Class BootstrapAlgorithmIdentities

java.lang.Object
zeroecho.core.alg.BootstrapAlgorithmIdentities

public final class BootstrapAlgorithmIdentities extends Object
Immutable bootstrap identities required by current ZeroEcho PKI behavior.

These identities are mandatory defaults, not a permanent maximum algorithm set. Trusted installed extensions may add identities in other namespaces. Provider aliases are accepted only by fromCompatibilityAlias(String) and never become canonical identity data.

  • Field Details

    • SHA256

      public static final AlgorithmIdentity SHA256
      SHA-256 digest identity.
    • SHA384

      public static final AlgorithmIdentity SHA384
      SHA-384 digest identity.
    • SHA512

      public static final AlgorithmIdentity SHA512
      SHA-512 digest identity.
    • MGF1

      public static final AlgorithmIdentity MGF1
      MGF1 mask-generation identity.
    • RSA_PKCS1_SHA256

      public static final AlgorithmIdentity RSA_PKCS1_SHA256
      RSA PKCS#1 v1.5 with SHA-256.
    • RSA_PKCS1_SHA384

      public static final AlgorithmIdentity RSA_PKCS1_SHA384
      RSA PKCS#1 v1.5 with SHA-384.
    • RSA_PKCS1_SHA512

      public static final AlgorithmIdentity RSA_PKCS1_SHA512
      RSA PKCS#1 v1.5 with SHA-512.
    • RSA_PSS_SHA256

      public static final AlgorithmIdentity RSA_PSS_SHA256
      RSA-PSS SHA-256/MGF1-SHA-256/salt-32/trailer-1 bootstrap identity.
    • ECDSA_SHA256

      public static final AlgorithmIdentity ECDSA_SHA256
      ECDSA with SHA-256, independent of the EC curve.
    • ECDSA_SHA384

      public static final AlgorithmIdentity ECDSA_SHA384
      ECDSA with SHA-384, independent of the EC curve.
    • ECDSA_SHA512

      public static final AlgorithmIdentity ECDSA_SHA512
      ECDSA with SHA-512, independent of the EC curve.
    • ED25519_SIGNATURE

      public static final AlgorithmIdentity ED25519_SIGNATURE
      Ed25519 signature identity.
    • ED448_SIGNATURE

      public static final AlgorithmIdentity ED448_SIGNATURE
      Ed448 signature identity.
    • SPHINCS_PLUS_SIGNATURE

      public static final AlgorithmIdentity SPHINCS_PLUS_SIGNATURE
      ZeroEcho SPHINCS+ default signature identity.
    • ML_DSA_44_SIGNATURE

      public static final AlgorithmIdentity ML_DSA_44_SIGNATURE
      ML-DSA-44 signature identity (FIPS 204, security level 2).
    • ML_DSA_65_SIGNATURE

      public static final AlgorithmIdentity ML_DSA_65_SIGNATURE
      ML-DSA-65 signature identity (FIPS 204, security level 3).
    • ML_DSA_87_SIGNATURE

      public static final AlgorithmIdentity ML_DSA_87_SIGNATURE
      ML-DSA-87 signature identity (FIPS 204, security level 5).
    • SLH_DSA_SHA2_128S_SIGNATURE

      public static final AlgorithmIdentity SLH_DSA_SHA2_128S_SIGNATURE
      SLH-DSA-SHA2-128s signature identity (FIPS 205, SHA2, 128-bit, small).
    • SLH_DSA_SHA2_128F_SIGNATURE

      public static final AlgorithmIdentity SLH_DSA_SHA2_128F_SIGNATURE
      SLH-DSA-SHA2-128f signature identity (FIPS 205, SHA2, 128-bit, fast).
    • SLH_DSA_SHA2_192S_SIGNATURE

      public static final AlgorithmIdentity SLH_DSA_SHA2_192S_SIGNATURE
      SLH-DSA-SHA2-192s signature identity (FIPS 205, SHA2, 192-bit, small).
    • SLH_DSA_SHA2_192F_SIGNATURE

      public static final AlgorithmIdentity SLH_DSA_SHA2_192F_SIGNATURE
      SLH-DSA-SHA2-192f signature identity (FIPS 205, SHA2, 192-bit, fast).
    • SLH_DSA_SHA2_256S_SIGNATURE

      public static final AlgorithmIdentity SLH_DSA_SHA2_256S_SIGNATURE
      SLH-DSA-SHA2-256s signature identity (FIPS 205, SHA2, 256-bit, small).
    • SLH_DSA_SHA2_256F_SIGNATURE

      public static final AlgorithmIdentity SLH_DSA_SHA2_256F_SIGNATURE
      SLH-DSA-SHA2-256f signature identity (FIPS 205, SHA2, 256-bit, fast).
    • SLH_DSA_SHAKE_128S_SIGNATURE

      public static final AlgorithmIdentity SLH_DSA_SHAKE_128S_SIGNATURE
      SLH-DSA-SHAKE-128s signature identity (FIPS 205, SHAKE, 128-bit, small).
    • SLH_DSA_SHAKE_128F_SIGNATURE

      public static final AlgorithmIdentity SLH_DSA_SHAKE_128F_SIGNATURE
      SLH-DSA-SHAKE-128f signature identity (FIPS 205, SHAKE, 128-bit, fast).
    • SLH_DSA_SHAKE_192S_SIGNATURE

      public static final AlgorithmIdentity SLH_DSA_SHAKE_192S_SIGNATURE
      SLH-DSA-SHAKE-192s signature identity (FIPS 205, SHAKE, 192-bit, small).
    • SLH_DSA_SHAKE_192F_SIGNATURE

      public static final AlgorithmIdentity SLH_DSA_SHAKE_192F_SIGNATURE
      SLH-DSA-SHAKE-192f signature identity (FIPS 205, SHAKE, 192-bit, fast).
    • SLH_DSA_SHAKE_256S_SIGNATURE

      public static final AlgorithmIdentity SLH_DSA_SHAKE_256S_SIGNATURE
      SLH-DSA-SHAKE-256s signature identity (FIPS 205, SHAKE, 256-bit, small).
    • SLH_DSA_SHAKE_256F_SIGNATURE

      public static final AlgorithmIdentity SLH_DSA_SHAKE_256F_SIGNATURE
      SLH-DSA-SHAKE-256f signature identity (FIPS 205, SHAKE, 256-bit, fast).
    • RSA_PUBLIC_KEY

      public static final AlgorithmIdentity RSA_PUBLIC_KEY
      RSA public-key identity.
    • EC_P256_PUBLIC_KEY

      public static final AlgorithmIdentity EC_P256_PUBLIC_KEY
      EC P-256 public-key identity.
    • EC_P384_PUBLIC_KEY

      public static final AlgorithmIdentity EC_P384_PUBLIC_KEY
      EC P-384 public-key identity.
    • EC_P521_PUBLIC_KEY

      public static final AlgorithmIdentity EC_P521_PUBLIC_KEY
      EC P-521 public-key identity.
    • ED25519_PUBLIC_KEY

      public static final AlgorithmIdentity ED25519_PUBLIC_KEY
      Ed25519 public-key identity.
    • ED448_PUBLIC_KEY

      public static final AlgorithmIdentity ED448_PUBLIC_KEY
      Ed448 public-key identity.
    • SPHINCS_PLUS_PUBLIC_KEY

      public static final AlgorithmIdentity SPHINCS_PLUS_PUBLIC_KEY
      ZeroEcho SPHINCS+ default public-key identity.
    • ML_DSA_44_PUBLIC_KEY

      public static final AlgorithmIdentity ML_DSA_44_PUBLIC_KEY
      ML-DSA-44 public-key identity (FIPS 204).
    • ML_DSA_65_PUBLIC_KEY

      public static final AlgorithmIdentity ML_DSA_65_PUBLIC_KEY
      ML-DSA-65 public-key identity (FIPS 204).
    • ML_DSA_87_PUBLIC_KEY

      public static final AlgorithmIdentity ML_DSA_87_PUBLIC_KEY
      ML-DSA-87 public-key identity (FIPS 204).
    • SLH_DSA_SHA2_128S_PUBLIC_KEY

      public static final AlgorithmIdentity SLH_DSA_SHA2_128S_PUBLIC_KEY
      SLH-DSA-SHA2-128s public-key identity (FIPS 205).
    • SLH_DSA_SHA2_128F_PUBLIC_KEY

      public static final AlgorithmIdentity SLH_DSA_SHA2_128F_PUBLIC_KEY
      SLH-DSA-SHA2-128f public-key identity (FIPS 205).
    • SLH_DSA_SHA2_192S_PUBLIC_KEY

      public static final AlgorithmIdentity SLH_DSA_SHA2_192S_PUBLIC_KEY
      SLH-DSA-SHA2-192s public-key identity (FIPS 205).
    • SLH_DSA_SHA2_192F_PUBLIC_KEY

      public static final AlgorithmIdentity SLH_DSA_SHA2_192F_PUBLIC_KEY
      SLH-DSA-SHA2-192f public-key identity (FIPS 205).
    • SLH_DSA_SHA2_256S_PUBLIC_KEY

      public static final AlgorithmIdentity SLH_DSA_SHA2_256S_PUBLIC_KEY
      SLH-DSA-SHA2-256s public-key identity (FIPS 205).
    • SLH_DSA_SHA2_256F_PUBLIC_KEY

      public static final AlgorithmIdentity SLH_DSA_SHA2_256F_PUBLIC_KEY
      SLH-DSA-SHA2-256f public-key identity (FIPS 205).
    • SLH_DSA_SHAKE_128S_PUBLIC_KEY

      public static final AlgorithmIdentity SLH_DSA_SHAKE_128S_PUBLIC_KEY
      SLH-DSA-SHAKE-128s public-key identity (FIPS 205).
    • SLH_DSA_SHAKE_128F_PUBLIC_KEY

      public static final AlgorithmIdentity SLH_DSA_SHAKE_128F_PUBLIC_KEY
      SLH-DSA-SHAKE-128f public-key identity (FIPS 205).
    • SLH_DSA_SHAKE_192S_PUBLIC_KEY

      public static final AlgorithmIdentity SLH_DSA_SHAKE_192S_PUBLIC_KEY
      SLH-DSA-SHAKE-192s public-key identity (FIPS 205).
    • SLH_DSA_SHAKE_192F_PUBLIC_KEY

      public static final AlgorithmIdentity SLH_DSA_SHAKE_192F_PUBLIC_KEY
      SLH-DSA-SHAKE-192f public-key identity (FIPS 205).
    • SLH_DSA_SHAKE_256S_PUBLIC_KEY

      public static final AlgorithmIdentity SLH_DSA_SHAKE_256S_PUBLIC_KEY
      SLH-DSA-SHAKE-256s public-key identity (FIPS 205).
    • SLH_DSA_SHAKE_256F_PUBLIC_KEY

      public static final AlgorithmIdentity SLH_DSA_SHAKE_256F_PUBLIC_KEY
      SLH-DSA-SHAKE-256f public-key identity (FIPS 205).
    • ECDSA_SHA256_P256

      public static final AlgorithmSuite ECDSA_SHA256_P256
      Current ECDSA P-256 signing suite.
    • ECDSA_SHA384_P384

      public static final AlgorithmSuite ECDSA_SHA384_P384
      Current ECDSA P-384 signing suite.
    • ECDSA_SHA512_P521

      public static final AlgorithmSuite ECDSA_SHA512_P521
      Current ECDSA P-521 signing suite.
    • PKI_SIGNATURE_DEFAULT_V1

      public static final AlgorithmSuite PKI_SIGNATURE_DEFAULT_V1
      Current immutable PKI signing default.
    • ML_DSA_44

      public static final AlgorithmSuite ML_DSA_44
      ML-DSA-44 signing suite (FIPS 204, security level 2).
    • ML_DSA_65

      public static final AlgorithmSuite ML_DSA_65
      ML-DSA-65 signing suite (FIPS 204, security level 3).
    • ML_DSA_87

      public static final AlgorithmSuite ML_DSA_87
      ML-DSA-87 signing suite (FIPS 204, security level 5).
    • SLH_DSA_SHA2_128S

      public static final AlgorithmSuite SLH_DSA_SHA2_128S
      SLH-DSA-SHA2-128s signing suite (FIPS 205, SHA2, 128-bit, small).
    • SLH_DSA_SHA2_128F

      public static final AlgorithmSuite SLH_DSA_SHA2_128F
      SLH-DSA-SHA2-128f signing suite (FIPS 205, SHA2, 128-bit, fast).
    • SLH_DSA_SHA2_192S

      public static final AlgorithmSuite SLH_DSA_SHA2_192S
      SLH-DSA-SHA2-192s signing suite (FIPS 205, SHA2, 192-bit, small).
    • SLH_DSA_SHA2_192F

      public static final AlgorithmSuite SLH_DSA_SHA2_192F
      SLH-DSA-SHA2-192f signing suite (FIPS 205, SHA2, 192-bit, fast).
    • SLH_DSA_SHA2_256S

      public static final AlgorithmSuite SLH_DSA_SHA2_256S
      SLH-DSA-SHA2-256s signing suite (FIPS 205, SHA2, 256-bit, small).
    • SLH_DSA_SHA2_256F

      public static final AlgorithmSuite SLH_DSA_SHA2_256F
      SLH-DSA-SHA2-256f signing suite (FIPS 205, SHA2, 256-bit, fast).
    • SLH_DSA_SHAKE_128S

      public static final AlgorithmSuite SLH_DSA_SHAKE_128S
      SLH-DSA-SHAKE-128s signing suite (FIPS 205, SHAKE, 128-bit, small).
    • SLH_DSA_SHAKE_128F

      public static final AlgorithmSuite SLH_DSA_SHAKE_128F
      SLH-DSA-SHAKE-128f signing suite (FIPS 205, SHAKE, 128-bit, fast).
    • SLH_DSA_SHAKE_192S

      public static final AlgorithmSuite SLH_DSA_SHAKE_192S
      SLH-DSA-SHAKE-192s signing suite (FIPS 205, SHAKE, 192-bit, small).
    • SLH_DSA_SHAKE_192F

      public static final AlgorithmSuite SLH_DSA_SHAKE_192F
      SLH-DSA-SHAKE-192f signing suite (FIPS 205, SHAKE, 192-bit, fast).
    • SLH_DSA_SHAKE_256S

      public static final AlgorithmSuite SLH_DSA_SHAKE_256S
      SLH-DSA-SHAKE-256s signing suite (FIPS 205, SHAKE, 256-bit, small).
    • SLH_DSA_SHAKE_256F

      public static final AlgorithmSuite SLH_DSA_SHAKE_256F
      SLH-DSA-SHAKE-256f signing suite (FIPS 205, SHAKE, 256-bit, fast).
  • Method Details

    • catalog

      public static AlgorithmIdentityCatalog catalog()
      Returns the immutable bootstrap identity catalog.
      Returns:
      built-in catalog
    • rsaPss

      public static AlgorithmIdentity rsaPss(AlgorithmIdentity hash, AlgorithmIdentity mgfHash, int saltLength)
      Creates an exact RSA-PSS identity without requiring a central enum entry.
      Parameters:
      hash - message digest
      mgfHash - MGF1 digest
      saltLength - salt length in bytes
      Returns:
      exact RSA-PSS identity
      Throws:
      IllegalArgumentException - if the tuple is contradictory
    • fromCompatibilityAlias

      public static Optional<AlgorithmIdentity> fromCompatibilityAlias(String alias)
      Resolves a finite legacy provider alias at the compatibility boundary.

      SHA-1 and unknown aliases are rejected. The returned identity, rather than the alias, is authoritative.

      Parameters:
      alias - legacy provider spelling
      Returns:
      exact bootstrap identity, or empty when unknown or forbidden
    • compatibilityAliases

      public static Map<String, AlgorithmIdentity> compatibilityAliases()
      Returns the immutable finite built-in compatibility aliases.
      Returns:
      alias-to-exact-identity map
    • resolve

      public static Optional<AlgorithmIdentity> resolve(String value)
      Resolves either a canonical identity or an approved compatibility alias.
      Parameters:
      value - canonical identity or finite legacy alias
      Returns:
      exact identity, or empty when unsupported