Class EcdhAlgorithm

java.lang.Object

zeroecho.core.CryptoAlgorithm

zeroecho.core.alg.AbstractCryptoAlgorithm

zeroecho.core.alg.ecdh.EcdhAlgorithm

public final class EcdhAlgorithm
extends AbstractCryptoAlgorithm

Elliptic Curve Diffie-Hellman (ECDH) Algorithm

Implementation of the Elliptic Curve Diffie-Hellman key agreement scheme within the ZeroEcho framework.

ECDH allows two parties, each possessing an elliptic-curve key pair, to derive a common shared secret over an insecure channel. Only the private key of one party and the public key of the other are required to compute the same shared value. This shared secret can then be expanded into symmetric session keys.

Capabilities

• AlgorithmFamily.AGREEMENT with KeyUsage.AGREEMENT: creates an AgreementContext from a local PrivateKey and a peer's public key supplied through the context.

Key builders

• EcdhCurveSpec: used to generate EC key pairs for ECDH; default is P-256.
• EcdsaPublicKeySpec and EcdsaPrivateKeySpec: reused for importing elliptic-curve keys since ECDH and ECDSA share curve parameters and encoding formats.

Notes

• The EcdsaCurveSpec parameter passed in the agreement capability is currently ignored in this implementation (defaulting always to the curve of the key itself). This is retained for API uniformity and may be enforced in future versions.

Example

// Generate a key pair for Alice
KeyPair aliceKeys = session.keyBuilders().asymmetric().generateKeyPair("ECDH", EcdhCurveSpec.P256);

// Generate a key pair for Bob
KeyPair bobKeys = session.keyBuilders().asymmetric().generateKeyPair("ECDH", EcdhCurveSpec.P256);

// Alice computes shared secret using her private key
AgreementContext aliceCtx = session.createContext("ECDH",
        KeyUsage.AGREEMENT, aliceKeys.getPrivate(), EcdsaCurveSpec.P256);
byte[] aliceSecret = aliceCtx.derive(bobKeys.getPublic());

// Bob computes shared secret using his private key
AgreementContext bobCtx = session.createContext("ECDH",
        KeyUsage.AGREEMENT, bobKeys.getPrivate(), EcdsaCurveSpec.P256);
byte[] bobSecret = bobCtx.derive(aliceKeys.getPublic());

// aliceSecret and bobSecret will be identical

Since:

1.0

Constructor Summary

Constructors

Constructor	Description
EcdhAlgorithm()	Constructs a new ECDH algorithm definition.

Method Summary

Modifier and Type	Method	Description
List<ParameterSetDescriptor<? extends AlgorithmKeySpec>>	parameterSets()	Returns the discoverable parameter sets (or parameterized templates) supported by this algorithm.

Methods inherited from class AbstractCryptoAlgorithm

capability

Methods inherited from class CryptoAlgorithm

addCapability, asymmetricKeyPairGenerator, bindContext, createContext, displayName, id, keyOperations, listCapabilities, priority, privateKeyImporter, providerName, publicKeyImporter, registerAsymmetricKeyPairGenerator, registerPrivateKeyImporter, registerPublicKeyImporter, registerSymmetricKeyGenerator, registerSymmetricKeyImporter, requiresStatefulSigning, roles, supports, symmetricKeyGenerator, symmetricKeyImporter

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

EcdhAlgorithm

public EcdhAlgorithm()

Constructs a new ECDH algorithm definition.

This constructor registers the capabilities and key builders required for Elliptic Curve Diffie-Hellman (ECDH) key agreement:

• Capability: AlgorithmFamily.AGREEMENT with KeyUsage.AGREEMENT, producing an AgreementContext from a local PrivateKey and a peer’s public key (supplied at runtime).
• Asymmetric key builders:
  • EcdhCurveSpec - generates EC key pairs suitable for ECDH (default: P-256).
  • EcdsaPublicKeySpec - imports existing EC public keys.
  • EcdsaPrivateKeySpec - imports existing EC private keys.

Note: although an EcdsaCurveSpec is accepted as a context parameter, the current implementation does not use it when constructing the AgreementContext. The curve is inferred from the provided key. This placeholder remains for API uniformity and may be enforced in later revisions.

Since:

1.0

Method Details

parameterSets

public List<ParameterSetDescriptor<? extends AlgorithmKeySpec>> parameterSets()

Description copied from class: CryptoAlgorithm

Returns the discoverable parameter sets (or parameterized templates) supported by this algorithm.

Callers (UIs, provisioning tools, policy engines) use this list to present users with valid, named key-generation options without prior knowledge of the concrete algorithm. Each entry is either a pre-built ParameterSetDescriptor.Concrete (ready spec) or a ParameterSetDescriptor.Template (user-supplied arguments produce the spec).

The default implementation returns an empty list. Algorithms with finite, enumerable parameter sets should override this method. Overrides must return immutable lists in stable order, with unique nonblank descriptor identifiers. Registry loading validates a snapshot; external providers remain responsible for maintaining the contract on subsequent calls. Implementations may use ParameterSetDescriptor.snapshot(List) to validate and copy their list.

Overrides:

parameterSets in class CryptoAlgorithm

Returns:

immutable list of parameter set descriptors; never null