct identity key");

+    final IdentityKey validAciIdentityKey = new IdentityKey(Curve.generateKeyPair().getPublicKey());
+    final IdentityKey secondValidPniIdentityKey = new IdentityKey(Curve.generateKeyPair().getPublicKey());
+    final IdentityKey secondValidAciIdentityKey = new IdentityKey(Curve.generateKeyPair().getPublicKey());
+    final IdentityKey invalidAciIdentityKey = new IdentityKey(Curve.generateKeyPair().getPublicKey());
+
    try (final Response response = resources.getJerseyTest().target("/v1/profile/identity_check/batch").request()
        .post(Entity.json(new BatchIdentityCheckRequest(List.of(
            new BatchIdentityCheckRequest.Element(AuthHelper.VALID_UUID, null,
-                convertKeyToFingerprint("else1234".getBytes(StandardCharsets.UTF_8))),
+                convertKeyToFingerprint(validAciIdentityKey)),
            new BatchIdentityCheckRequest.Element(null, AuthHelper.VALID_PNI_TWO,
-                convertKeyToFingerprint("another1".getBytes(StandardCharsets.UTF_8))),
+                convertKeyToFingerprint(secondValidPniIdentityKey)),
            new BatchIdentityCheckRequest.Element(null, AuthHelper.VALID_UUID_TWO,
-                convertKeyToFingerprint("another2".getBytes(StandardCharsets.UTF_8))),
+                convertKeyToFingerprint(secondValidAciIdentityKey)),
            new BatchIdentityCheckRequest.Element(AuthHelper.INVALID_UUID, null,
-                convertKeyToFingerprint("456".getBytes(StandardCharsets.UTF_8)))
+                convertKeyToFingerprint(invalidAciIdentityKey))
        ))))) {
      assertThat(response).isNotNull();
      assertThat(response.getStatus()).isEqualTo(200);
@@ -1202,13 +1209,13 @@ class ProfileControllerTest {
    }

    final List<BatchIdentityCheckRequest.Element> largeElementList = new ArrayList<>(List.of(
-        new BatchIdentityCheckRequest.Element(AuthHelper.VALID_UUID, null, convertKeyToFingerprint("else1234".getBytes(StandardCharsets.UTF_8))),
-        new BatchIdentityCheckRequest.Element(null, AuthHelper.VALID_PNI_TWO, convertKeyToFingerprint("another1".getBytes(StandardCharsets.UTF_8))),
-        new BatchIdentityCheckRequest.Element(AuthHelper.INVALID_UUID, null, convertKeyToFingerprint("456".getBytes(StandardCharsets.UTF_8)))));
+        new BatchIdentityCheckRequest.Element(AuthHelper.VALID_UUID, null, convertKeyToFingerprint(validAciIdentityKey)),
+        new BatchIdentityCheckRequest.Element(null, AuthHelper.VALID_PNI_TWO, convertKeyToFingerprint(secondValidPniIdentityKey)),
+        new BatchIdentityCheckRequest.Element(AuthHelper.INVALID_UUID, null, convertKeyToFingerprint(invalidAciIdentityKey))));

    for (int i = 0; i < 900; i++) {
      largeElementList.add(
-          new BatchIdentityCheckRequest.Element(UUID.randomUUID(), null, convertKeyToFingerprint("abcd".getBytes(StandardCharsets.UTF_8))));
+          new BatchIdentityCheckRequest.Element(UUID.randomUUID(), null, convertKeyToFingerprint(new IdentityKey(Curve.generateKeyPair().getPublicKey()))));
    }

    try (final Response response = resources.getJerseyTest().target("/v1/profile/identity_check/batch").request()
@@ -1228,9 +1235,9 @@ class ProfileControllerTest {

    final Condition<BatchIdentityCheckResponse.Element> isAnExpectedUuid = new Condition<>(element -> {
      if (AuthHelper.VALID_UUID.equals(element.aci())) {
-        return Arrays.equals(ACCOUNT_IDENTITY_KEY, element.identityKey());
+        return ACCOUNT_IDENTITY_KEY.equals(element.identityKey());
      } else if (AuthHelper.VALID_PNI_TWO.equals(element.uuid())) {
-        return Arrays.equals(ACCOUNT_TWO_PHONE_NUMBER_IDENTITY_KEY, element.identityKey());
+        return ACCOUNT_TWO_PHONE_NUMBER_IDENTITY_KEY.equals(element.identityKey());
      } else {
        return false;
      }
@@ -1245,9 +1252,9 @@ class ProfileControllerTest {
                { "aci": "%s", "fingerprint": "%s" }
              ]
            }
-            """, AuthHelper.VALID_UUID, Base64.getEncoder().encodeToString(convertKeyToFingerprint("else1234".getBytes(StandardCharsets.UTF_8))),
-        AuthHelper.VALID_PNI_TWO, Base64.getEncoder().encodeToString(convertKeyToFingerprint("another1".getBytes(StandardCharsets.UTF_8))),
-        AuthHelper.INVALID_UUID, Base64.getEncoder().encodeToString(convertKeyToFingerprint("456".getBytes(StandardCharsets.UTF_8))));
+            """, AuthHelper.VALID_UUID, Base64.getEncoder().encodeToString(convertKeyToFingerprint(new IdentityKey(Curve.generateKeyPair().getPublicKey()))),
+        AuthHelper.VALID_PNI_TWO, Base64.getEncoder().encodeToString(convertKeyToFingerprint(new IdentityKey(Curve.generateKeyPair().getPublicKey()))),
+        AuthHelper.INVALID_UUID, Base64.getEncoder().encodeToString(convertKeyToFingerprint(new IdentityKey(Curve.generateKeyPair().getPublicKey()))));

    try (final Response response = resources.getJerseyTest().target("/v1/profile/identity_check/batch").request()
        .post(Entity.entity(json, "application/json"))) {
@@ -1313,15 +1320,15 @@ class ProfileControllerTest {
                      ]
                    }
                    """, AuthHelper.VALID_UUID, AuthHelper.VALID_PNI,
-                Base64.getEncoder().encodeToString(convertKeyToFingerprint("else1234".getBytes(StandardCharsets.UTF_8)))))
+                Base64.getEncoder().encodeToString(convertKeyToFingerprint(new IdentityKey(Curve.generateKeyPair().getPublicKey())))))
    );
  }

-  private static byte[] convertKeyToFingerprint(byte[] key) {
+  private static byte[] convertKeyToFingerprint(final IdentityKey publicKey) {
    try {
-      return Util.truncate(MessageDigest.getInstance("SHA-256").digest(key), 4);
-    } catch (NoSuchAlgorithmException e) {
-      throw new AssertionError(e);
+      return Util.truncate(MessageDigest.getInstance("SHA-256").digest(publicKey.serialize()), 4);
+    } catch (final NoSuchAlgorithmException e) {
+      throw new AssertionError("All Java implementations must support SHA-256 MessageDigest algorithm", e);
    }
  }
 }
--- a/service/src/test/java/org/whispersystems/textsecuregcm/controllers/RegistrationControllerTest.java
+++ b/service/src/test/java/org/whispersystems/textsecuregcm/controllers/RegistrationControllerTest.java
@@ -47,6 +47,7 @@ import org.junit.jupiter.params.provider.Arguments;
 import org.junit.jupiter.params.provider.CsvSource;
 import org.junit.jupiter.params.provider.EnumSource;
 import org.junit.jupiter.params.provider.MethodSource;
+import org.signal.libsignal.protocol.IdentityKey;
 import org.signal.libsignal.protocol.ecc.Curve;
 import org.signal.libsignal.protocol.ecc.ECKeyPair;
 import org.whispersystems.textsecuregcm.auth.PhoneVerificationTokenManager;
@@ -415,8 +416,8 @@ class RegistrationControllerTest {
  }

  static Stream<Arguments> atomicAccountCreationConflictingChannel() {
-    final Optional<byte[]> aciIdentityKey;
-    final Optional<byte[]> pniIdentityKey;
+    final Optional<IdentityKey> aciIdentityKey;
+    final Optional<IdentityKey> pniIdentityKey;
    final Optional<SignedPreKey> aciSignedPreKey;
    final Optional<SignedPreKey> pniSignedPreKey;
    final Optional<SignedPreKey> aciPqLastResortPreKey;
@@ -425,8 +426,8 @@ class RegistrationControllerTest {
      final ECKeyPair aciIdentityKeyPair = Curve.generateKeyPair();
      final ECKeyPair pniIdentityKeyPair = Curve.generateKeyPair();

-      aciIdentityKey = Optional.of(aciIdentityKeyPair.getPublicKey().serialize());
-      pniIdentityKey = Optional.of(pniIdentityKeyPair.getPublicKey().serialize());
+      aciIdentityKey = Optional.of(new IdentityKey(aciIdentityKeyPair.getPublicKey()));
+      pniIdentityKey = Optional.of(new IdentityKey(pniIdentityKeyPair.getPublicKey()));
      aciSignedPreKey = Optional.of(KeysHelper.signedECPreKey(1, aciIdentityKeyPair));
      pniSignedPreKey = Optional.of(KeysHelper.signedECPreKey(2, pniIdentityKeyPair));
      aciPqLastResortPreKey = Optional.of(KeysHelper.signedKEMPreKey(3, aciIdentityKeyPair));
@@ -504,8 +505,8 @@ class RegistrationControllerTest {
  }

  static Stream<Arguments> atomicAccountCreationPartialSignedPreKeys() {
-    final Optional<byte[]> aciIdentityKey;
-    final Optional<byte[]> pniIdentityKey;
+    final Optional<IdentityKey> aciIdentityKey;
+    final Optional<IdentityKey> pniIdentityKey;
    final Optional<SignedPreKey> aciSignedPreKey;
    final Optional<SignedPreKey> pniSignedPreKey;
    final Optional<SignedPreKey> aciPqLastResortPreKey;
@@ -514,8 +515,8 @@ class RegistrationControllerTest {
      final ECKeyPair aciIdentityKeyPair = Curve.generateKeyPair();
      final ECKeyPair pniIdentityKeyPair = Curve.generateKeyPair();

-      aciIdentityKey = Optional.of(aciIdentityKeyPair.getPublicKey().serialize());
-      pniIdentityKey = Optional.of(pniIdentityKeyPair.getPublicKey().serialize());
+      aciIdentityKey = Optional.of(new IdentityKey(aciIdentityKeyPair.getPublicKey()));
+      pniIdentityKey = Optional.of(new IdentityKey(pniIdentityKeyPair.getPublicKey()));
      aciSignedPreKey = Optional.of(KeysHelper.signedECPreKey(1, aciIdentityKeyPair));
      pniSignedPreKey = Optional.of(KeysHelper.signedECPreKey(2, pniIdentityKeyPair));
      aciPqLastResortPreKey = Optional.of(KeysHelper.signedKEMPreKey(3, aciIdentityKeyPair));
@@ -617,8 +618,8 @@ class RegistrationControllerTest {
  @MethodSource
  @SuppressWarnings("OptionalUsedAsFieldOrParameterType")
  void atomicAccountCreationSuccess(final RegistrationRequest registrationRequest,
-      final byte[] expectedAciIdentityKey,
-      final byte[] expectedPniIdentityKey,
+      final IdentityKey expectedAciIdentityKey,
+      final IdentityKey expectedPniIdentityKey,
      final SignedPreKey expectedAciSignedPreKey,
      final SignedPreKey expectedPniSignedPreKey,
      final SignedPreKey expectedAciPqLastResortPreKey,
@@ -683,8 +684,8 @@ class RegistrationControllerTest {
  }

  private static Stream<Arguments> atomicAccountCreationSuccess() {
-    final Optional<byte[]> aciIdentityKey;
-    final Optional<byte[]> pniIdentityKey;
+    final Optional<IdentityKey> aciIdentityKey;
+    final Optional<IdentityKey> pniIdentityKey;
    final Optional<SignedPreKey> aciSignedPreKey;
    final Optional<SignedPreKey> pniSignedPreKey;
    final Optional<SignedPreKey> aciPqLastResortPreKey;
@@ -693,8 +694,8 @@ class RegistrationControllerTest {
      final ECKeyPair aciIdentityKeyPair = Curve.generateKeyPair();
      final ECKeyPair pniIdentityKeyPair = Curve.generateKeyPair();

-      aciIdentityKey = Optional.of(aciIdentityKeyPair.getPublicKey().serialize());
-      pniIdentityKey = Optional.of(pniIdentityKeyPair.getPublicKey().serialize());
+      aciIdentityKey = Optional.of(new IdentityKey(aciIdentityKeyPair.getPublicKey()));
+      pniIdentityKey = Optional.of(new IdentityKey(pniIdentityKeyPair.getPublicKey()));
      aciSignedPreKey = Optional.of(KeysHelper.signedECPreKey(1, aciIdentityKeyPair));
      pniSignedPreKey = Optional.of(KeysHelper.signedECPreKey(2, pniIdentityKeyPair));
      aciPqLastResortPreKey = Optional.of(KeysHelper.signedKEMPreKey(3, aciIdentityKeyPair));
--- a/service/src/test/java/org/whispersystems/textsecuregcm/storage/AccountsManagerChangeNumberIntegrationTest.java
+++ b/service/src/test/java/org/whispersystems/textsecuregcm/storage/AccountsManagerChangeNumberIntegrationTest.java
@@ -5,7 +5,9 @@

 package org.whispersystems.textsecuregcm.storage;

-import static org.junit.jupiter.api.Assertions.*;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.verify;
@@ -21,6 +23,7 @@ import java.util.concurrent.CompletableFuture;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.RegisterExtension;
+import org.signal.libsignal.protocol.IdentityKey;
 import org.signal.libsignal.protocol.ecc.Curve;
 import org.signal.libsignal.protocol.ecc.ECKeyPair;
 import org.whispersystems.textsecuregcm.configuration.dynamic.DynamicConfiguration;
@@ -155,7 +158,7 @@ class AccountsManagerChangeNumberIntegrationTest {
    final UUID originalUuid = account.getUuid();
    final UUID originalPni = account.getPhoneNumberIdentifier();

-    final byte[] pniIdentityKey = pniIdentityKeyPair.getPublicKey().serialize();
+    final IdentityKey pniIdentityKey = new IdentityKey(pniIdentityKeyPair.getPublicKey());
    final Map<Long, SignedPreKey> preKeys = Map.of(Device.MASTER_ID, rotatedSignedPreKey);
    final Map<Long, Integer> registrationIds = Map.of(Device.MASTER_ID, rotatedPniRegistrationId);

@@ -172,7 +175,7 @@ class AccountsManagerChangeNumberIntegrationTest {
    assertEquals(Optional.empty(), deletedAccounts.findUuid(originalNumber));
    assertEquals(Optional.empty(), deletedAccounts.findUuid(secondNumber));

-    assertArrayEquals(pniIdentityKey, updatedAccount.getPhoneNumberIdentityKey());
+    assertEquals(pniIdentityKey, updatedAccount.getPhoneNumberIdentityKey());

    assertEquals(OptionalInt.of(rotatedPniRegistrationId),
        updatedAccount.getMasterDevice().orElseThrow().getPhoneNumberIdentityRegistrationId());
--- a/service/src/test/java/org/whispersystems/textsecuregcm/storage/AccountsManagerConcurrentModificationIntegrationTest.java
+++ b/service/src/test/java/org/whispersystems/textsecuregcm/storage/AccountsManagerConcurrentModificationIntegrationTest.java
@@ -20,7 +20,6 @@ import static org.mockito.Mockito.when;

 import io.lettuce.core.cluster.api.sync.RedisAdvancedClusterCommands;
 import java.io.IOException;
-import java.nio.charset.StandardCharsets;
 import java.time.Clock;
 import java.time.Instant;
 import java.util.ArrayList;
@@ -38,6 +37,8 @@ import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.RegisterExtension;
 import org.mockito.ArgumentCaptor;
 import org.mockito.stubbing.Answer;
+import org.signal.libsignal.protocol.IdentityKey;
+import org.signal.libsignal.protocol.ecc.Curve;
 import org.whispersystems.textsecuregcm.auth.SaltedTokenHash;
 import org.whispersystems.textsecuregcm.configuration.dynamic.DynamicConfiguration;
 import org.whispersystems.textsecuregcm.entities.AccountAttributes;
@@ -147,7 +148,7 @@ class AccountsManagerConcurrentModificationIntegrationTest {

    final boolean discoverableByPhoneNumber = false;
    final String currentProfileVersion = "cpv";
-    final byte[] identityKey = "ikey".getBytes(StandardCharsets.UTF_8);
+    final IdentityKey identityKey = new IdentityKey(Curve.generateKeyPair().getPublicKey());
    final byte[] unidentifiedAccessKey = new byte[]{1};
    final String pin = "1234";
    final String registrationLock = "reglock";
@@ -189,12 +190,12 @@ class AccountsManagerConcurrentModificationIntegrationTest {
    return JsonHelpers.fromJson(redisSetArgumentCapture.getValue(), Account.class);
  }

-  private void verifyAccount(final String name, final Account account, final boolean discoverableByPhoneNumber, final String currentProfileVersion, final byte[] identityKey, final byte[] unidentifiedAccessKey, final String pin, final String clientRegistrationLock, final boolean unrestrictedUnidentifiedAccess, final long lastSeen) {
+  private void verifyAccount(final String name, final Account account, final boolean discoverableByPhoneNumber, final String currentProfileVersion, final IdentityKey identityKey, final byte[] unidentifiedAccessKey, final String pin, final String clientRegistrationLock, final boolean unrestrictedUnidentifiedAccess, final long lastSeen) {

    assertAll(name,
        () -> assertEquals(discoverableByPhoneNumber, account.isDiscoverableByPhoneNumber()),
        () -> assertEquals(currentProfileVersion, account.getCurrentProfileVersion().orElseThrow()),
-        () -> assertArrayEquals(identityKey, account.getIdentityKey()),
+        () -> assertEquals(identityKey, account.getIdentityKey()),
        () -> assertArrayEquals(unidentifiedAccessKey, account.getUnidentifiedAccessKey().orElseThrow()),
        () -> assertTrue(account.getRegistrationLock().verify(clientRegistrationLock)),
        () -> assertEquals(unrestrictedUnidentifiedAccess, account.isUnrestrictedUnidentifiedAccess())
--- a/service/src/test/java/org/whispersystems/textsecuregcm/storage/AccountsManagerTest.java
+++ b/service/src/test/java/org/whispersystems/textsecuregcm/storage/AccountsManagerTest.java
@@ -5,7 +5,12 @@

 package org.whispersystems.textsecuregcm.storage;

-import static org.junit.jupiter.api.Assertions.*;
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertSame;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyLong;
 import static org.mockito.ArgumentMatchers.argThat;
@@ -24,8 +29,6 @@ import static org.mockito.Mockito.when;

 import io.lettuce.core.RedisException;
 import io.lettuce.core.cluster.api.sync.RedisAdvancedClusterCommands;
-
-import java.nio.charset.StandardCharsets;
 import java.time.Clock;
 import java.time.Duration;
 import java.util.ArrayList;
@@ -46,6 +49,7 @@ import org.junit.jupiter.params.provider.Arguments;
 import org.junit.jupiter.params.provider.MethodSource;
 import org.junit.jupiter.params.provider.ValueSource;
 import org.mockito.stubbing.Answer;
+import org.signal.libsignal.protocol.IdentityKey;
 import org.signal.libsignal.protocol.ecc.Curve;
 import org.signal.libsignal.protocol.ecc.ECKeyPair;
 import org.whispersystems.textsecuregcm.configuration.dynamic.DynamicConfiguration;
@@ -473,10 +477,12 @@ class AccountsManagerTest {
        .doAnswer(ACCOUNT_UPDATE_ANSWER)
        .when(accounts).update(any());

-    account = accountsManager.update(account, a -> a.setIdentityKey("identity-key".getBytes(StandardCharsets.UTF_8)));
+    final IdentityKey identityKey = new IdentityKey(Curve.generateKeyPair().getPublicKey());
+
+    account = accountsManager.update(account, a -> a.setIdentityKey(identityKey));

    assertEquals(1, account.getVersion());
-    assertArrayEquals("identity-key".getBytes(StandardCharsets.UTF_8), account.getIdentityKey());
+    assertEquals(identityKey, account.getIdentityKey());

    verify(accounts, times(1)).getByAccountIdentifier(uuid);
    verify(accounts, times(2)).update(any());
@@ -669,7 +675,7 @@ class AccountsManagerTest {
    Account account = AccountsHelper.generateTestAccount(number, UUID.randomUUID(), UUID.randomUUID(), new ArrayList<>(), new byte[16]);
    assertThrows(IllegalArgumentException.class,
        () -> accountsManager.changeNumber(
-            account, number, "new-identity-key".getBytes(StandardCharsets.UTF_8), Map.of(1L, new SignedPreKey()), null, Map.of(1L, 101)),
+            account, number, new IdentityKey(Curve.generateKeyPair().getPublicKey()), Map.of(1L, new SignedPreKey()), null, Map.of(1L, 101)),
        "AccountsManager should not allow use of changeNumber with new PNI keys but without changing number");

    verify(accounts, never()).update(any());
@@ -728,7 +734,7 @@ class AccountsManagerTest {
    final List<Device> devices = List.of(DevicesHelper.createDevice(1L, 0L, 101), DevicesHelper.createDevice(2L, 0L, 102));
    final Account account = AccountsHelper.generateTestAccount(originalNumber, uuid, originalPni, devices, new byte[16]);
    final Account updatedAccount = accountsManager.changeNumber(
-        account, targetNumber, "new-pni-identity-key".getBytes(StandardCharsets.UTF_8), newSignedKeys, newSignedPqKeys, newRegistrationIds);
+        account, targetNumber, new IdentityKey(Curve.generateKeyPair().getPublicKey()), newSignedKeys, newSignedPqKeys, newRegistrationIds);

    assertEquals(targetNumber, updatedAccount.getNumber());

@@ -771,7 +777,9 @@ class AccountsManagerTest {
    UUID oldPni = account.getPhoneNumberIdentifier();
    Map<Long, SignedPreKey> oldSignedPreKeys = account.getDevices().stream().collect(Collectors.toMap(Device::getId, Device::getSignedPreKey));

-    final Account updatedAccount = accountsManager.updatePniKeys(account, "new-pni-identity-key".getBytes(StandardCharsets.UTF_8), newSignedKeys, null, newRegistrationIds);
+    final IdentityKey pniIdentityKey = new IdentityKey(Curve.generateKeyPair().getPublicKey());
+
+    final Account updatedAccount = accountsManager.updatePniKeys(account, pniIdentityKey, newSignedKeys, null, newRegistrationIds);

    // non-PNI stuff should not change
    assertEquals(oldUuid, updatedAccount.getUuid());
@@ -783,7 +791,7 @@ class AccountsManagerTest {
        updatedAccount.getDevices().stream().collect(Collectors.toMap(Device::getId, Device::getRegistrationId)));

    // PNI stuff should
-    assertArrayEquals("new-pni-identity-key".getBytes(StandardCharsets.UTF_8), updatedAccount.getPhoneNumberIdentityKey());
+    assertEquals(pniIdentityKey, updatedAccount.getPhoneNumberIdentityKey());
    assertEquals(newSignedKeys,
        updatedAccount.getDevices().stream().collect(Collectors.toMap(Device::getId, Device::getPhoneNumberIdentitySignedPreKey)));
    assertEquals(newRegistrationIds,
@@ -817,8 +825,10 @@ class AccountsManagerTest {

    Map<Long, SignedPreKey> oldSignedPreKeys = account.getDevices().stream().collect(Collectors.toMap(Device::getId, Device::getSignedPreKey));

+    final IdentityKey pniIdentityKey = new IdentityKey(Curve.generateKeyPair().getPublicKey());
+
    final Account updatedAccount =
-        accountsManager.updatePniKeys(account, "new-pni-identity-key".getBytes(StandardCharsets.UTF_8), newSignedKeys, newSignedPqKeys, newRegistrationIds);
+        accountsManager.updatePniKeys(account, pniIdentityKey, newSignedKeys, newSignedPqKeys, newRegistrationIds);

    // non-PNI-keys stuff should not change
    assertEquals(oldUuid, updatedAccount.getUuid());
@@ -830,7 +840,7 @@ class AccountsManagerTest {
        updatedAccount.getDevices().stream().collect(Collectors.toMap(Device::getId, Device::getRegistrationId)));

    // PNI keys should
-    assertArrayEquals("new-pni-identity-key".getBytes(StandardCharsets.UTF_8), updatedAccount.getPhoneNumberIdentityKey());
+    assertEquals(pniIdentityKey, updatedAccount.getPhoneNumberIdentityKey());
    assertEquals(newSignedKeys,
        updatedAccount.getDevices().stream().collect(Collectors.toMap(Device::getId, Device::getPhoneNumberIdentitySignedPreKey)));
    assertEquals(newRegistrationIds,
--- a/service/src/test/java/org/whispersystems/textsecuregcm/storage/ChangeNumberManagerTest.java
+++ b/service/src/test/java/org/whispersystems/textsecuregcm/storage/ChangeNumberManagerTest.java
@@ -14,7 +14,6 @@ import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;

-import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
 import java.util.Base64;
 import java.util.Collections;
@@ -27,6 +26,8 @@ import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.mockito.ArgumentCaptor;
 import org.mockito.stubbing.Answer;
+import org.signal.libsignal.protocol.IdentityKey;
+import org.signal.libsignal.protocol.ecc.Curve;
 import org.whispersystems.textsecuregcm.controllers.StaleDevicesException;
 import org.whispersystems.textsecuregcm.entities.IncomingMessage;
 import org.whispersystems.textsecuregcm.entities.MessageProtos;
@@ -106,7 +107,7 @@ public class ChangeNumberManagerTest {
    Account account = mock(Account.class);
    when(account.getNumber()).thenReturn("+18005551234");
    var prekeys = Map.of(1L, new SignedPreKey());
-    final byte[] pniIdentityKey = "pni-identity-key".getBytes(StandardCharsets.UTF_8);
+    final IdentityKey pniIdentityKey = new IdentityKey(Curve.generateKeyPair().getPublicKey());

    changeNumberManager.changeNumber(account, "+18025551234", pniIdentityKey, prekeys, null, Collections.emptyList(), Collections.emptyMap());
    verify(accountsManager).changeNumber(account, "+18025551234", pniIdentityKey, prekeys, null, Collections.emptyMap());
@@ -132,7 +133,7 @@ public class ChangeNumberManagerTest {
    when(account.getDevice(2L)).thenReturn(Optional.of(d2));
    when(account.getDevices()).thenReturn(List.of(d2));

-    final byte[] pniIdentityKey = "pni-identity-key".getBytes();
+    final IdentityKey pniIdentityKey = new IdentityKey(Curve.generateKeyPair().getPublicKey());
    final Map<Long, SignedPreKey> prekeys = Map.of(1L, new SignedPreKey(), 2L, new SignedPreKey());
    final Map<Long, Integer> registrationIds = Map.of(1L, 17, 2L, 19);

@@ -175,7 +176,7 @@ public class ChangeNumberManagerTest {
    when(account.getDevice(2L)).thenReturn(Optional.of(d2));
    when(account.getDevices()).thenReturn(List.of(d2));

-    final byte[] pniIdentityKey = "pni-identity-key".getBytes(StandardCharsets.UTF_8);
+    final IdentityKey pniIdentityKey = new IdentityKey(Curve.generateKeyPair().getPublicKey());
    final Map<Long, SignedPreKey> prekeys = Map.of(1L, new SignedPreKey(), 2L, new SignedPreKey());
    final Map<Long, SignedPreKey> pqPrekeys = Map.of(3L, new SignedPreKey(), 4L, new SignedPreKey());
    final Map<Long, Integer> registrationIds = Map.of(1L, 17, 2L, 19);
@@ -217,7 +218,7 @@ public class ChangeNumberManagerTest {
    when(account.getDevice(2L)).thenReturn(Optional.of(d2));
    when(account.getDevices()).thenReturn(List.of(d2));

-    final byte[] pniIdentityKey = "pni-identity-key".getBytes();
+    final IdentityKey pniIdentityKey = new IdentityKey(Curve.generateKeyPair().getPublicKey());
    final Map<Long, SignedPreKey> prekeys = Map.of(1L, new SignedPreKey(), 2L, new SignedPreKey());
    final Map<Long, SignedPreKey> pqPrekeys = Map.of(3L, new SignedPreKey(), 4L, new SignedPreKey());
    final Map<Long, Integer> registrationIds = Map.of(1L, 17, 2L, 19);
@@ -257,7 +258,7 @@ public class ChangeNumberManagerTest {
    when(account.getDevice(2L)).thenReturn(Optional.of(d2));
    when(account.getDevices()).thenReturn(List.of(d2));

-    final byte[] pniIdentityKey = "pni-identity-key".getBytes();
+    final IdentityKey pniIdentityKey = new IdentityKey(Curve.generateKeyPair().getPublicKey());
    final Map<Long, SignedPreKey> prekeys = Map.of(1L, new SignedPreKey(), 2L, new SignedPreKey());
    final Map<Long, Integer> registrationIds = Map.of(1L, 17, 2L, 19);

@@ -296,7 +297,7 @@ public class ChangeNumberManagerTest {
    when(account.getDevice(2L)).thenReturn(Optional.of(d2));
    when(account.getDevices()).thenReturn(List.of(d2));

-    final byte[] pniIdentityKey = "pni-identity-key".getBytes();
+    final IdentityKey pniIdentityKey = new IdentityKey(Curve.generateKeyPair().getPublicKey());
    final Map<Long, SignedPreKey> prekeys = Map.of(1L, new SignedPreKey(), 2L, new SignedPreKey());
    final Map<Long, SignedPreKey> pqPrekeys = Map.of(3L, new SignedPreKey(), 4L, new SignedPreKey());
    final Map<Long, Integer> registrationIds = Map.of(1L, 17, 2L, 19);
@@ -347,7 +348,7 @@ public class ChangeNumberManagerTest {
    final Map<Long, Integer> registrationIds = Map.of(1L, 17, 2L, 47, 3L, 89);

    assertThrows(StaleDevicesException.class,
-        () -> changeNumberManager.changeNumber(account, "+18005559876", "pni-identity-key".getBytes(StandardCharsets.UTF_8), preKeys, null, messages, registrationIds));
+        () -> changeNumberManager.changeNumber(account, "+18005559876", new IdentityKey(Curve.generateKeyPair().getPublicKey()), preKeys, null, messages, registrationIds));
  }

  @Test
@@ -377,7 +378,7 @@ public class ChangeNumberManagerTest {
    final Map<Long, Integer> registrationIds = Map.of(1L, 17, 2L, 47, 3L, 89);

    assertThrows(StaleDevicesException.class,
-        () -> changeNumberManager.updatePniKeys(account, "pni-identity-key".getBytes(StandardCharsets.UTF_8), preKeys, null, messages, registrationIds));
+        () -> changeNumberManager.updatePniKeys(account, new IdentityKey(Curve.generateKeyPair().getPublicKey()), preKeys, null, messages, registrationIds));
  }

  @Test
@@ -406,6 +407,6 @@ public class ChangeNumberManagerTest {
    final Map<Long, Integer> registrationIds = Map.of(1L, 17, 2L, 47, 3L, 89);

    assertThrows(IllegalArgumentException.class,
-        () -> changeNumberManager.changeNumber(account, "+18005559876", "pni-identity-key".getBytes(StandardCharsets.UTF_8), null, null, messages, registrationIds));
+        () -> changeNumberManager.changeNumber(account, "+18005559876", new IdentityKey(Curve.generateKeyPair().getPublicKey()), null, null, messages, registrationIds));
  }
 }
--- a/service/src/test/java/org/whispersystems/textsecuregcm/tests/controllers/CertificateControllerTest.java
+++ b/service/src/test/java/org/whispersystems/textsecuregcm/tests/controllers/CertificateControllerTest.java
@@ -113,7 +113,7 @@ class CertificateControllerTest {
    assertEquals(certificate.getSenderDevice(), 1L);
    assertTrue(certificate.hasSenderUuid());
    assertEquals(AuthHelper.VALID_UUID.toString(), certificate.getSenderUuid());
-    assertArrayEquals(certificate.getIdentityKey().toByteArray(), AuthHelper.VALID_IDENTITY);
+    assertArrayEquals(certificate.getIdentityKey().toByteArray(), AuthHelper.VALID_IDENTITY.serialize());
  }

  @Test
@@ -141,7 +141,7 @@ class CertificateControllerTest {
    assertEquals(certificate.getSender(), AuthHelper.VALID_NUMBER);
    assertEquals(certificate.getSenderDevice(), 1L);
    assertEquals(certificate.getSenderUuid(), AuthHelper.VALID_UUID.toString());
-    assertArrayEquals(certificate.getIdentityKey().toByteArray(), AuthHelper.VALID_IDENTITY);
+    assertArrayEquals(certificate.getIdentityKey().toByteArray(), AuthHelper.VALID_IDENTITY.serialize());
  }

  @Test
@@ -170,7 +170,7 @@ class CertificateControllerTest {
    assertTrue(StringUtils.isBlank(certificate.getSender()));
    assertEquals(certificate.getSenderDevice(), 1L);
    assertEquals(certificate.getSenderUuid(), AuthHelper.VALID_UUID.toString());
-    assertArrayEquals(certificate.getIdentityKey().toByteArray(), AuthHelper.VALID_IDENTITY);
+    assertArrayEquals(certificate.getIdentityKey().toByteArray(), AuthHelper.VALID_IDENTITY.serialize());
  }

  @Test
--- a/service/src/test/java/org/whispersystems/textsecuregcm/tests/controllers/DeviceControllerTest.java
+++ b/service/src/test/java/org/whispersystems/textsecuregcm/tests/controllers/DeviceControllerTest.java
@@ -42,6 +42,7 @@ import org.junit.jupiter.params.provider.Arguments;
 import org.junit.jupiter.params.provider.MethodSource;
 import org.junit.jupiter.params.provider.ValueSource;
 import org.mockito.ArgumentCaptor;
+import org.signal.libsignal.protocol.IdentityKey;
 import org.signal.libsignal.protocol.ecc.Curve;
 import org.signal.libsignal.protocol.ecc.ECKeyPair;
 import org.whispersystems.textsecuregcm.auth.AuthenticatedAccount;
@@ -277,8 +278,8 @@ class DeviceControllerTest {
    aciPqLastResortPreKey = Optional.of(KeysHelper.signedKEMPreKey(3, aciIdentityKeyPair));
    pniPqLastResortPreKey = Optional.of(KeysHelper.signedKEMPreKey(4, pniIdentityKeyPair));

-    when(account.getIdentityKey()).thenReturn(aciIdentityKeyPair.getPublicKey().serialize());
-    when(account.getPhoneNumberIdentityKey()).thenReturn(pniIdentityKeyPair.getPublicKey().serialize());
+    when(account.getIdentityKey()).thenReturn(new IdentityKey(aciIdentityKeyPair.getPublicKey()));
+    when(account.getPhoneNumberIdentityKey()).thenReturn(new IdentityKey(pniIdentityKeyPair.getPublicKey()));

    final LinkDeviceRequest request = new LinkDeviceRequest("5678901",
        new AccountAttributes(fetchesMessages, 1234, null, null, true, null),
@@ -363,8 +364,8 @@ class DeviceControllerTest {
    aciPqLastResortPreKey = Optional.of(KeysHelper.signedKEMPreKey(3, aciIdentityKeyPair));
    pniPqLastResortPreKey = Optional.of(KeysHelper.signedKEMPreKey(4, pniIdentityKeyPair));

-    when(account.getIdentityKey()).thenReturn(aciIdentityKeyPair.getPublicKey().serialize());
-    when(account.getPhoneNumberIdentityKey()).thenReturn(pniIdentityKeyPair.getPublicKey().serialize());
+    when(account.getIdentityKey()).thenReturn(new IdentityKey(aciIdentityKeyPair.getPublicKey()));
+    when(account.getPhoneNumberIdentityKey()).thenReturn(new IdentityKey(pniIdentityKeyPair.getPublicKey()));

    final LinkDeviceRequest request = new LinkDeviceRequest("5678901",
        new AccountAttributes(fetchesMessages, 1234, null, null, true, null),
@@ -392,8 +393,8 @@ class DeviceControllerTest {
  @ParameterizedTest
  @MethodSource
  @SuppressWarnings("OptionalUsedAsFieldOrParameterType")
-  void linkDeviceAtomicMissingProperty(final byte[] aciIdentityKey,
-                                       final byte[] pniIdentityKey,
+  void linkDeviceAtomicMissingProperty(final IdentityKey aciIdentityKey,
+                                       final IdentityKey pniIdentityKey,
                                       final Optional<SignedPreKey> aciSignedPreKey,
                                       final Optional<SignedPreKey> pniSignedPreKey,
                                       final Optional<SignedPreKey> aciPqLastResortPreKey,
@@ -439,8 +440,8 @@ class DeviceControllerTest {
    final Optional<SignedPreKey> aciPqLastResortPreKey = Optional.of(KeysHelper.signedKEMPreKey(3, aciIdentityKeyPair));
    final Optional<SignedPreKey> pniPqLastResortPreKey = Optional.of(KeysHelper.signedKEMPreKey(4, pniIdentityKeyPair));

-    final byte[] aciIdentityKey = aciIdentityKeyPair.getPublicKey().serialize();
-    final byte[] pniIdentityKey = pniIdentityKeyPair.getPublicKey().serialize();
+    final IdentityKey aciIdentityKey = new IdentityKey(aciIdentityKeyPair.getPublicKey());
+    final IdentityKey pniIdentityKey = new IdentityKey(pniIdentityKeyPair.getPublicKey());

    return Stream.of(
        Arguments.of(aciIdentityKey, pniIdentityKey, Optional.empty(), pniSignedPreKey, aciPqLastResortPreKey, pniPqLastResortPreKey),
@@ -452,8 +453,8 @@ class DeviceControllerTest {

  @ParameterizedTest
  @MethodSource
-  void linkDeviceAtomicInvalidSignature(final byte[] aciIdentityKey,
-                                        final byte[] pniIdentityKey,
+  void linkDeviceAtomicInvalidSignature(final IdentityKey aciIdentityKey,
+                                        final IdentityKey pniIdentityKey,
                                        final SignedPreKey aciSignedPreKey,
                                        final SignedPreKey pniSignedPreKey,
                                        final SignedPreKey aciPqLastResortPreKey,
@@ -499,8 +500,8 @@ class DeviceControllerTest {
    final SignedPreKey aciPqLastResortPreKey = KeysHelper.signedKEMPreKey(3, aciIdentityKeyPair);
    final SignedPreKey pniPqLastResortPreKey = KeysHelper.signedKEMPreKey(4, pniIdentityKeyPair);

-    final byte[] aciIdentityKey = aciIdentityKeyPair.getPublicKey().serialize();
-    final byte[] pniIdentityKey = pniIdentityKeyPair.getPublicKey().serialize();
+    final IdentityKey aciIdentityKey = new IdentityKey(aciIdentityKeyPair.getPublicKey());
+    final IdentityKey pniIdentityKey = new IdentityKey(pniIdentityKeyPair.getPublicKey());

    return Stream.of(
        Arguments.of(aciIdentityKey, pniIdentityKey, signedPreKeyWithBadSignature(aciSignedPreKey), pniSignedPreKey, aciPqLastResortPreKey, pniPqLastResortPreKey),
--- a/service/src/test/java/org/whispersystems/textsecuregcm/tests/controllers/KeysControllerTest.java
+++ b/service/src/test/java/org/whispersystems/textsecuregcm/tests/controllers/KeysControllerTest.java
@@ -39,6 +39,7 @@ import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
 import org.mockito.ArgumentCaptor;
+import org.signal.libsignal.protocol.IdentityKey;
 import org.signal.libsignal.protocol.ecc.Curve;
 import org.signal.libsignal.protocol.ecc.ECKeyPair;
 import org.whispersystems.textsecuregcm.auth.AuthenticatedAccount;
@@ -80,10 +81,10 @@ class KeysControllerTest {
  private static final int SAMPLE_PNI_REGISTRATION_ID = 1717;

  private final ECKeyPair IDENTITY_KEY_PAIR = Curve.generateKeyPair();
-  private final byte[] IDENTITY_KEY = IDENTITY_KEY_PAIR.getPublicKey().serialize();
+  private final IdentityKey IDENTITY_KEY = new IdentityKey(IDENTITY_KEY_PAIR.getPublicKey());
  
  private final ECKeyPair PNI_IDENTITY_KEY_PAIR = Curve.generateKeyPair();
-  private final byte[] PNI_IDENTITY_KEY = PNI_IDENTITY_KEY_PAIR.getPublicKey().serialize();
+  private final IdentityKey PNI_IDENTITY_KEY = new IdentityKey(PNI_IDENTITY_KEY_PAIR.getPublicKey());
  
  private final PreKey SAMPLE_KEY = KeysHelper.ecPreKey(1234);
  private final PreKey SAMPLE_KEY2 = KeysHelper.ecPreKey(5667);
@@ -658,7 +659,7 @@ class KeysControllerTest {
    final PreKey preKey = KeysHelper.ecPreKey(31337);
    final ECKeyPair identityKeyPair = Curve.generateKeyPair();
    final SignedPreKey signedPreKey = KeysHelper.signedECPreKey(31338, identityKeyPair);
-    final byte[] identityKey = identityKeyPair.getPublicKey().serialize();
+    final IdentityKey identityKey = new IdentityKey(identityKeyPair.getPublicKey());

    PreKeyState preKeyState = new PreKeyState(identityKey, signedPreKey, List.of(preKey));

@@ -688,7 +689,7 @@ class KeysControllerTest {
    final SignedPreKey signedPreKey = KeysHelper.signedECPreKey(31338, identityKeyPair);
    final SignedPreKey pqPreKey = KeysHelper.signedKEMPreKey(31339, identityKeyPair);
    final SignedPreKey pqLastResortPreKey = KeysHelper.signedKEMPreKey(31340, identityKeyPair);
-    final byte[] identityKey = identityKeyPair.getPublicKey().serialize();
+    final IdentityKey identityKey = new IdentityKey(identityKeyPair.getPublicKey());

    PreKeyState preKeyState = new PreKeyState(identityKey, signedPreKey, List.of(preKey), List.of(pqPreKey), pqLastResortPreKey);

@@ -716,7 +717,7 @@ class KeysControllerTest {
  @Test
  void putKeysStructurallyInvalidSignedECKey() {
    final ECKeyPair identityKeyPair = Curve.generateKeyPair();
-    final byte[] identityKey = identityKeyPair.getPublicKey().serialize();
+    final IdentityKey identityKey = new IdentityKey(identityKeyPair.getPublicKey());
    final SignedPreKey wrongPreKey = KeysHelper.signedKEMPreKey(1, identityKeyPair);
    final PreKeyState preKeyState = new PreKeyState(identityKey, wrongPreKey, null, null, null);

@@ -729,11 +730,11 @@ class KeysControllerTest {

    assertThat(response.getStatus()).isEqualTo(422);
  }
-  
+
  @Test
  void putKeysStructurallyInvalidUnsignedECKey() {
    final ECKeyPair identityKeyPair = Curve.generateKeyPair();
-    final byte[] identityKey = identityKeyPair.getPublicKey().serialize();
+    final IdentityKey identityKey = new IdentityKey(identityKeyPair.getPublicKey());
    final PreKey wrongPreKey = new PreKey(1, "cluck cluck i'm a parrot".getBytes());
    final PreKeyState preKeyState = new PreKeyState(identityKey, null, List.of(wrongPreKey), null, null);

@@ -746,11 +747,11 @@ class KeysControllerTest {

    assertThat(response.getStatus()).isEqualTo(422);
  }
-  
+
  @Test
  void putKeysStructurallyInvalidPQOneTimeKey() {
    final ECKeyPair identityKeyPair = Curve.generateKeyPair();
-    final byte[] identityKey = identityKeyPair.getPublicKey().serialize();
+    final IdentityKey identityKey = new IdentityKey(identityKeyPair.getPublicKey());
    final SignedPreKey wrongPreKey = KeysHelper.signedECPreKey(1, identityKeyPair);
    final PreKeyState preKeyState = new PreKeyState(identityKey, null, null, List.of(wrongPreKey), null);

@@ -763,11 +764,11 @@ class KeysControllerTest {

    assertThat(response.getStatus()).isEqualTo(422);
  }
-  
+
  @Test
  void putKeysStructurallyInvalidPQLastResortKey() {
    final ECKeyPair identityKeyPair = Curve.generateKeyPair();
-    final byte[] identityKey = identityKeyPair.getPublicKey().serialize();
+    final IdentityKey identityKey = new IdentityKey(identityKeyPair.getPublicKey());
    final SignedPreKey wrongPreKey = KeysHelper.signedECPreKey(1, identityKeyPair);
    final PreKeyState preKeyState = new PreKeyState(identityKey, null, null, null, wrongPreKey);

@@ -780,13 +781,13 @@ class KeysControllerTest {

    assertThat(response.getStatus()).isEqualTo(422);
  }
-  
+
  @Test
  void putKeysByPhoneNumberIdentifierTestV2() {
    final PreKey preKey = KeysHelper.ecPreKey(31337);
    final ECKeyPair identityKeyPair = Curve.generateKeyPair();
    final SignedPreKey signedPreKey = KeysHelper.signedECPreKey(31338, identityKeyPair);
-    final byte[] identityKey = identityKeyPair.getPublicKey().serialize();
+    final IdentityKey identityKey = new IdentityKey(identityKeyPair.getPublicKey());

    PreKeyState preKeyState = new PreKeyState(identityKey, signedPreKey, List.of(preKey));

@@ -817,7 +818,7 @@ class KeysControllerTest {
    final SignedPreKey signedPreKey = KeysHelper.signedECPreKey(31338, identityKeyPair);
    final SignedPreKey pqPreKey = KeysHelper.signedKEMPreKey(31339, identityKeyPair);
    final SignedPreKey pqLastResortPreKey = KeysHelper.signedKEMPreKey(31340, identityKeyPair);
-    final byte[] identityKey = identityKeyPair.getPublicKey().serialize();
+    final IdentityKey identityKey = new IdentityKey(identityKeyPair.getPublicKey());

    PreKeyState preKeyState = new PreKeyState(identityKey, signedPreKey, List.of(preKey), List.of(pqPreKey), pqLastResortPreKey);

@@ -860,10 +861,10 @@ class KeysControllerTest {

  @Test
  void disabledPutKeysTestV2() {
-    final PreKey       preKey       = KeysHelper.ecPreKey(31337);
+    final PreKey preKey = KeysHelper.ecPreKey(31337);
    final ECKeyPair identityKeyPair = Curve.generateKeyPair();
    final SignedPreKey signedPreKey = KeysHelper.signedECPreKey(31338, identityKeyPair);
-    final byte[]       identityKey  = identityKeyPair.getPublicKey().serialize();
+    final IdentityKey identityKey = new IdentityKey(identityKeyPair.getPublicKey());

    PreKeyState preKeyState = new PreKeyState(identityKey, signedPreKey, List.of(preKey));

--- a/service/src/test/java/org/whispersystems/textsecuregcm/tests/util/AuthHelper.java
+++ b/service/src/test/java/org/whispersystems/textsecuregcm/tests/util/AuthHelper.java
@@ -20,6 +20,8 @@ import java.util.Base64;
 import java.util.Optional;
 import java.util.Random;
 import java.util.UUID;
+import org.signal.libsignal.protocol.IdentityKey;
+import org.signal.libsignal.protocol.ecc.ECPublicKey;
 import org.whispersystems.textsecuregcm.auth.AccountAuthenticator;
 import org.whispersystems.textsecuregcm.auth.AuthenticatedAccount;
 import org.whispersystems.textsecuregcm.auth.DisabledPermittedAccountAuthenticator;
@@ -63,7 +65,8 @@ public class AuthHelper {
  public static final UUID   UNDISCOVERABLE_UUID     = UUID.randomUUID();
  public static final String UNDISCOVERABLE_PASSWORD = "IT'S A SECRET TO EVERYBODY.";

-  public static final byte[] VALID_IDENTITY = Base64.getDecoder().decode("BcxxDU9FGMda70E7+Uvm7pnQcEdXQ64aJCpPUeRSfcFo");
+  public static final IdentityKey VALID_IDENTITY = new IdentityKey(ECPublicKey.fromPublicKeyBytes(
+      Base64.getDecoder().decode("BcxxDU9FGMda70E7+Uvm7pnQcEdXQ64aJCpPUeRSfcFo")));

  public static AccountsManager ACCOUNTS_MANAGER       = mock(AccountsManager.class);
  public static Account         VALID_ACCOUNT          = mock(Account.class        );