Class SignatureInteropProfile

java.lang.Object
zeroecho.core.alg.common.sig.SignatureInteropProfile
public final class SignatureInteropProfile extends Object
Describes how a standard signature algorithm identifier maps to a concrete ZeroEcho signature context.

Standard external ecosystems such as X.509, PKCS#10, JCA, OpenSSL, or remote APIs often identify signature algorithms with canonical names such as SHA256withRSA, SHA384withECDSA, or Ed25519. ZeroEcho, by contrast, separates the key algorithm from the per-operation ContextSpec. This immutable helper bridges the two worlds by carrying all information needed to:

  • import or compare the correct public-key algorithm,
  • create a ZeroEcho signature context with an explicit, deterministic ContextSpec, and
  • translate signature bytes between an external representation and the internal ZeroEcho representation when the two differ.

Representation model

For RSA PKCS#1 v1.5, RSA-PSS, Ed25519, and Ed448, the external and internal signature bytes are identical. ECDSA is different: X.509/JCA normally use ASN.1 DER encoded SEQUENCE { r, s }, while ZeroEcho ECDSA contexts use fixed-length IEEE P1363 bytes (r || s). The SignatureInteropProfile.SignatureRepresentation enum models this distinction explicitly.

Security notes

  • This class never stores key material, plaintext, or signatures beyond the arguments passed to conversion methods.
  • Conversion methods validate structure and length to prevent silent format confusion.
  • The carried ContextSpec must be treated as part of algorithm semantics, not as an optional hint.

  • Constructor Details

    • SignatureInteropProfile

      public SignatureInteropProfile(String requestedAlgorithmId, String keyAlgorithmId, String contextAlgorithmId, ContextSpec contextSpec, SignatureInteropProfile.SignatureRepresentation signatureRepresentation, int internalSignatureLength)
      Creates a profile.
      Parameters:
      requestedAlgorithmId - caller-visible algorithm identifier such as SHA256withRSA
      keyAlgorithmId - ZeroEcho key algorithm identifier used for key import and matching, such as RSA
      contextAlgorithmId - ZeroEcho context algorithm identifier used with ZeroEchoSession.createContext(...)
      contextSpec - explicit ZeroEcho context specification
      signatureRepresentation - signature representation bridge between external bytes and internal ZeroEcho bytes
      internalSignatureLength - fixed internal signature length in bytes when representation conversion requires it; set to 0 for identity representations

  • Method Details

    • requestedAlgorithmId

      public String requestedAlgorithmId()
      Returns the caller-visible signature algorithm identifier.
      Returns:
      canonical requested algorithm id

    • keyAlgorithmId

      public String keyAlgorithmId()
      Returns the ZeroEcho key algorithm identifier.
      Returns:
      key algorithm id used for key import and key-class matching

    • contextAlgorithmId

      public String contextAlgorithmId()
      Returns the ZeroEcho context algorithm identifier.
      Returns:
      context algorithm id used to create signature contexts

    • contextSpec

      public ContextSpec contextSpec()
      Returns the explicit ZeroEcho context specification.
      Returns:
      non-null signature context spec

    • signatureRepresentation

      public SignatureInteropProfile.SignatureRepresentation signatureRepresentation()
      Returns the representation bridge used for signature bytes.
      Returns:
      representation policy

    • externalToInternalSignature

      public byte[] externalToInternalSignature(byte[] signature)
      Converts external signature bytes into the internal ZeroEcho representation.
      Parameters:
      signature - external signature bytes
      Returns:
      internal signature bytes suitable for ZeroEcho verification contexts
      Throws:
      IllegalArgumentException - if the supplied bytes do not match the expected external representation

    • internalToExternalSignature

      public byte[] internalToExternalSignature(byte[] signature) throws IOException
      Converts internal ZeroEcho signature bytes into the external representation.
      Parameters:
      signature - internal ZeroEcho signature bytes
      Returns:
      external signature bytes suitable for X.509, PKCS#10, or JCA callers
      Throws:
      IOException - if DER encoding fails
      IllegalArgumentException - if the supplied bytes do not match the expected internal representation