Class HmacAlgorithm

java.lang.Object
zeroecho.core.CryptoAlgorithm
zeroecho.core.alg.AbstractCryptoAlgorithm
zeroecho.core.alg.hmac.HmacAlgorithm
public final class HmacAlgorithm extends AbstractCryptoAlgorithm

HMAC Algorithm Integration

HmacAlgorithm registers the Hash-based Message Authentication Code (HMAC) family into the ZeroEcho framework. It provides a single role, KeyUsage.MAC, which can both produce and verify authentication tags.

HMAC is a widely standardized construction that combines a cryptographic hash function with a secret key to provide integrity and authenticity for arbitrary messages. It is secure under the assumption that the underlying hash function is pseudorandom and collision-resistant.

Capabilities

Key management

  • HmacKeyGenSpec: for generating fresh keys using a secure random source and the specified key length.
  • HmacKeyImportSpec: for wrapping existing raw key material into a SecretKey instance compatible with HMAC.

Defaults

  • Default MAC spec: HmacSpec.sha256()
  • Default key generation: 256-bit key for SHA-256 HMAC

Usage example

// Generate a fresh key for HMAC-SHA256
SecretKey key = session.keyBuilders().symmetric().generate("HMAC",
    HmacKeyGenSpec.sha256(256));

// Create a MAC context
MacContext ctx = session.createContext("HMAC",
    KeyUsage.MAC, key, HmacSpec.sha256());

ctx.update(data);
byte[] tag = ctx.doFinal();

// Verification: set expected tag
ctx.setExpectedTag(tag);
boolean valid = ctx.verify(data);
Since:
1.0

  • Constructor Details

    • HmacAlgorithm

      public HmacAlgorithm()
      Constructs and registers the HMAC algorithm.

      The constructor wires the algorithm identifier, declares the MAC capability, and registers symmetric key builders for generation and import. It sets SHA-256 HMAC as the default spec for both catalog metadata and testing.

      Initialization steps

      1. Registers a KeyUsage.MAC capability bound to MacContext and HmacSpec.
      2. Registers a symmetric key builder for HmacKeyGenSpec, which generates keys using the JCA KeyGenerator API.
      3. Registers a symmetric key builder for HmacKeyImportSpec, which wraps raw byte arrays as SecretKeySpec instances.

  • Method Details

    • parameterSets

      public List<ParameterSetDescriptor<? extends AlgorithmKeySpec>> parameterSets()
      Description copied from class: CryptoAlgorithm
      Returns the discoverable parameter sets (or parameterized templates) supported by this algorithm.

      Callers (UIs, provisioning tools, policy engines) use this list to present users with valid, named key-generation options without prior knowledge of the concrete algorithm. Each entry is either a pre-built ParameterSetDescriptor.Concrete (ready spec) or a ParameterSetDescriptor.Template (user-supplied arguments produce the spec).

      The default implementation returns an empty list. Algorithms with finite, enumerable parameter sets should override this method. Overrides must return immutable lists in stable order, with unique nonblank descriptor identifiers. Registry loading validates a snapshot; external providers remain responsible for maintaining the contract on subsequent calls. Implementations may use ParameterSetDescriptor.snapshot(List) to validate and copy their list.

      Overrides:
      parameterSets in class CryptoAlgorithm
      Returns:
      immutable list of parameter set descriptors; never null