All Classes and Interfaces
Class
Description
InputStream that transforms data in fixed-size chunks with optional
finalization.
Convenience base class for concrete
CryptoAlgorithm implementations.Abstract EdDSA Key-Pair Builder
Abstract EdDSA Encoded Private Key Builder
Abstract EdDSA Encoded Public Key Builder
An abstract base class for exportable data content, providing default
implementations for managing input data and export mode.
Passthrough
InputStream that forwards body bytes and optionally emits
a trailer at EOF.AES algorithm registration and capability wiring.
Streaming AES cipher context for GCM / CBC / CTR.
Fluent builder that exposes AES as a
DataContent in pull‑mode.Minimal AES header codec that persists runtime parameters only:
Key generation parameters for AES.
Specification for importing an existing AES key.
Static configuration for AES encryption and decryption.
Builder for
AesSpec.AES block modes supported by this implementation.
Padding schemes for CBC mode.
Context for performing key agreement protocols using a private key and a
peer's public key.
Immutable deterministic snapshot of installed execution capabilities.
Trusted-code declaration of an installed cryptographic execution domain.
Supported execution direction.
Service-provider contract for trusted installed execution capabilities.
High-level classification of cryptographic algorithms.
Provider-independent X.509
AlgorithmIdentifier (RFC 5280): an OID with
an exactly-typed parameter form.Encoding form of the optional
parameters field.Provider-independent identity of one exact cryptographic operation or key
type.
Digest-qualified signature parameters.
Stable namespaced algorithm family name.
Semantic role represented by an identity.
Exact named parameter set, such as an elliptic-curve name.
Parameters for an unparameterized family.
Typed, immutable family parameters.
Exact RSA-PSS parameters.
Deeply immutable snapshot of installed algorithm identities.
Trusted-code canonical codec for one typed algorithm-parameter schema.
Marker interface for algorithm-specific key specifications.
Immutable composition of a signature scheme and a compatible public-key
identity.
Generates asymmetric key pairs for one exact specification type.
Lightweight dynamic proxy that audits crypto contexts without changing their
behavior.
Listener for structured audit events emitted by audited crypto contexts.
Utilities for enforcing the best-effort audit-listener contract.
Defines the session-owned automatic auditing strategy.
The X.509
BasicConstraints extension value (RFC 5280, 4.2.1.9).The default
PkixProvider, implemented with BouncyCastle.Integration of BIKE (Bit Flipping Key Encapsulation) algorithm
BIKE Key Encapsulation Mechanism context
Specification for BIKE key generation
Available BIKE parameter sets.
BIKE-256 key pair utilities for modules that depend on
zeroecho.lib.Specification for a BIKE private key
Specification for a BIKE public key
Describes block sizing rules for RSA encryption and decryption.
Immutable bootstrap identities required by current ZeroEcho PKI behavior.
Provides initialization support for the Bouncy Castle cryptographic provider.
Verification strategy for comparing two byte arrays in constant time.
Provider-independent cancellation signal for streaming operations.
Immutable value descriptor of one algorithm context capability.
Helper routines for catalog selection by family and roles.
An OCSP
CertID (RFC 6960): identifies a certificate by the hash of its
issuer's name and key together with the certificate serial number.A fluent builder for an unsigned X.509 v3 certificate body or a signed standard
X509Certificate.A generic X.509 v3 extension (RFC 5280, 4.1): an OID, a criticality flag, and
the exact DER of the
extnValue OCTET STRING contents.A parsed PKCS#10 certification request (RFC 2986).
A fluent builder for a signed PKCS#10 certification request.
Thrown when a PKCS#10 certification request cannot be parsed or its
proof-of-possession self-signature fails verification.
An OCSP certificate status (RFC 6960):
good, revoked, or
unknown.The certificate is not revoked.
The certificate is revoked.
The responder does not know the status of the requested certificate.
ChaCha20-Poly1305 (AEAD) algorithm
ChaCha20-Poly1305 streaming header codec
ChaCha20-Poly1305 algorithm specification
Fluent builder for
ChaCha20Poly1305Spec.ChaCha20 (stream) algorithm
ChaCha base specification marker
ChaCha20 cipher context (stream)
ChaChaDataContentBuilder builds streaming ChaCha20 and ChaCha20-Poly1305
pipelines that encrypt or decrypt as an
InputStream is
consumed.ChaCha20 streaming header codec
ChaCha20 key generation specification
ChaCha20 key import specification
ChaCha20 stream cipher specification
Fluent builder for
ChaChaSpec.Builder for chunk-transforming
InputStreams backed by a
Cipher.Configures
java.util.logging (JUL) from a jul.properties
resource on the classpath.Classic McEliece (CMCE) algorithm adapter
Classic McEliece (CMCE) KEM context
CMCE key generation specification
Enumeration of supported CMCE parameter set variants.
Classic McEliece (CMCE) private key specification
Classic McEliece (CMCE) public key specification
Immutable PBM work and algorithm limits, checked before iterative derivation.
Immutable bounded CMP request with exact canonical protected bytes.
Immutable unsigned response bound to one verified request.
Immutable proof token constructed only after exact message protection verification.
General-purpose bidirectional codec between a domain type
T and a
serialized representation R.Base class for EdDSA signature contexts that adapts a JCA
Signature
for streaming sign and verify.A compact single-line
Formatter for JUL log
records.Shared typed keys for ephemeral cryptographic parameters.
Streaming integrity helpers for repeatable content.
A streaming producer of a signature over to-be-signed content, used by the
ZeroEcho PKIX builders to sign certificates, CRLs, CSRs, and OCSP responses.
Immutable repeatable bounded view over another repeatable content source.
A streaming verifier of a signature over to-be-signed content.
Optional service-provider interface for cryptographic primitives that need to
share or persist per-session parameters using a
CtxInterface.Creates a cryptographic context from a key and a context specification.
Marker interface for per-operation parameters.
A fluent builder for a signed X.509 CRL that yields a standard
X509CRL.A single revoked-certificate entry in a CRL.
The X.509 CRL
reasonCode values (RFC 5280, 5.3.1), each carrying its DER
enumerated code.Immutable structural projection of one canonical CRMF
CertReqMsg.Immutable structural predecessor reference; possession and authority are not asserted.
Abstract base class for all cryptographic algorithm definitions in ZeroEcho.
Immutable registry of
CryptoAlgorithm providers.Immutable snapshot of discovered
CryptoAlgorithm implementations,
with utilities to validate and serialize the catalog.Common interface for all cryptographic operation contexts.
A strategy interface for validating cryptographic keys, usages, and
specifications before contexts are created.
A PKCS#10 attribute: an OID and one or more DER-encoded values.
Represents a generic unit of data content.
A builder interface for constructing instances of
DataContent.A builder interface for constructing a chain of
DataContent
components, where each content unit passes its output as the input to the
next one.Default implementation of
DataContentChainBuilder.Defines a contract for objects that can provide a concise, human-readable
description.
Diffie-Hellman algorithm registration for use in the pluggable cryptography
catalog.
DH key pair builder
Key specification for a Diffie-Hellman private key encoded in PKCS#8 format.
Key specification for a Diffie-Hellman public key encoded in X.509 format.
Diffie-Hellman parameter specification
Context for computing unkeyed message digests and extendable-output functions
(XOFs) in streaming pipelines.
DigestDataContentBuilder constructs streaming pipelines that compute message
digests while reading an InputStream.
Digest parameters for SHA-2, SHA-3, and SHAKE
Enumeration of supported digest algorithms.
The ASN.1 string type used to encode a distinguished-name attribute value.
Declares a human-friendly display name for a class, specification, or
capability.
Elliptic Curve Diffie-Hellman (ECDH) Algorithm
Standardized ECDH Curve Specifications
ECDH Key Pair Generator
Elliptic Curve Digital Signature Algorithm (ECDSA)
ECDSA Curve Specifications
ECDSA Key Pair Generator
ECDSA Private Key Builder
ECDSA Private Key Specification
ECDSA Public Key Builder
ECDSA Public Key Specification
Ed25519 Digital Signature Algorithm
Key-pair builder for Ed25519
Specification for Ed25519 key-pair generation
Private key builder for Ed25519
Specification for Ed25519 private keys
Public key builder for Ed25519
Specification for Ed25519 public keys
Signature context for Ed25519 with a fixed 64-byte tag length.
Ed448 Digital Signature Algorithm
Ed448 Key-Pair Builder
Ed448 Key Generation Specification
Ed448 Private Key Builder
Ed448 Private Key Specification
Ed448 Public Key Builder
Ed448 Public Key Specification
Signature context for Ed448 with a fixed 114-byte tag length.
OID constants for the Egothor organisation's private algorithm arc.
ElGamal Asymmetric Encryption Algorithm
Streaming ElGamal cipher context that adapts an upstream stream into an
encrypted or decrypted stream.
ElgamalEncDataContentBuilder builds streaming ElGamal encryption or
decryption pipelines that operate as an InputStream is consumed.
ElGamal Encryption Parameters
Supported padding modes for ElGamal encryption.
ElGamal Key Generation Specification
ElGamal Parameter Specification
ElGamal Private Key Specification
ElGamal Public Key Specification
Reusable opener for
CTX-ENC:<algorithm> entries.Recipient implementation that delegates content-encryption key (CEK) wrapping
to a provided
EncryptionContext.Represents encrypted content, which is the result of an encryption process
and can be safely deployed to a public space without security concerns.
Context for performing encryption or decryption in streaming pipelines.
Strict RFC 7030 server-key-generation template and recipient validation.
An extension of
DataContent that provides export capabilities in
different modes.Enumeration of supported export modes.
An X.509
ExtendedKeyUsage extension value (RFC 5280, 4.2.1.12): an
ordered list of key-purpose OIDs.Frodo Key Encapsulation Mechanism (KEM)
FrodoKEM runtime context
Key generation specification for FrodoKEM
Enumerates the standardized FrodoKEM parameter sets.
Specification for importing a Frodo private key
Specification for importing a Frodo public key
A typed X.509
GeneralName (RFC 5280, 4.2.1.6), used for subject/issuer
alternative names and related extensions.directoryName (tag 4).dNSName (tag 2).iPAddress (tag 7), as a textual IPv4/IPv6 literal.otherName (tag 0): a type-id OID plus the exact DER of the value.registeredID (tag 8).rfc822Name (tag 1), an e-mail address.uniformResourceIdentifier (tag 6).Emits an HTML fragment with a table that summarizes discovered cryptographic
algorithms.
Generic JCA-based Key Agreement Context
Message-oriented JCA key agreement context where the handshake message is a
public key encoding.
Factory of initialized
Signature engines.Strategy for determining the signature trailer length in SIGN mode.
Strategy for determining the expected signature length in VERIFY mode.
HMAC Algorithm Integration
HmacDataContentBuilder constructs streaming pipelines that compute or verify
HMAC tags while an InputStream is consumed.
Mode selects whether the pipeline computes an HMAC tag or verifies one.
Specification for HMAC key generation
Specification for importing raw HMAC keys into a
SecretKey.Streaming HMAC context backed by the JCA
Mac API.Specification for HMAC operation parameters
HQC (Hamming Quasi-Cyclic) Algorithm Integration
HQC KEM Context
HQC Key Generation Specification
Enumeration of HQC parameter sets.
HQC Private Key Specification
HQC Public Key Specification
Builder-style utility for deriving purpose-separated key material from a
hybrid KEX exporter and applying it to streaming algorithm builders.
Fluent builder for constructing hybrid KEX contexts.
Configurator for the classic leg in
HybridKexBuilder.ClassicMode.CLASSIC_AGREEMENT
mode.Configurator for the classic leg in
HybridKexBuilder.ClassicMode.PAIR_MESSAGE mode.Configurator for the PQC leg (KEM adapter).
Hybrid key exchange (KEX) context that combines a classic agreement and a
post-quantum KEM-style agreement.
Factory utilities for constructing hybrid key exchange (KEX) contexts.
Deterministic exporter for deriving multiple independent keys from a single
hybrid KEX.
Hybrid KEX policy helper for minimum security strength enforcement.
Profile for a hybrid key exchange (KEX) composition.
Canonical transcript builder for binding hybrid KEX derivation to public
handshake context.
Factory for
SignatureContext-compatible hybrid signature contexts.Immutable definition of a hybrid signature composition.
Verification aggregation rule for hybrid signatures.
Explicit small-value adapter from immutable bytes to repeatable content.
Digest context that adapts a JCA
MessageDigest to a
pull-based streaming pipeline.AuditListener implementation that emits structured Java Util Logging records.
Fluent factory for
JulAuditListenerStd.HKDF utilities for deriving symmetric keys from a KEM shared secret.
Context for performing key encapsulation and decapsulation (KEM) operations.
Encapsulation result holding both ciphertext and shared secret.
Reusable opener for
KEM:<algorithm>:GCM-WRAP entries.Recipient implementation that derives a key-encryption key (KEK) via a
KemContext encapsulation and uses it to wrap a content-encryption key
(CEK).KEM-based envelope builder that first collects KEM parameters and only then
delegates to an explicit symmetric builder for the payload.
Adapter: using a KEM as a message-based agreement primitive
Builder for
KemMessageAgreementAdapter.Role of the adapter: initiator or responder.
Session-bound entry point for exact key-material operations.
Identifies one exact key-material operation exposed by an algorithm.
Immutable metadata for one exact key operation.
Redacted checked failure raised by encrypted keyring operations.
Stable keyring failure categories.
Destroyable owner of a keyring password.
Operational limits applied while opening an encrypted software keyring.
Executes a streaming signature while confining private-key resolution to the
keyring-owning library boundary.
Cause-free marker indicating cancellation observed at a documented signing
checkpoint.
Checked, redacted failure raised by key resolution or provider execution.
Stable, non-sensitive failure categories.
Path-bound encrypted local software keystore.
Standard encoded key forms supported by the encrypted store.
Key classifications supported by the encrypted store.
Algorithm identifier paired with an imported private key.
Algorithm identifier paired with an imported public key.
Algorithm identifier paired with an imported secret key.
Supplies a fresh destroyable password for one keyring open operation.
Declares the intended purpose(s) of a cryptographic key.
The X.509
KeyUsage bits (RFC 5280, 4.2.1.3), in the standard bit order.Concrete CryptoAlgorithm implementation for the post-quantum key
encapsulation mechanism (KEM) Kyber, standardized as ML-KEM.
KyberKemContext is a lightweight KEM context used to perform Kyber (ML-KEM)
encapsulation or decapsulation.
Key generation specification for the Kyber (ML-KEM) algorithm family.
Enumerates the supported Kyber parameter sets.
Specification wrapper for a Kyber (ML-KEM) private key encoded in PKCS#8.
Specification wrapper for a Kyber (ML-KEM) public key encoded in X.509.
Concrete
CryptoAlgorithm for LMS (Leighton–Micali
Signatures).Key generation specification for LMS.
Encoded representation of an LMS private key in PKCS#8 format.
Encoded representation of an LMS public key in X.509 (SubjectPublicKeyInfo)
format.
Streaming signature context for LMS (Leighton–Micali Signatures).
Default local monotonic authority for stateful signatures.
Context for computing message authentication codes (MACs) in streaming
pipelines.
Extension of
AgreementContext for message-based key agreement
protocols.ML-DSA (FIPS 204) signature algorithm binding for the ZeroEcho framework.
Key pair builder for ML-DSA (FIPS 204) using the Bouncy Castle provider.
Specification for generating ML-DSA key pairs (FIPS 204).
ML-DSA parameter sets as defined by FIPS 204.
Optional pre-hash variant selection.
Builder for importing ML-DSA private keys from encoded specifications.
Encoded representation of an ML-DSA private key.
Builder for importing ML-DSA public keys from encoded specifications.
Encoded representation of an ML-DSA public key.
Streaming signature context for ML-DSA (FIPS 204).
Represents one-shot multi-recipient content that owns temporary recipient
resources until processing or explicit cleanup.
Builds a data content pipeline that supports multiple recipients and
delegates payload encryption to AES or ChaCha builders.
NtruAlgorithm exposes the NTRU KEM from the Bouncy Castle PQC provider and
adapts it for both KEM and message-based agreement roles.
NtruKemContext performs NTRU key encapsulation and decapsulation against a
single key and parameter set.
NtruKeyGenSpec selects an NTRU parameter set for key pair generation.
Variant enumerates supported NTRU parameter sets for key generation.
Configures and exposes the NTRU LPRime post-quantum KEM and a
message-agreement adapter backed by the Bouncy Castle PQC provider.
KEM context for NTRU LPRime that performs encapsulation and decapsulation
using the underlying key material.
Algorithm-specific key generation parameters for NTRU LPRime.
Enumeration of supported NTRU LPRime parameter sets.
Specification wrapper for an encoded NTRU LPRime private key in PKCS#8
format.
Specification wrapper for an encoded NTRU LPRime public key in X.509 format.
NtruPrivateKeySpec holds a PKCS#8-encoded NTRU private key and supports a
simple marshal/unmarshal form.
NtruPublicKeySpec holds an X.509 SubjectPublicKeyInfo encoded NTRU public key
and supports a simple marshal/unmarshal form.
Sentinel
Key representing the intentional absence of cryptographic
key material.A parsed OCSP request (RFC 6960).
A parsed OCSP response (RFC 6960), used to validate a generated/persisted OCSP
status object at a service boundary.
One certificate-status entry within an OCSP response.
A fluent builder for unsigned OCSP
ResponseData or a successful,
signed OCSP response (RFC 6960) carrying a BasicOCSPResponse.Provider-independent one-shot streaming input.
An abstract adapter that converts an
OutputStream-based
transformation (such as encryption or compression) into an
InputStream-based one.A streaming writer that reads a variable-length 7-bit encoded length prefix
from the input data and writes the subsequent payload to a target
OutputStream.Immutable sequence of string key-value pairs with cursor-based iteration and
simple text serialization.
Immutable machine-readable validation for one template argument.
Machine-readable scalar kind; legacy types retain their presentation type.
Describes a named, discoverable parameter set (or parameterized template)
for a
CryptoAlgorithm.A fully pre-built, named parameter set carrying a ready-to-use spec.
A parameterized family of parameter sets driven by user-supplied arguments.
Utility class for generating random passwords and secure random byte arrays.
Recipient opener for password-based entries that derives a KEK via PBKDF2 and
unwraps the CEK with AES-GCM.
Password recipient that derives a KEK via PBKDF2(HMAC-SHA-256) and wraps the
CEK with AES-GCM.
Explicit PBKDF2 work-factor limits for trusted configuration and decoded
data.
The entry point of the ZeroEcho PKIX API: certificate, CSR, CRL, and OCSP
builders and parsers plus content signing and verification, all in terms of
standard
java.security types.The service-provider contract that backs the ZeroEcho PKIX API.
An implementation of
PlainContent that encapsulates a byte array.Builder interface for constructing
PlainBytes instances that
encapsulate unencrypted byte array content.Default implementation of the
PlainBytesBuilder interface.Represents a plain content that includes some original content, such as data
from interactive input, a file, or the result of decrypting encrypted
content.
A
PlainContent implementation that reads content from a file-like
URL.Builder interface for constructing
PlainContent instances that
represent unencrypted file-based content sourced from a URL.Default implementation of the
PlainFileBuilder interface.A
PlainContent implementation that wraps a UTF-8 string.Builder interface for constructing
PlainString instances, which
represent unencrypted textual content.Default implementation of the
PlainStringBuilder interface.The result of building a CT pre-certificate: a signed pre-cert and its issuer chain,
ready for submission to a Certificate Transparency log.
Imports private keys for one exact specification type.
Exception signaling a failure in the underlying cryptographic provider during
algorithm initialization or operation.
Immutable mathematical public-key identity for enrollment separation checks.
Imports public keys for one exact specification type.
Provides the authoritative process-wide cryptographic random source.
Recipient describes how to encode a single recipient entry that can recover a
content-encryption key (CEK) during decryption.
Defines the KEK sizes supported by recipient entries without an encoded size
discriminator.
RecipientOpener attempts to recover a content-encryption key (CEK) from a
single recipient entry during decryption.
A single-valued relative distinguished name: an attribute-type OID, its value,
and the ASN.1 string type used to encode that value.
Immutable, provider-independent source of repeatable operation content.
An OCSP
ResponderID (RFC 6960): the responder identity, either by name
or by key hash.Responder identified by the SHA-1 hash of its public key.
Responder identified by its distinguished name.
RSA algorithm binding for encryption/decryption and signature/verification.
Streaming RSA cipher context that transforms data block-by-block using OAEP
or PKCS#1 v1.5 padding.
RsaEncDataContentBuilder builds streaming RSA encryption or decryption
pipelines that operate while an InputStream is consumed.
Specification of RSA encryption parameters including padding mode, hash
function, and optional OAEP label.
Hash algorithms usable within OAEP padding.
Supported RSA padding schemes.
Key generation specification for RSA key pairs.
Encoded RSA private key specification in PKCS#8 format.
Encoded RSA public key specification in X.509 SubjectPublicKeyInfo format.
RsaSigDataContentBuilder builds streaming RSA signature pipelines that sign
or verify as an InputStream is consumed.
Mode selects whether the builder signs or verifies.
Streaming RSA signature context for signing or verifying data in a pull
pipeline.
Specification of RSA signature parameters including padding mode, hash
function, and (for PSS) salt length.
Supported hash algorithms for RSA signatures.
Signature padding modes supported by RSA.
Implements the SABER post-quantum key encapsulation mechanism for the crypto
catalog and wires it to the Bouncy Castle PQC provider.
KEM context for SABER supporting encapsulation with a public key and
decapsulation with a private key.
Key generation specification for the SABER post-quantum KEM algorithm.
Enumeration of SABER parameter set variants.
Encoded private key specification for the SABER post-quantum KEM algorithm.
Encoded public key specification for the SABER post-quantum KEM algorithm.
BouncyCastle-backed codec for SCEP (RFC 8894) CMS message encoding and decoding.
Authenticated outer request.
Signals a SCEP protocol message encode or decode failure.
Parsed representation of a SCEP PKIOperation message.
Represents secret content, which is a specific type of plain content that
stores a secret phrase.
Destroyable password content backed exclusively by an owned character array.
Security level of a cryptographic algorithm or parameter set.
Estimates conservative security strength in bits for a given algorithm
identifier and key.
SHA-2, SHA-3, and SHAKE digest algorithms
Context for streaming digital signature operations in pull-based pipelines.
Describes how a standard signature algorithm identifier maps to a concrete
ZeroEcho signature context.
Signature byte representation bridging policy.
Resolves standard signature algorithm identifiers to explicit ZeroEcho
signature profiles.
Signature-specific trailer builder for
DataContent pipelines.Helper entry for hybrid signature construction.
Helper entry for single-algorithm signature construction.
SignatureTrailerInputStream reads an upstream stream that has a trailing
signature tag and exposes only the original body while capturing the detached
signature.
Verification strategy that delegates to a JCA
Signature object.A Signed Certificate Timestamp (SCT) received from a Certificate Transparency log,
as defined by RFC 9162 (CT 2.0) and RFC 6962 (CT 1.0).
SLH-DSA (FIPS 205) signature algorithm binding for the ZeroEcho framework.
Key pair builder for SLH-DSA (FIPS 205) using the Bouncy Castle PQC provider.
Specification for generating SLH-DSA key pairs (FIPS 205).
SLH-DSA hash families (FIPS 205).
Optional pre-hash variant selection.
Security levels as defined by NIST PQC (L1, L3, L5).
Variant trading performance against signature size.
Builder for importing SLH-DSA private keys from encoded specifications.
Encoded representation of an SLH-DSA private key.
Builder for importing SLH-DSA public keys from encoded specifications.
Encoded representation of an SLH-DSA public key.
Streaming signature context for SLH-DSA (FIPS 205).
Configures and exposes the SNTRU Prime post-quantum KEM and a
message-agreement adapter backed by the Bouncy Castle PQC provider.
KEM context for SNTRU Prime that performs encapsulation and decapsulation
using the underlying key material.
Algorithm-specific key generation parameters for SNTRU Prime.
Enumeration of supported SNTRU Prime parameter sets.
Specification wrapper for an encoded SNTRU Prime private key in PKCS#8
format.
Specification wrapper for an encoded SNTRU Prime public key in X.509 format.
SPHINCS+ signature algorithm binding for the ZeroEcho framework.
Key pair builder for the SPHINCS+ post-quantum signature scheme.
Specification for generating SPHINCS+ key pairs.
Hash function families supported by SPHINCS+.
Legacy construction selector.
Security levels as defined by NIST PQC (L1, L3, L5).
Signature variants trading performance against signature size.
Builder for importing SPHINCS+ private keys from encoded specifications.
Encoded representation of a SPHINCS+ private key.
Builder for importing SPHINCS+ public keys from encoded specifications.
Encoded representation of a SPHINCS+ public key.
SPHINCS+ signature context that adapts a JCA engine for streaming sign and
verify.
Durable signing capability for a newly enrolled LMS/XMSS key.
Fail-closed containment for stateful signing until durable leaf reservation is
available.
Utility class providing string conversion helpers for debugging and logging.
Optional SPI to write/read a small header that carries runtime params (e.g.,
IV, tag length, AAD hash).
Generates symmetric keys for one exact specification type.
Imports symmetric keys for one exact specification type.
Minimal streaming engine for producing or verifying authentication tags on
byte streams.
Factory-style builder that supplies fresh
TagEngine instances on
demand.Builder for
DataContent pipelines that attach or verify an
authentication tag at end of stream.InputStream that withholds the last N bytes from the upstream stream and
emits everything before that tail, delivering the withheld tail to a callback
at EOF.
Describes a single user-supplied parameter accepted by a
ParameterSetDescriptor.Template.A functional predicate of two arguments that may throw a checked exception.
Decorator that records the verification outcome in a context before returning
it.
Decorator that throws
VerificationException when the delegated
verification fails.Base type for verification strategies that compare a value of type
T
to a byte array and may throw VerificationException.Caller-owned session-operation input used to unlock a recipient entry.
Destroyable password unlocking material backed by an owned character array.
Private key unlocking material.
Thrown by
Pkix.parseDistinguishedName(byte[]) when a relative
distinguished name carries an attribute value whose ASN.1 string type is not
one of the supported directory string types (UTF8String,
PrintableString, IA5String).Exception indicating that an algorithm does not support the requested role.
Exception indicating that a provided key/spec combination is not supported by
the algorithm for the requested role.
Utility class for performing efficient I/O operations with support for packed
integers.
Exception thrown when a cryptographic signature or digest verification fails.
Context specification for algorithms that require no additional parameters.
Utility class providing support for working with X.509 certificates, private
keys, and certification requests using PEM-encoded files and the Bouncy
Castle library.
Algorithm definition for XDH (elliptic curve Diffie-Hellman) key agreement,
backed by the JCA
KeyAgreement API.KeyPair generator for XDH curves using the JCA KeyPairGenerator SPI.
Key specification for an XDH (elliptic curve Diffie-Hellman) private key.
Key specification for an XDH (elliptic curve Diffie-Hellman) public key.
Specification for X25519 and X448 Diffie-Hellman over Montgomery-form
elliptic curves.
Concrete
CryptoAlgorithm for XMSS (eXtended Merkle
Signature Scheme).Key generation specification for XMSS.
Encoded representation of an XMSS private key in PKCS#8 format.
Encoded representation of an XMSS public key in X.509 (SubjectPublicKeyInfo)
format.
Streaming signature context for XMSS (eXtended Merkle Signature Scheme).
Concrete
CryptoAlgorithm for the X-Wing hybrid
post-quantum key encapsulation mechanism.KEM context for the X-Wing hybrid post-quantum key encapsulation mechanism.
Key generation specification for X-Wing.
Encoded representation of an X-Wing private key as its 32-byte seed.
Encoded representation of an X-Wing public key in raw format.
Immutable, explicitly scoped runtime configuration for ZeroEcho operations.