Repository: wultra/powerauth-crypto
Pull request #377 (2021-05-12 11:32:38)

Prepare release 1.1.0
Merge of all commits from `develop` into `master`.


Patch:
diff --git a/docs/Activation-Code.md b/docs/Activation-Code.md
index cc6d6e4b..6d8562a8 100644
--- a/docs/Activation-Code.md
+++ b/docs/Activation-Code.md
@@ -1,6 +1,6 @@
 # Activation Code
 
-The PowerAuth protocol 3, defines a new version of activation code, where OTP<sup>1</sup> is no longer applied. The format of the code is the same (four groups, each group is composed from five Base32 characters), but the code is no longer split into `OTP` and `SHORT_ID` parts. The new code has following features:
+The PowerAuth protocol 3, defines a new version of activation code, where OTP<sup>1</sup> is no longer applied. The format of the code is the same (four groups, each group is composed of five Base32 characters), but the code is no longer split into `OTP` and `SHORT_ID` parts. The new code has following features:
 
 - The whole code is now a short activation identifier, and we call it simply `ACTIVATION_CODE`. This principally means, that the code is no longer used in the cryptographic calculations.
 - The code is using `CRC-16/ARC` to detect a typing errors. This is useful for scenarios, where the user needs to re-type the code manually.
diff --git a/docs/Additional-Activation-OTP.md b/docs/Additional-Activation-OTP.md
index b5456ca9..090eb81a 100644
--- a/docs/Additional-Activation-OTP.md
+++ b/docs/Additional-Activation-OTP.md
@@ -25,7 +25,7 @@ In this common scenario, it's expected that the PowerAuth activation is not yet
 1. User is authenticated in Master Front-End Application and initiates the activation creation process:
 
    1. Master Front-End Application generates random activation OTP.
-   1. Master Front-End Application then asks PowerAuth server to create an activation, with using this OTP ([`initActivation`](https://github.com/wultra/powerauth-server/blob/develop/docs/SOAP-Service-Methods.md#method-initactivation) method, OTP validation set to ON_KEY_EXCHANGE).
+   1. Master Front-End Application then asks PowerAuth server to create an activation, with using this OTP ([`initActivation`](https://github.com/wultra/powerauth-server/blob/develop/docs/WebServices-Methods.md#method-initactivation) method, OTP validation set to ON_KEY_EXCHANGE).
    1. Master Front-End Application then displays QR code, containing an activation code.
    1. At the same time, Master Front-End Application initiates the delivery of activation OTP. It's recommended to deliver such code via a dedicated out-of-band channel, for example, via SMS.
    
@@ -38,7 +38,7 @@ In this common scenario, it's expected that the PowerAuth activation is not yet
 
 1. Intermediate Server Application receives activation with activation code and OTP:
  
-   1. The activation code and OTP are verified by the PowerAuth server in the [`prepareActivation`](https://github.com/wultra/powerauth-server/blob/develop/docs/SOAP-Service-Methods.md#method-prepareactivation) method. 
+   1. The activation code and OTP are verified by the PowerAuth server in the [`prepareActivation`](https://github.com/wultra/powerauth-server/blob/develop/docs/WebServices-Methods.md#method-prepareactivation) method. 
    1. If the method call succeeds, the activation is set to the ACTIVE state. There's no need to wait for the confirmation.
    1. In case that received OTP is wrong, the user has a limited number of retry attempts. The activation will be removed after too many failures. 
 
@@ -65,7 +65,7 @@ There are multiple ways how to implement custom activation with an additional au
 1. Intermediate Server Application receives a custom activation request, with username, password, and OTP:
 
    1. The username, password, and OTP is verified by the Intermediate Server Application.
-   1. If everything's right, then Intermediate Server Application creates activation by calling [`createActivation`](https://github.com/wultra/powerauth-server/blob/develop/docs/SOAP-Service-Methods.md#method-createactivation). The activation state can be set to ACTIVE.
+   1. If everything's right, then Intermediate Server Application creates activation by calling [`createActivation`](https://github.com/wultra/powerauth-server/blob/develop/docs/WebServices-Methods.md#method-createactivation). The activation state can be set to ACTIVE.
 
 1. The mobile application receives the response from the server and completes the activation on the mobile side.
 
@@ -80,7 +80,7 @@ In this common scenario, an additional activation OTP helps with the final activ
 1. User is authenticated in Master Front-End Application and initiates the activation creation process:
 
    1. Master Front-End Application generates random activation OTP and keeps it temporarily in the database.
-   1. Master Front-End Application then asks PowerAuth server to create an activation, with using this OTP ([`initActivation`](https://github.com/wultra/powerauth-server/blob/develop/docs/SOAP-Service-Methods.md#method-initactivation) method, OTP validation set to ON_COMMIT).
+   1. Master Front-End Application then asks PowerAuth server to create an activation, with using this OTP ([`initActivation`](https://github.com/wultra/powerauth-server/blob/develop/docs/WebServices-Methods.md#method-initactivation) method, OTP validation set to ON_COMMIT).
    1. Master Front-End Application then displays QR code, containing an activation code.
 
 1. In the mobile application: 
@@ -90,7 +90,7 @@ In this common scenario, an additional activation OTP helps with the final activ
 
 1. Intermediate Server Application receives a regular activation request, with activation code:
    
-   1. The activation code is verified by the PowerAuth server in the [`prepareActivation`](https://github.com/wultra/powerauth-server/blob/develop/docs/SOAP-Service-Methods.md#method-prepareactivation) method. 
+   1. The activation code is verified by the PowerAuth server in the [`prepareActivation`](https://github.com/wultra/powerauth-server/blob/develop/docs/WebServices-Methods.md#method-prepareactivation) method. 
    1. If the method call succeeds, the activation is set to the PENDING_COMMIT state.
    1. At the same time, Intermediate Server Application initiates the delivery of activation OTP. It's recommended to deliver such code via a dedicated out-of-band channel, for example, via SMS.
 
@@ -98,13 +98,13 @@ In this common scenario, an additional activation OTP helps with the final activ
    
 Now it depends whether the user has to retype OTP back to the Master Front-End Application, or the mobile application.
  
-1. For the first case, the implementation is straightforward. Once the user retypes OTP back to Master Front-End Application, the activation can be completed on PowerAuth Server by calling [`commitActivation`](https://github.com/wultra/powerauth-server/blob/develop/docs/SOAP-Service-Methods.md#method-commitactivation) method. In case the commit fails, the number of commit attempts is limited to the [`MAX_FAILED_ATTEMPTS`](Computing-and-Validating-Signatures.md#constants-and-variables).
+1. For the first case, the implementation is straightforward. Once the user retypes OTP back to Master Front-End Application, the activation can be completed on PowerAuth Server by calling [`commitActivation`](https://github.com/wultra/powerauth-server/blob/develop/docs/WebServices-Methods.md#method-commitactivation) method. In case the commit fails, the number of commit attempts is limited to the [`MAX_FAILED_ATTEMPTS`](Computing-and-Validating-Signatures.md#constants-and-variables).
 
 2. In case the OTP is retyped in the mobile application, the additional RESTful endpoint has to be implemented on the Intermediate Server Application. We recommend to use our [ECIES encryption](End-To-End-Encryption.md) to protect such endpoint. In case the commit fails, the number of commit attempts is limited to the [`MAX_FAILED_ATTEMPTS`](Computing-and-Validating-Signatures.md#constants-and-variables). 
 
-For both cases, it's recommended to generate a new OTP in case that delivery failed (e.g. user did not receive SMS). You can use [`updateActivationOtp`](https://github.com/wultra/powerauth-server/blob/develop/docs/SOAP-Service-Methods.md#method-updateactivationotp) method to set a new OTP to the PowerAuth Server.
+For both cases, it's recommended to generate a new OTP in case that delivery failed (e.g. user did not receive SMS). You can use [`updateActivationOtp`](https://github.com/wultra/powerauth-server/blob/develop/docs/WebServices-Methods.md#method-updateactivationotp) method to set a new OTP to the PowerAuth Server.
 
-You can also slightly alter this whole sequence, and generate the first OTP later, in the step 3. In this case, you have to use [`updateActivationOtp`](https://github.com/wultra/powerauth-server/blob/develop/docs/SOAP-Service-Methods.md#method-updateactivationotp) in the same step, to set the OTP. 
+You can also slightly alter this whole sequence, and generate the first OTP later, in the step 3. In this case, you have to use [`updateActivationOtp`](https://github.com/wultra/powerauth-server/blob/develop/docs/WebServices-Methods.md#method-updateactivationotp) in the same step, to set the OTP. 
 
 ### Confirm custom activation with OTP
 
@@ -118,8 +118,8 @@ There are multiple ways how to implement custom activation and confirm it with a
 1. Intermediate Server Application receives a custom activation request, with username and password:
 
    1. The username and password is verified by the Intermediate Server Application.
-   1. If everything's right, then Intermediate Server Application creates activation by calling [`createActivation`](https://github.com/wultra/powerauth-server/blob/develop/docs/SOAP-Service-Methods.md#method-createactivation). The activation must be set to the PENDING_COMMIT state.
-   1. Intermediate Server Application generates random activation OTP and update the activation record, by calling [`updateActivationOtp`](https://github.com/wultra/powerauth-server/blob/develop/docs/SOAP-Service-Methods.md#method-updateactivationotp) method.
+   1. If everything's right, then Intermediate Server Application creates activation by calling [`createActivation`](https://github.com/wultra/powerauth-server/blob/develop/docs/WebServices-Methods.md#method-createactivation). The activation must be set to the PENDING_COMMIT state.
+   1. Intermediate Server Application generates random activation OTP and update the activation record, by calling [`updateActivationOtp`](https://github.com/wultra/powerauth-server/blob/develop/docs/WebServices-Methods.md#method-updateactivationotp) method.
    1. At the same time, Intermediate Server Application initiates the delivery of activation OTP.
    
 1. Back in the mobile application:
@@ -132,7 +132,7 @@ There are multiple ways how to implement custom activation and confirm it with a
 1. Intermediate Server Application then receives the commit request:
 
    1. Decrypts OTP from the request
-   1. Commits the activation by calling PowerAuth Server's [`commitActivation`](https://github.com/wultra/powerauth-server/blob/develop/docs/SOAP-Service-Methods.md#method-commitactivation) method.
+   1. Commits the activation by calling PowerAuth Server's [`commitActivation`](https://github.com/wultra/powerauth-server/blob/develop/docs/WebServices-Methods.md#method-commitactivation) method.
 
 After the response from the commit is received on the mobile side, the application can check whether the activation's state is ACTIVE.
 
@@ -147,8 +147,8 @@ The confirmation of activation recovery is very similar to custom activation con
 
 1. Intermediate Server Application receives a recovery activation request:
 
-   1. The recovery code and PUK is verified by the PowerAuth Server, by calling [`recoveryCodeActivation`](https://github.com/wultra/powerauth-server/blob/develop/docs/SOAP-Service-Methods.md#method-recoverycodeactivation).
-   1. Intermediate Server Application generates random activation OTP and update the activation record, by calling [`updateActivationOtp`](https://github.com/wultra/powerauth-server/blob/develop/docs/SOAP-Service-Methods.md#method-updateactivationotp) method.
+   1. The recovery code and PUK is verified by the PowerAuth Server, by calling [`recoveryCodeActivation`](https://github.com/wultra/powerauth-server/blob/develop/docs/WebServices-Methods.md#method-recoverycodeactivation).
+   1. Intermediate Server Application generates random activation OTP and update the activation record, by calling [`updateActivationOtp`](https://github.com/wultra/powerauth-server/blob/develop/docs/WebServices-Methods.md#method-updateactivationotp) method.
    1. At the same time, Intermediate Server Application initiates the delivery of activation OTP.
    
 1. Back in the mobile application:
@@ -161,6 +161,6 @@ The confirmation of activation recovery is very similar to custom activation con
 1. Intermediate Server Application then receives the commit request:
 
    1. Decrypts OTP from the request.
-   1. Commits the activation by calling PowerAuth Server's [`commitActivation`](https://github.com/wultra/powerauth-server/blob/develop/docs/SOAP-Service-Methods.md#method-commitactivation) method.
+   1. Commits the activation by calling PowerAuth Server's [`commitActivation`](https://github.com/wultra/powerauth-server/blob/develop/docs/WebServices-Methods.md#method-commitactivation) method.
 
 After the response from the commit is received on the mobile side, the application can check whether the activation's state is ACTIVE.
\ No newline at end of file
diff --git a/docs/PowerAuth-2017.11.md b/docs/PowerAuth-2017.11.md
index c5dd6203..95a76e29 100644
--- a/docs/PowerAuth-2017.11.md
+++ b/docs/PowerAuth-2017.11.md
@@ -54,7 +54,7 @@ In case you are updating from older versions of PA stack, you might meet followi
 
 ```java
 public class MyEncryptedObjectResponse<T> extends ObjectResponse<T> {
-    private String encryption = "nonpersonalized";
+    private final String encryption = "nonpersonalized";
     // ... getters and setters
 }
 ```
diff --git a/docs/PowerAuth-2020.11.md b/docs/PowerAuth-2020.11.md
index 24318f97..99f88ee2 100644
--- a/docs/PowerAuth-2020.11.md
+++ b/docs/PowerAuth-2020.11.md
@@ -64,7 +64,8 @@ For updating to 2020.11, please follow these migration guides:
 | PowerAuth Cryptography Provider | `powerauth-java-prov.jar` | 1.0.0 | Abstraction on top of cryptography providers, so that Bouncy Castle can be switched to other implementation more easily. |
 | PowerAuth Command-Line Tool Library | `powerauth-java-cmd-lib.jar` | 1.0.0 | Library used for implementation of the PowerAuth Command-Line Tool app, useful for unit testing. |
 | PowerAuth RESTful Security Base Support | `powerauth-restful-security-base.jar` | 1.0.0 | Base classes for RESTful API security, shared between JAX-RS and Spring implementations. |
-| Wultra Java Networking Objects | `rest-model-base.jar` | 1.1.0 | Base classes for RESTful API networking, shared across all Wultra back-end projects. |
+| Wultra Java Networking Objects | `rest-model-base.jar` | 1.2.0 | Base classes for RESTful API networking, shared across all Wultra back-end projects. |
+| Wultra REST Client | `rest-client-base.jar` | 1.2.0 | Base RESTful client implementation, shared across all Wultra back-end projects. |
 
 ## Known Issues When Updating From Older Versions
 
diff --git a/docs/PowerAuth-2021.05.md b/docs/PowerAuth-2021.05.md
new file mode 100644
index 00000000..66f4d749
--- /dev/null
+++ b/docs/PowerAuth-2021.05.md
@@ -0,0 +1,69 @@
+# PowerAuth 2021.05
+
+## Migration guides
+
+For updating to 2021.05, please follow these migration guides:
+
+- [PowerAuth Server - Migration from version 1.1.0 to version 1.1.0](https://github.com/wultra/powerauth-server/blob/develop/docs/PowerAuth-Server-1.1.0.md)
+- [PowerAuth Push Server - Migration from version 1.1.0 to version 1.1.0](https://github.com/wultra/powerauth-push-server/blob/develop/docs/PowerAuth-Push-Server-1.1.0.md)
+- [PowerAuth Web Flow - Migration from version 1.1.0 to version 1.1.0](https://github.com/wultra/powerauth-webflow/blob/develop/docs/Web-Flow-1.1.0.md)
+- [PowerAuth Mobile SDK - Migration from version 1.5.0 to version 1.6.0](https://github.com/wultra/powerauth-mobile-sdk/blob/develop/docs/Migration-from-1.5-to-1.6.md)
+
+## Components for version 2021.05
+
+### Back-End Applications
+
+| Component | Application Name | Version | Description |
+|---|---|---|---|
+| PowerAuth Server | `powerauth-java-server.war` | 1.1.0 | Core back-end component for PowerAuth stack. |
+| PowerAuth Admin | `powerauth-admin.war` | 1.1.0 | Administration console for PowerAuth Server. |
+| PowerAuth Push Server | `powerauth-push-server.war` | 1.1.0 | Simple to deploy push server for APNS and FCM. |
+| PowerAuth Web Flow | `powerauth-webflow.war` | 1.1.0 | Central web authentication page. |
+| PowerAuth Next Step | `powerauth-next-step.war` | 1.1.0 | Authorization server used for PowerAuth Web Flow component. |
+| PowerAuth Data Adapter | `powerauth-data-adapter.war` | 1.1.0 | Customization component for PowerAuth Web Flow. |
+| PowerAuth Tpp Engine | `powerauth-tpp-engine.war` | 1.1.0 | Third party provider registry and consent engine. |
+
+### Utilities
+
+| Component | Application Name | Version | Description |
+|---|---|---|---|
+| PowerAuth Command Line Tool | `powerauth-java-cmd.jar` | 1.1.0 | Command line tool for integration testing. |
+
+### Mobile Libraries
+
+| Platform | Package Name | Version | Description |
+|---|---|---|---|
+| iOS | `PowerAuth2` | 1.6.0 | A client library for iOS. |
+| watchOS | `PowerAuth2ForWatch` | 1.6.0 | A limited library for watchOS. |
+| iOS App Extensions | `PowerAuth2ForExtensions` | 1.6.0 | A limited library for iOS App Extensions. |
+| Android | `com.wultra.android.powerauth:powerauth-sdk` | 1.6.0 | A client library for Android. |
+
+### Back-End Integration Libraries
+
+| Component | Library Name |  Version | Description |
+|---|---|---|---|
+| PowerAuth RESTful Model | `powerauth-restful-model.jar` | 1.1.0 | Model classes for request and response objects used in PowerAuth Standard RESTful API. |
+| PowerAuth RESTful API Security for Spring | `powerauth-restful-security-spring.jar` | 1.1.0 | High-level integration libraries for RESTful API security, build for Spring MVC. |
+| PowerAuth SOAP Client for Spring WS | `powerauth-java-client-spring.jar` | 1.1.0 | SOAP service client for PowerAuth Server service, built using Spring WS. |
+| PowerAuth Push Server RESTful Model | `powerauth-push-model.jar` | 1.1.0 | Model classes for request and response objects used in PowerAuth Push Server. |
+| PowerAuth Push Server RESTful Client | `powerauth-push-client.jar` | 1.1.0 | Client implementation that simplifies integration with PowerAuth Push Server service. |
+| PowerAuth Data Adapter RESTful Model | `powerauth-data-adapter-model.jar` | 1.1.0 | Model classes for request and response objects used in PowerAuth Data Adapter component. |
+| PowerAuth Data Adapter Client | `powerauth-data-adapter-client.jar` | 1.1.0 | Client implementation that simplifies integration with PowerAuth Data Adapter custom component. |
+| PowerAuth Next Step RESTful Model | `powerauth-nextstep-model.jar` | 1.1.0 | Model classes for request and response objects used in PowerAuth Next Step service. |
+| PowerAuth Next Step Client | `powerauth-nextstep-client.jar` | 1.1.0 | Client implementation that simplifies integration with PowerAuth Next Step service. |
+| PowerAuth Mobile Token Model | `powerauth-mtoken-model.jar` | 1.1.0 | Model classes for request and response objects used in PowerAuth Mobile Token. |
+
+### Technical Dependencies
+
+| Component | Library Name | Version | Description |
+|---|---|---|---|
+| PowerAuth Cryptography | `powerauth-java-crypto.jar` | 1.1.0 | Core cryptography implementation of the PowerAuth protocol. |
+| PowerAuth HTTP Utilities | `powerauth-java-http.jar` | 1.1.0 | Utilities used for binding PowerAuth cryptography to HTTP technology. |
+| PowerAuth Command-Line Tool Library | `powerauth-java-cmd-lib.jar` | 1.1.0 | Library used for implementation of the PowerAuth Command-Line Tool app, useful for unit testing. |
+| PowerAuth RESTful Security Base Support | `powerauth-restful-security-base.jar` | 1.1.0 | Base classes for RESTful API security. |
+| Wultra Java Networking Objects | `rest-model-base.jar` | 1.3.0 | Base classes for RESTful API networking, shared across all Wultra back-end projects. |
+| Wultra REST Client | `rest-client-base.jar` | 1.3.0 | Base RESTful client implementation, shared across all Wultra back-end projects. |
+
+## Known Issues When Updating From Older Versions
+
+_No known issues so far._
\ No newline at end of file
diff --git a/pom.xml b/pom.xml
index 903dbb60..ad9ce2be 100644
--- a/pom.xml
+++ b/pom.xml
@@ -25,7 +25,7 @@
 
     <groupId>io.getlime.security</groupId>
     <artifactId>powerauth-crypto-parent</artifactId>
-    <version>1.0.0</version>
+    <version>1.1.0</version>
     <packaging>pom</packaging>
 
     <inceptionYear>2016</inceptionYear>
@@ -73,10 +73,10 @@
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <maven.compiler.source>1.8</maven.compiler.source>
         <maven.compiler.target>1.8</maven.compiler.target>
-        <maven-jar-plugin.version>3.1.2</maven-jar-plugin.version>
+        <maven-jar-plugin.version>3.2.0</maven-jar-plugin.version>
         <maven-deploy-plugin.version>3.0.0-M1</maven-deploy-plugin.version>
-        <maven-javadoc-plugin.version>3.1.1</maven-javadoc-plugin.version>
-        <maven-source-plugin.version>3.1.0</maven-source-plugin.version>
+        <maven-javadoc-plugin.version>3.2.0</maven-javadoc-plugin.version>
+        <maven-source-plugin.version>3.2.1</maven-source-plugin.version>
     </properties>
 
     <build>
@@ -138,7 +138,7 @@
                     <plugin>
                         <groupId>org.apache.maven.plugins</groupId>
                         <artifactId>maven-gpg-plugin</artifactId>
-                        <version>1.6</version>
+                        <version>3.0.1</version>
                         <executions>
                             <execution>
                                 <id>sign-artifacts</id>
@@ -165,11 +165,11 @@
 
     <distributionManagement>
         <snapshotRepository>
-            <id>ossrh</id>
+            <id>ossrh-snapshots-distribution</id>
             <url>https://oss.sonatype.org/content/repositories/snapshots/</url>
         </snapshotRepository>
         <repository>
-            <id>ossrh</id>
+            <id>ossrh-staging-distribution</id>
             <url>https://oss.sonatype.org/service/local/staging/deploy/maven2/</url>
         </repository>
     </distributionManagement>
diff --git a/powerauth-java-crypto/pom.xml b/powerauth-java-crypto/pom.xml
index c2eb1809..735b0aec 100644
--- a/powerauth-java-crypto/pom.xml
+++ b/powerauth-java-crypto/pom.xml
@@ -21,13 +21,13 @@
 	<modelVersion>4.0.0</modelVersion>
 
 	<artifactId>powerauth-java-crypto</artifactId>
-	<version>1.0.0</version>
+	<version>1.1.0</version>
 	<packaging>jar</packaging>
 
 	<parent>
 		<groupId>io.getlime.security</groupId>
 		<artifactId>powerauth-crypto-parent</artifactId>
-		<version>1.0.0</version>
+		<version>1.1.0</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 
@@ -35,7 +35,7 @@
 		<dependency>
 			<groupId>com.google.guava</groupId>
 			<artifactId>guava</artifactId>
-			<version>30.0-jre</version>
+			<version>30.1.1-jre</version>
 		</dependency>
 		<dependency>
 			<groupId>org.slf4j</groupId>
@@ -45,13 +45,13 @@
 		<dependency>
 			<groupId>junit</groupId>
 			<artifactId>junit</artifactId>
-			<version>4.13.1</version>
+			<version>4.13.2</version>
 			<scope>test</scope>
 		</dependency>
 		<dependency>
 			<groupId>com.fasterxml.jackson.core</groupId>
 			<artifactId>jackson-databind</artifactId>
-			<version>2.11.3</version>
+			<version>2.12.3</version>
 			<scope>test</scope>
 		</dependency>
 		<dependency>
@@ -64,7 +64,7 @@
 		<dependency>
 			<groupId>org.bouncycastle</groupId>
 			<artifactId>bcprov-jdk15on</artifactId>
-			<version>1.67</version>
+			<version>1.68</version>
 			<scope>provided</scope>
 		</dependency>
 	</dependencies>
diff --git a/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/client/encryptor/ClientNonPersonalizedEncryptor.java b/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/client/encryptor/ClientNonPersonalizedEncryptor.java
index dfe56c6b..f48ddad8 100644
--- a/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/client/encryptor/ClientNonPersonalizedEncryptor.java
+++ b/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/client/encryptor/ClientNonPersonalizedEncryptor.java
@@ -27,7 +27,7 @@ import java.security.PublicKey;
  */
 public class ClientNonPersonalizedEncryptor {
 
-    private NonPersonalizedEncryptor encryptor;
+    private final NonPersonalizedEncryptor encryptor;
 
     private final KeyConvertor keyConvertor = new KeyConvertor();
 
diff --git a/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/encryptor/NonPersonalizedEncryptor.java b/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/encryptor/NonPersonalizedEncryptor.java
index 415c8c81..66f467e0 100644
--- a/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/encryptor/NonPersonalizedEncryptor.java
+++ b/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/encryptor/NonPersonalizedEncryptor.java
@@ -164,34 +164,66 @@ public class NonPersonalizedEncryptor {
         return aes.decrypt(encryptedData, nonce, encryptionKey);
     }
 
+    /**
+     * Get application key.
+     * @return Application key.
+     */
     public byte[] getApplicationKey() {
         return applicationKey;
     }
 
+    /**
+     * Set application key.
+     * @param applicationKey Application key.
+     */
     public void setApplicationKey(byte[] applicationKey) {
         this.applicationKey = applicationKey;
     }
 
+    /**
+     * Get session index.
+     * @return Session index.
+     */
     public byte[] getSessionIndex() {
         return sessionIndex;
     }
 
+    /**
+     * Set session index.
+     * @param sessionIndex Session index.
+     */
     public void setSessionIndex(byte[] sessionIndex) {
         this.sessionIndex = sessionIndex;
     }
 
+    /**
+     * Get ephemeral public key.
+     * @return Ephemeral public key.
+     */
     public byte[] getEphemeralPublicKey() {
         return ephemeralPublicKey;
     }
 
+    /**
+     * Set ephemeral public key.
+     * @param ephemeralPublicKey Ephemeral public key.
+     */
     public void setEphemeralPublicKey(byte[] ephemeralPublicKey) {
         this.ephemeralPublicKey = ephemeralPublicKey;
     }
 
+    /**
+     * Get session related secret key.
+     * @return Session related secret key.
+     */
     public byte[] getSessionRelatedSecretKey() {
         return sessionRelatedSecretKey;
     }
 
+    /**
+     * Set session related secret key.
+     * @param sessionRelatedSecretKey Session related secret key.
+     */
     public void setSessionRelatedSecretKey(byte[] sessionRelatedSecretKey) {
         this.sessionRelatedSecretKey = sessionRelatedSecretKey;
     }
diff --git a/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/encryptor/ecies/exception/EciesException.java b/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/encryptor/ecies/exception/EciesException.java
index 86de6452..76bf436f 100644
--- a/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/encryptor/ecies/exception/EciesException.java
+++ b/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/encryptor/ecies/exception/EciesException.java
@@ -23,13 +23,25 @@ package io.getlime.security.powerauth.crypto.lib.encryptor.ecies.exception;
  */
 public class EciesException extends Exception {
 
+    /**
+     * Default constructor.
+     */
     public EciesException() {
     }
 
+    /**
+     * Constructor with message.
+     * @param message Message.
+     */
     public EciesException(String message) {
         super(message);
     }
 
+    /**
+     * Construction with message and cause.
+     * @param message Message.
+     * @param cause Cause.
+     */
     public EciesException(String message, Throwable cause) {
         super(message, cause);
     }
diff --git a/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/encryptor/ecies/model/EciesSharedInfo1.java b/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/encryptor/ecies/model/EciesSharedInfo1.java
index ebc7ef84..2ce83e23 100644
--- a/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/encryptor/ecies/model/EciesSharedInfo1.java
+++ b/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/encryptor/ecies/model/EciesSharedInfo1.java
@@ -24,15 +24,42 @@ import java.nio.charset.StandardCharsets;
  */
 public enum EciesSharedInfo1 {
 
+    /**
+     * Generic application scope.
+     */
     APPLICATION_SCOPE_GENERIC("/pa/generic/application"),
+
+    /**
+     * Generic activation scope.
+     */
     ACTIVATION_SCOPE_GENERIC("/pa/generic/activation"),
+
+    /**
+     * Activation scope layer 2.
+     */
     ACTIVATION_LAYER_2("/pa/activation"),
+
+    /**
+     * Upgrade scope.
+     */
     UPGRADE("/pa/upgrade"),
+
+    /**
+     * Vault unlock scope.
+     */
     VAULT_UNLOCK("/pa/vault/unlock"),
+
+    /**
+     * Create token scope.
+     */
     CREATE_TOKEN("/pa/token/create"),
+
+    /**
+     * Recovery code confirmation scope.
+     */
     CONFIRM_RECOVERY_CODE("/pa/recovery/confirm");
 
-    private byte[] value;
+    private final byte[] value;
 
     /**
      * Constructor with sharedInfo1 parameter for ECIES.
diff --git a/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/encryptor/model/EncryptedMessage.java b/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/encryptor/model/EncryptedMessage.java
index 0ba11e58..4ac5c672 100644
--- a/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/encryptor/model/EncryptedMessage.java
+++ b/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/encryptor/model/EncryptedMessage.java
@@ -39,50 +39,98 @@ public class EncryptedMessage {
     private byte[] encryptedData;
     private byte[] mac;
 
+    /**
+     * Get session index.
+     * @return Session index.
+     */
     public byte[] getSessionIndex() {
         return sessionIndex;
     }
 
+    /**
+     * Set session index.
+     * @param sessionIndex Session index.
+     */
     public void setSessionIndex(byte[] sessionIndex) {
         this.sessionIndex = sessionIndex;
     }
 
+    /**
+     * Get ad-hoc index.
+     * @return Ad-hoc index.
+     */
     public byte[] getAdHocIndex() {
         return adHocIndex;
     }
 
+    /**
+     * Set ad-hoc index.
+     * @param adHocIndex Ad-hoc index.
+     */
     public void setAdHocIndex(byte[] adHocIndex) {
         this.adHocIndex = adHocIndex;
     }
 
+    /**
+     * Get MAC index.
+     * @return MAC index.
+     */
     public byte[] getMacIndex() {
         return macIndex;
     }
 
+    /**
+     * Set MAC index.
+     * @param macIndex MAC index.
+     */
     public void setMacIndex(byte[] macIndex) {
         this.macIndex = macIndex;
     }
 
+    /**
+     * Get nonce.
+     * @return Nonce.
+     */
     public byte[] getNonce() {
         return nonce;
     }
 
+    /**
+     * Set nonce.
+     * @param nonce Nonce.
+     */
     public void setNonce(byte[] nonce) {
         this.nonce = nonce;
     }
 
+    /**
+     * Get encrypted data.
+     * @return Encrypted data.
+     */
     public byte[] getEncryptedData() {
         return encryptedData;
     }
 
+    /**
+     * Set encrypted data.
+     * @param encryptedData Encrypted data.
+     */
     public void setEncryptedData(byte[] encryptedData) {
         this.encryptedData = encryptedData;
     }
 
+    /**
+     * Get MAC.
+     * @return MAC.
+     */
     public byte[] getMac() {
         return mac;
     }
 
+    /**
+     * Set MAC.
+     * @param mac MAC.
+     */
     public void setMac(byte[] mac) {
         this.mac = mac;
     }
diff --git a/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/encryptor/model/NonPersonalizedEncryptedMessage.java b/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/encryptor/model/NonPersonalizedEncryptedMessage.java
index 3ae03e6e..936fd0f4 100644
--- a/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/encryptor/model/NonPersonalizedEncryptedMessage.java
+++ b/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/encryptor/model/NonPersonalizedEncryptedMessage.java
@@ -18,18 +18,34 @@ public class NonPersonalizedEncryptedMessage extends EncryptedMessage {
     private byte[] applicationKey;
     private byte[] ephemeralPublicKey;
 
+    /**
+     * Get application key.
+     * @return Application key.
+     */
     public byte[] getApplicationKey() {
         return applicationKey;
     }
 
+    /**
+     * Set application key.
+     * @param applicationKey Application key.
+     */
     public void setApplicationKey(byte[] applicationKey) {
         this.applicationKey = applicationKey;
     }
 
+    /**
+     * Get ephemeral public key.
+     * @return Ephemeral public key.
+     */
     public byte[] getEphemeralPublicKey() {
         return ephemeralPublicKey;
     }
 
+    /**
+     * Set ephemeral public key.
+     * @param ephemeralPublicKey Ephemeral public key.
+     */
     public void setEphemeralPublicKey(byte[] ephemeralPublicKey) {
         this.ephemeralPublicKey = ephemeralPublicKey;
     }
diff --git a/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/encryptor/model/PersonalizedEncryptedMessage.java b/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/encryptor/model/PersonalizedEncryptedMessage.java
index 60d7e847..b868eec0 100644
--- a/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/encryptor/model/PersonalizedEncryptedMessage.java
+++ b/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/encryptor/model/PersonalizedEncryptedMessage.java
@@ -17,10 +17,18 @@ public class PersonalizedEncryptedMessage extends EncryptedMessage {
 
     private String activationId;
 
+    /**
+     * Get activation identifier.
+     * @return Activation identifier.
+     */
     public String getActivationId() {
         return activationId;
     }
 
+    /**
+     * Set activation identifier.
+     * @param activationId Activation identifier.
+     */
     public void setActivationId(String activationId) {
         this.activationId = activationId;
     }
diff --git a/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/enums/PowerAuthDerivedKey.java b/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/enums/PowerAuthDerivedKey.java
index 97d3db99..154bea22 100644
--- a/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/enums/PowerAuthDerivedKey.java
+++ b/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/enums/PowerAuthDerivedKey.java
@@ -53,7 +53,7 @@ public enum PowerAuthDerivedKey {
      */
     ENCRYPTED_VAULT(2000);
 
-    private long index;
+    private final long index;
 
     private final static Map<Long, PowerAuthDerivedKey> map = new HashMap<>();
 
diff --git a/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/enums/PowerAuthSignatureTypes.java b/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/enums/PowerAuthSignatureTypes.java
index ca9a2096..e3016458 100644
--- a/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/enums/PowerAuthSignatureTypes.java
+++ b/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/enums/PowerAuthSignatureTypes.java
@@ -57,7 +57,7 @@ public enum PowerAuthSignatureTypes {
      */
     POSSESSION_KNOWLEDGE_BIOMETRY("possession_knowledge_biometry");
 
-    private String value;
+    private final String value;
 
     private final static Map<String, PowerAuthSignatureTypes> map = new HashMap<>();
 
@@ -77,14 +77,10 @@ public enum PowerAuthSignatureTypes {
      * @return Enum value.
      */
     public static PowerAuthSignatureTypes getEnumFromString(String value) {
-        if (value != null) {
-            final PowerAuthSignatureTypes type = map.get(value.toLowerCase());
-            if (type != null) {
-                return type;
-            }
+        if (value == null) {
+            return null;
         }
-        // Otherwise return null
-        return null;
+        return map.get(value.toLowerCase());
     }
 
     /**
diff --git a/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/generator/IdentifierGenerator.java b/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/generator/IdentifierGenerator.java
index 6e349a12..22235200 100644
--- a/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/generator/IdentifierGenerator.java
+++ b/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/generator/IdentifierGenerator.java
@@ -234,12 +234,12 @@ public class IdentifierGenerator {
         final Map<Integer, String> puks = new LinkedHashMap<>();
 
         for (int i = 1; i <= pukCount; i++) {
-            Long derivationIndex;
+            long derivationIndex;
             String derivedPuk;
             int derivationAttempt = 0;
             do {
                 // Generate random derivation index
-                byte[] derivationIndexBytes = keyGenerator.generateRandomBytes(8);
+                final byte[] derivationIndexBytes = keyGenerator.generateRandomBytes(8);
                 derivationIndex = ByteBuffer.wrap(derivationIndexBytes).getLong();
                 // Generate recovery PUK
                 derivedPuk = generatePuk(recoveryPukBaseKey, derivationIndexBytes);
diff --git a/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/model/ActivationStatusBlobInfo.java b/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/model/ActivationStatusBlobInfo.java
index 0398242f..79dc4ae1 100644
--- a/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/model/ActivationStatusBlobInfo.java
+++ b/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/model/ActivationStatusBlobInfo.java
@@ -25,6 +25,9 @@ package io.getlime.security.powerauth.crypto.lib.model;
  */
 public class ActivationStatusBlobInfo {
 
+    /**
+     * Activation status magic value.
+     */
     public static final int ACTIVATION_STATUS_MAGIC_VALUE = 0xDEC0DED1;
 
     private boolean valid;
diff --git a/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/model/ActivationVersion.java b/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/model/ActivationVersion.java
index 724cb201..d2671bab 100644
--- a/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/model/ActivationVersion.java
+++ b/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/model/ActivationVersion.java
@@ -22,6 +22,14 @@ package io.getlime.security.powerauth.crypto.lib.model;
  * @author Roman Strobl, roman.strobl@wultra.com
  */
 public enum ActivationVersion {
+
+    /**
+     * Version 2.
+     */
     VERSION_2,
+
+    /**
+     * Version 3.
+     */
     VERSION_3
 }
diff --git a/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/util/KeyConvertor.java b/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/util/KeyConvertor.java
index 08fec102..d886505f 100644
--- a/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/util/KeyConvertor.java
+++ b/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/util/KeyConvertor.java
@@ -18,6 +18,7 @@ package io.getlime.security.powerauth.crypto.lib.util;
 
 import io.getlime.security.powerauth.crypto.lib.config.PowerAuthConfiguration;
 import io.getlime.security.powerauth.crypto.lib.model.exception.CryptoProviderException;
+import io.getlime.security.powerauth.crypto.lib.model.exception.GenericCryptoException;
 import org.bouncycastle.jce.ECNamedCurveTable;
 import org.bouncycastle.jce.spec.ECNamedCurveParameterSpec;
 import org.slf4j.Logger;
@@ -41,6 +42,8 @@ public class KeyConvertor {
 
     private static final Logger logger = LoggerFactory.getLogger(KeyConvertor.class);
 
+    private final PublicKeyValidator publicKeyValidator = new PublicKeyValidator();
+
     /**
      * Converts an EC public key to a byte array by encoding Q point parameter (W in Java Security).
      *
@@ -70,8 +73,9 @@ public class KeyConvertor {
      * @throws InvalidKeySpecException When provided bytes are not a correct key
      *                                 representation.
      * @throws CryptoProviderException When crypto provider is incorrectly initialized.
+     * @throws GenericCryptoException When public key is invalid.
      */
-    public PublicKey convertBytesToPublicKey(byte[] keyBytes) throws InvalidKeySpecException, CryptoProviderException {
+    public PublicKey convertBytesToPublicKey(byte[] keyBytes) throws InvalidKeySpecException, CryptoProviderException, GenericCryptoException {
         try {
             // Decode EC point using Bouncy Castle and extract its coordinates
             ECNamedCurveParameterSpec ecSpec = ECNamedCurveTable.getParameterSpec("secp256r1");
@@ -79,6 +83,8 @@ public class KeyConvertor {
                 throw new CryptoProviderException("Crypto provider does not support the secp256r1 curve");
             }
             org.bouncycastle.math.ec.ECPoint point = ecSpec.getCurve().decodePoint(keyBytes);
+            publicKeyValidator.validate(ecSpec.getCurve(), point);
+
             BigInteger x = point.getAffineXCoord().toBigInteger();
             BigInteger y = point.getAffineYCoord().toBigInteger();
 
@@ -91,6 +97,9 @@ public class KeyConvertor {
         } catch (NoSuchAlgorithmException | InvalidParameterSpecException | NoSuchProviderException ex) {
             logger.warn(ex.getMessage(), ex);
             throw new CryptoProviderException(ex.getMessage(), ex);
+        } catch (IllegalArgumentException ex) {
+            logger.warn(ex.getMessage(), ex);
+            throw new GenericCryptoException(ex.getMessage(), ex);
         }
     }
 
diff --git a/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/util/PasswordHash.java b/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/util/PasswordHash.java
index 6f1184d5..6887cd94 100644
--- a/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/util/PasswordHash.java
+++ b/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/util/PasswordHash.java
@@ -39,6 +39,7 @@ public class PasswordHash {
     private static final int ITERATIONS = 3;
     private static final int MEMORY_POW_2 = 15;
     private static final int PARALLELISM = 16;
+    private static final int SALT_SIZE = 16;
 
     // Conversion of algorithm ID to algorithm name for Argon2
     private static final Map<Integer, String> ALGORITHM_NAME_MAP = new LinkedHashMap<>();
@@ -48,7 +49,7 @@ public class PasswordHash {
         ALGORITHM_NAME_MAP.put(Argon2Parameters.ARGON2_id, "argon2id");
     }
 
-    private static KeyGenerator keyGenerator = new KeyGenerator();
+    private static final KeyGenerator keyGenerator = new KeyGenerator();
 
     /**
      * Generate hash in Argon2 Modular Crypt Format for specified password using Argon2i algorithm.
@@ -58,7 +59,7 @@ public class PasswordHash {
      */
     public static String hash(byte[] password) throws CryptoProviderException {
         // Generate random salt
-        byte[] salt = keyGenerator.generateRandomBytes(8);
+        byte[] salt = keyGenerator.generateRandomBytes(SALT_SIZE);
         // Set up the Argon2i algorithm with default parameters
         Argon2Parameters.Builder builder = new Argon2Parameters.Builder(ALGORITHM_ID)
                 .withVersion(VERSION)
diff --git a/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/util/PublicKeyValidator.java b/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/util/PublicKeyValidator.java
new file mode 100644
index 00000000..1b2d8854
--- /dev/null
+++ b/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/lib/util/PublicKeyValidator.java
@@ -0,0 +1,54 @@
+/*
+ * PowerAuth Crypto Library
+ * Copyright 2021 Wultra s.r.o.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package io.getlime.security.powerauth.crypto.lib.util;
+
+import io.getlime.security.powerauth.crypto.lib.model.exception.GenericCryptoException;
+import org.bouncycastle.math.ec.ECAlgorithms;
+import org.bouncycastle.math.ec.ECCurve;
+import org.bouncycastle.math.ec.ECPoint;
+
+import java.math.BigInteger;
+
+/**
+ * Public key validations which complement validations in Bouncy Castle library.
+ */
+public class PublicKeyValidator {
+
+    /**
+     * Validate the public key:
+     * <ul>
+     *   <li>check that the EC point is not the point at infinity</li>
+     *   <li>check that point order matches the order defined in EC curve</li>
+     * </ul>
+     *
+     * @param curve EC curve.
+     * @param point EC point.
+     * @throws GenericCryptoException In case the EC point validation fails.
+     */
+    public void validate(ECCurve curve, ECPoint point) throws GenericCryptoException {
+        if (point.isInfinity()) {
+            throw new GenericCryptoException("Invalid public key with point equal to the point at infinity");
+        }
+
+        BigInteger n = curve.getOrder();
+        ECPoint calculatedPoint = ECAlgorithms.referenceMultiply(point, n);
+        if (!calculatedPoint.isInfinity()) {
+            throw new GenericCryptoException("Point order does not match the order defined in EC curve");
+        }
+    }
+
+}
\ No newline at end of file
diff --git a/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/server/util/DataDigest.java b/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/server/util/DataDigest.java
index f6243048..4762e084 100644
--- a/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/server/util/DataDigest.java
+++ b/powerauth-java-crypto/src/main/java/io/getlime/security/powerauth/crypto/server/util/DataDigest.java
@@ -49,10 +49,18 @@ public class DataDigest {
             this.salt = salt;
         }
 
+        /**
+         * Get data digest.
+         * @return Data digest.
+         */
         public String getDigest() {
             return digest;
         }
 
+        /**
+         * Get salt used for creating the data digest.
+         * @return Salt used for creating the data digest.
+         */
         public byte[] getSalt() {
             return salt;
         }
diff --git a/powerauth-java-http/pom.xml b/powerauth-java-http/pom.xml
index 038d2e49..3a1e02cd 100644
--- a/powerauth-java-http/pom.xml
+++ b/powerauth-java-http/pom.xml
@@ -21,7 +21,7 @@
 	<modelVersion>4.0.0</modelVersion>
 
 	<artifactId>powerauth-java-http</artifactId>
-	<version>1.0.0</version>
+	<version>1.1.0</version>
 	<name>powerauth-java-http</name>
 	<description>PowerAuth utility module for HTTP support</description>
 	<packaging>jar</packaging>
@@ -29,7 +29,7 @@
 	<parent>
 		<groupId>io.getlime.security</groupId>
 		<artifactId>powerauth-crypto-parent</artifactId>
-		<version>1.0.0</version>
+		<version>1.1.0</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 
@@ -37,12 +37,12 @@
 		<dependency>
 			<groupId>com.google.guava</groupId>
 			<artifactId>guava</artifactId>
-			<version>30.0-jre</version>
+			<version>30.1.1-jre</version>
 		</dependency>
 		<dependency>
 			<groupId>junit</groupId>
 			<artifactId>junit</artifactId>
-			<version>4.13.1</version>
+			<version>4.13.2</version>
 			<scope>test</scope>
 		</dependency>
 	</dependencies>
diff --git a/powerauth-java-http/src/main/java/io/getlime/security/powerauth/http/PowerAuthEncryptionHttpHeader.java b/powerauth-java-http/src/main/java/io/getlime/security/powerauth/http/PowerAuthEncryptionHttpHeader.java
index 4e155b2f..6c11ba72 100644
--- a/powerauth-java-http/src/main/java/io/getlime/security/powerauth/http/PowerAuthEncryptionHttpHeader.java
+++ b/powerauth-java-http/src/main/java/io/getlime/security/powerauth/http/PowerAuthEncryptionHttpHeader.java
@@ -29,7 +29,7 @@ public class PowerAuthEncryptionHttpHeader extends PowerAuthHttpHeader {
     /**
      * Class with keys used in the underlying map.
      */
-    public class Key {
+    public static class Key {
 
         /**
          * Key representing the "application_key" in the PowerAuth encryption header.
diff --git a/powerauth-java-http/src/main/java/io/getlime/security/powerauth/http/PowerAuthHttpHeader.java b/powerauth-java-http/src/main/java/io/getlime/security/powerauth/http/PowerAuthHttpHeader.java
index a341150d..9fe924e1 100644
--- a/powerauth-java-http/src/main/java/io/getlime/security/powerauth/http/PowerAuthHttpHeader.java
+++ b/powerauth-java-http/src/main/java/io/getlime/security/powerauth/http/PowerAuthHttpHeader.java
@@ -28,6 +28,9 @@ import java.util.regex.Pattern;
  */
 public abstract class PowerAuthHttpHeader {
 
+    /**
+     * PowerAuth HTTP header prefix.
+     */
     protected static final String POWERAUTH_PREFIX = "PowerAuth ";
 
     /**
diff --git a/powerauth-java-http/src/main/java/io/getlime/security/powerauth/http/PowerAuthRequestCanonizationUtils.java b/powerauth-java-http/src/main/java/io/getlime/security/powerauth/http/PowerAuthRequestCanonizationUtils.java
index fb919f3c..05f0fa94 100644
--- a/powerauth-java-http/src/main/java/io/getlime/security/powerauth/http/PowerAuthRequestCanonizationUtils.java
+++ b/powerauth-java-http/src/main/java/io/getlime/security/powerauth/http/PowerAuthRequestCanonizationUtils.java
@@ -25,6 +25,9 @@ import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 
+/**
+ * Canonization utilities for PowerAuth requests.
+ */
 public class PowerAuthRequestCanonizationUtils {
 
     /**
diff --git a/powerauth-java-http/src/main/java/io/getlime/security/powerauth/http/PowerAuthSignatureHttpHeader.java b/powerauth-java-http/src/main/java/io/getlime/security/powerauth/http/PowerAuthSignatureHttpHeader.java
index 8400965a..5b704282 100644
--- a/powerauth-java-http/src/main/java/io/getlime/security/powerauth/http/PowerAuthSignatureHttpHeader.java
+++ b/powerauth-java-http/src/main/java/io/getlime/security/powerauth/http/PowerAuthSignatureHttpHeader.java
@@ -29,7 +29,7 @@ public class PowerAuthSignatureHttpHeader extends PowerAuthHttpHeader {
     /**
      * Class with keys used in the underlying map.
      */
-    public class Key {
+    public static class Key {
 
         /**
          * Key representing the "pa_activation_id" in the PowerAuth authorization header.
@@ -155,26 +155,50 @@ public class PowerAuthSignatureHttpHeader extends PowerAuthHttpHeader {
 
     // Field getters
 
+    /**
+     * Get activation ID.
+     * @return Activation ID.
+     */
     public String getActivationId() {
         return activationId;
     }
 
+    /**
+     * Get application key.
+     * @return Application key.
+     */
     public String getApplicationKey() {
         return applicationKey;
     }
 
+    /**
+     * Get signature.
+     * @return Signature.
+     */
     public String getSignature() {
         return signature;
     }
 
+    /**
+     * Get signature type.
+     * @return Signature type.
+     */
     public String getSignatureType() {
         return signatureType;
     }
 
+    /**
+     * Get nonce.
+     * @return Nonce.
+     */
     public String getNonce() {
         return nonce;
     }
 
+    /**
+     * Get version.
+     * @return Version.
+     */
     public String getVersion() {
         return version;
     }
diff --git a/powerauth-java-http/src/main/java/io/getlime/security/powerauth/http/PowerAuthTokenHttpHeader.java b/powerauth-java-http/src/main/java/io/getlime/security/powerauth/http/PowerAuthTokenHttpHeader.java
index 2e360ca9..cd6cdace 100644
--- a/powerauth-java-http/src/main/java/io/getlime/security/powerauth/http/PowerAuthTokenHttpHeader.java
+++ b/powerauth-java-http/src/main/java/io/getlime/security/powerauth/http/PowerAuthTokenHttpHeader.java
@@ -29,7 +29,7 @@ public class PowerAuthTokenHttpHeader extends PowerAuthHttpHeader {
     /**
      * Class with keys used in the underlying map.
      */
-    public class Key {
+    public static class Key {
 
         /**
          * Key representing the "token_id" in the PowerAuth token header.
@@ -138,22 +138,42 @@ public class PowerAuthTokenHttpHeader extends PowerAuthHttpHeader {
 
     // Field getters
 
+    /**
+     * Get token identifier.
+     * @return Token identifier.
+     */
     public String getTokenId() {
         return tokenId;
     }
 
+    /**
+     * Get token digest.
+     * @return Token digest.
+     */
     public String getTokenDigest() {
         return tokenDigest;
     }
 
+    /**
+     * Get nonce.
+     * @return Nonce.
+     */
     public String getNonce() {
         return nonce;
     }
 
+    /**
+     * Get timestamp.
+     * @return Timestamp.
+     */
     public String getTimestamp() {
         return timestamp;
     }
 
+    /**
+     * Get version.
+     * @return Version.
+     */
     public String getVersion() {
         return version;
     }
diff --git a/powerauth-java-http/src/main/java/io/getlime/security/powerauth/http/validator/InvalidPowerAuthHttpHeaderException.java b/powerauth-java-http/src/main/java/io/getlime/security/powerauth/http/validator/InvalidPowerAuthHttpHeaderException.java
index 464e759a..23596cfe 100644
--- a/powerauth-java-http/src/main/java/io/getlime/security/powerauth/http/validator/InvalidPowerAuthHttpHeaderException.java
+++ b/powerauth-java-http/src/main/java/io/getlime/security/powerauth/http/validator/InvalidPowerAuthHttpHeaderException.java
@@ -23,6 +23,10 @@ package io.getlime.security.powerauth.http.validator;
  */
 public class InvalidPowerAuthHttpHeaderException extends Exception {
 
+    /**
+     * Exception constructor.
+     * @param message Message.
+     */
     public InvalidPowerAuthHttpHeaderException(String message) {
         super(message);
     }
diff --git a/powerauth-java-http/src/main/java/io/getlime/security/powerauth/http/validator/PowerAuthEncryptionHttpHeaderValidator.java b/powerauth-java-http/src/main/java/io/getlime/security/powerauth/http/validator/PowerAuthEncryptionHttpHeaderValidator.java
index 4f402e30..d9ed8166 100644
--- a/powerauth-java-http/src/main/java/io/getlime/security/powerauth/http/validator/PowerAuthEncryptionHttpHeaderValidator.java
+++ b/powerauth-java-http/src/main/java/io/getlime/security/powerauth/http/validator/PowerAuthEncryptionHttpHeaderValidator.java
@@ -25,6 +25,11 @@ import io.getlime.security.powerauth.http.PowerAuthEncryptionHttpHeader;
  */
 public class PowerAuthEncryptionHttpHeaderValidator {
 
+    /**
+     * Validate PowerAuth encryption HTTP header.
+     * @param header PowerAuth encryption HTTP header.
+     * @throws InvalidPowerAuthHttpHeaderException Thrown in case PowerAuth encryption HTTP header is invalid.
+     */
     public static void validate(PowerAuthEncryptionHttpHeader header) throws InvalidPowerAuthHttpHeaderException {
 
         // Check if the parsing was successful
diff --git a/powerauth-java-http/src/main/java/io/getlime/security/powerauth/http/validator/PowerAuthSignatureHttpHeaderValidator.java b/powerauth-java-http/src/main/java/io/getlime/security/powerauth/http/validator/PowerAuthSignatureHttpHeaderValidator.java
index 6af77dea..77cec811 100644
--- a/powerauth-java-http/src/main/java/io/getlime/security/powerauth/http/validator/PowerAuthSignatureHttpHeaderValidator.java
+++ b/powerauth-java-http/src/main/java/io/getlime/security/powerauth/http/validator/PowerAuthSignatureHttpHeaderValidator.java
@@ -25,6 +25,11 @@ import io.getlime.security.powerauth.http.PowerAuthSignatureHttpHeader;
  */
 public class PowerAuthSignatureHttpHeaderValidator {
 
+    /**
+     * Validate PowerAuth signature HTTP header.
+     * @param header PowerAuth signature HTTP header.
+     * @throws InvalidPowerAuthHttpHeaderException Thrown in case PowerAuth signature HTTP header is invalid.
+     */
     public static void validate(PowerAuthSignatureHttpHeader header) throws InvalidPowerAuthHttpHeaderException {
 
         // Check if the parsing was successful
diff --git a/powerauth-java-http/src/main/java/io/getlime/security/powerauth/http/validator/PowerAuthTokenHttpHeaderValidator.java b/powerauth-java-http/src/main/java/io/getlime/security/powerauth/http/validator/PowerAuthTokenHttpHeaderValidator.java
index 884c3ae4..b8e4d925 100644
--- a/powerauth-java-http/src/main/java/io/getlime/security/powerauth/http/validator/PowerAuthTokenHttpHeaderValidator.java
+++ b/powerauth-java-http/src/main/java/io/getlime/security/powerauth/http/validator/PowerAuthTokenHttpHeaderValidator.java
@@ -25,6 +25,11 @@ import io.getlime.security.powerauth.http.PowerAuthTokenHttpHeader;
  */
 public class PowerAuthTokenHttpHeaderValidator {
 
+    /**
+     * Validate PowerAuth token HTTP header.
+     * @param header PowerAuth token HTTP header.
+     * @throws InvalidPowerAuthHttpHeaderException Thrown when PowerAuth token HTTP header is invalid.
+     */
     public static void validate(PowerAuthTokenHttpHeader header) throws InvalidPowerAuthHttpHeaderException {
 
         // Check if the parsing was successful


Test patch:
diff --git a/powerauth-java-crypto/src/test/java/io/getlime/security/powerauth/crypto/ec/InvalidPointTest.java b/powerauth-java-crypto/src/test/java/io/getlime/security/powerauth/crypto/ec/InvalidPointTest.java
new file mode 100644
index 00000000..0a578f9f
--- /dev/null
+++ b/powerauth-java-crypto/src/test/java/io/getlime/security/powerauth/crypto/ec/InvalidPointTest.java
@@ -0,0 +1,173 @@
+/*
+ * PowerAuth Crypto Library
+ * Copyright 2021 Wultra s.r.o.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package io.getlime.security.powerauth.crypto.ec;
+
+import com.google.common.io.BaseEncoding;
+import io.getlime.security.powerauth.crypto.lib.model.exception.CryptoProviderException;
+import io.getlime.security.powerauth.crypto.lib.model.exception.GenericCryptoException;
+import io.getlime.security.powerauth.crypto.lib.util.KeyConvertor;
+import org.bouncycastle.crypto.ec.CustomNamedCurves;
+import org.bouncycastle.jce.ECNamedCurveTable;
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
+import org.bouncycastle.jce.spec.ECNamedCurveParameterSpec;
+import org.bouncycastle.math.ec.custom.sec.SecP256R1Curve;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+
+import java.lang.reflect.Field;
+import java.math.BigInteger;
+import java.security.Security;
+import java.security.spec.InvalidKeySpecException;
+
+import static org.junit.Assert.assertTrue;
+
+/**
+ * Tests for validations during public key import.
+ *
+ * @author Roman Strobl, roman.strobl@wultra.com
+ */
+public class InvalidPointTest {
+
+    private final KeyConvertor keyConvertor = new KeyConvertor();
+
+    /**
+     * Add BC crypto provider.
+     */
+    @Before
+    public void setUp() {
+        Security.addProvider(new BouncyCastleProvider());
+    }
+
+    /**
+     * Test of validation for point at infinity.
+     */
+    @Test
+    public void testInfinityValidation() {
+        ECNamedCurveParameterSpec ecSpec = ECNamedCurveTable.getParameterSpec("secp256r1");
+        assertTrue(ecSpec.getCurve().getInfinity().isValid());
+    }
+
+    /**
+     * Test of usage of point at infinity as public key.
+     */
+    @Test
+    public void testInfinityAsPublicKey() throws InvalidKeySpecException, CryptoProviderException {
+        try {
+            keyConvertor.convertBytesToPublicKey(BaseEncoding.base64().decode("AA=="));
+        } catch (GenericCryptoException ex) {
+            return;
+        }
+        Assert.fail("Infinity allowed as public key");
+    }
+
+    /**
+     * Test of validation for invalid point compression.
+     */
+    @Test
+    public void testValidationInvalidPoint1() throws InvalidKeySpecException, CryptoProviderException {
+        try {
+            // Invalid point compression
+            keyConvertor.convertBytesToPublicKey(BaseEncoding.base64().decode("ArcL8EPBRJNXVvj0V4w2nPlg7lEKWg+Q6To3OiHw0Tl/"));
+        } catch (GenericCryptoException ex) {
+            return;
+        }
+        Assert.fail("EC point validation is missing");
+    }
+
+    /**
+     * Test of validation for invalid encoding.
+     */
+    @Test
+    public void testValidationInvalidPoint2() throws InvalidKeySpecException, CryptoProviderException {
+        try {
+            // Invalid point encoding 0x3d
+            keyConvertor.convertBytesToPublicKey(BaseEncoding.base64().decode("Pes+/6wnmrjwVa2L9v2wqUDBYMCtq0qvQ7JIZ6+nZe6fsT+vr85+rUPunAIaK3tRAuIkIROUwYEvj/TlcemQ5Q="));
+        } catch (GenericCryptoException ex) {
+            return;
+        }
+        Assert.fail("EC point validation is missing");
+    }
+
+    /**
+     * Test of validation for point with invalid coordinates outside Fp.
+     */
+    @Test
+    public void testValidationInvalidPoint3() throws InvalidKeySpecException, CryptoProviderException {
+        try {
+            // Invalid point coordinates
+            keyConvertor.convertBytesToPublicKey(BaseEncoding.base64().decode("BGjj8wAErlEt1FNJzH8uhpWN2GSd9apNK0tWaDAN+Bukt5EwKZ6l3YzX475apYQdVbzmg0X2mRysqrvTEPRj8b8="));
+        } catch (GenericCryptoException ex) {
+            return;
+        }
+        Assert.fail("EC point validation is missing");
+    }
+
+    /**
+     * Test of validation for point with invalid coordinates inside Fp.
+     */
+    @Test
+    public void testValidationInvalidPoint4() throws InvalidKeySpecException, CryptoProviderException {
+        try {
+            // Invalid point coordinates
+            keyConvertor.convertBytesToPublicKey(BaseEncoding.base64().decode("BMa1eFhnJNtFLU6yFeFgcHMt9iPg074ZUKM9D8tX3nuNk7cKwTbbQG8uHItW8NxvPaMYo0WM87eV5Ud9dB3/14Q="));
+        } catch (GenericCryptoException ex) {
+            return;
+        }
+        Assert.fail("EC point validation is missing");
+    }
+
+    /**
+     * Test of validation for point from CVE-2018-5383.
+     */
+    @Test
+    public void testValidationInvalidPoint5() throws InvalidKeySpecException, CryptoProviderException {
+        try {
+            // Invalid point coordinates
+            // x: "82794344854243450371984501721340198645022926339504713863786955730156937886079"
+            // y: "33552521881581467670836617859178523407344471948513881718969729275859461829010"
+            keyConvertor.convertBytesToPublicKey(BaseEncoding.base64().decode("BLcL8EPBRJNXVvj0V4w2nPlg7lEKWg+Q6To3OiHw0Tl/Si4N7VelFWu4LrQxTDf9QVU5Wn5RmIryiczlMbnBcZI="));
+        } catch (GenericCryptoException ex) {
+            return;
+        }
+        Assert.fail("EC point validation is missing");
+    }
+
+    /**
+     * Test of validation for point order. The point is correct, however the curve parameters
+     * have been altered to simulate an EC curve fault attack.
+     */
+    @Test
+    public void testValidationInvalidOrder() throws InvalidKeySpecException, CryptoProviderException, IllegalAccessException, NoSuchFieldException {
+        KeyConvertor keyConvertor = new KeyConvertor();
+        SecP256R1Curve p256curve = (SecP256R1Curve) CustomNamedCurves.getByName("secp256r1").getCurve();
+        Class<?> parentClass = p256curve.getClass().getSuperclass().getSuperclass();
+        Field orderField = parentClass.getDeclaredField("order");
+        orderField.setAccessible(true);
+        BigInteger orderValid = p256curve.getOrder();
+        orderField.set(p256curve, orderValid.add(BigInteger.ONE));
+        try {
+            keyConvertor.convertBytesToPublicKey(BaseEncoding.base64().decode("BJBAcEeM25rL3lo5GIM9J4ygFzkkY3dPe6dKx6x17XNdG1Jy+FlH31rejjCHYVKcLs8lgKjJTKzyxrxMe+kK4KY="));
+        } catch (GenericCryptoException ex) {
+            // Revert the P-256 curve order change used only for fault attack simulation
+            orderField.set(p256curve, orderValid);
+            return;
+        }
+        Assert.fail("EC point validation is missing");
+    }
+
+}
\ No newline at end of file