Class MldsaSignatureContext

java.lang.Object

zeroecho.core.alg.mldsa.MldsaSignatureContext

All Implemented Interfaces:

Closeable, AutoCloseable, CryptoContext, SignatureContext, TagEngine<Signature>

public final class MldsaSignatureContext
extends Object
implements SignatureContext

Streaming signature context for ML-DSA (FIPS 204).

MldsaSignatureContext adapts a JCA Signature engine for use within the ZeroEcho streaming signature infrastructure. It supports both signing and verification and delegates the low-level mechanics to GenericJcaSignatureContext.

Provider and algorithm

• JCA algorithm: "ML-DSA".
• Provider: "BC" (Bouncy Castle core provider).

Streaming contract

• SIGN: the wrapped stream emits the message body and appends a detached signature trailer at EOF.
• VERIFY: the wrapped stream emits the body only; verification is performed at EOF against a caller-supplied expected tag.

Since:

1.0

Field Summary

Fields inherited from interface TagEngine

LOG

Constructor Summary

Constructors

Constructor	Description
MldsaSignatureContext(CryptoAlgorithm algorithm, PrivateKey privateKey)	Creates a signing context bound to a private key.
MldsaSignatureContext(CryptoAlgorithm algorithm, PublicKey publicKey)	Creates a verification context bound to a public key.

Method Summary

Modifier and Type	Method	Description
CryptoAlgorithm	algorithm()	Returns the parent CryptoAlgorithm associated with this context.
void	close()	Closes this context and releases any underlying resources.
ThrowingBiPredicate.VerificationBiPredicate<Signature>	getVerificationCore()	Returns the verification predicate core that can be used to select a mismatch handling strategy.
Key	key()	Returns the key bound to this context.
void	setExpectedTag(byte[] expected)	Supplies the expected signature (tag) for VERIFY mode.
void	setVerificationApproach(ThrowingBiPredicate.VerificationBiPredicate<Signature> strategy)	Sets the verification approach used at EOF to compare the computed and expected signatures.
int	tagLength()	Returns the signature (tag) length in bytes for the parameter set in use.
InputStream	wrap(InputStream upstream)	Wraps an input stream such that bytes read from the returned stream update the underlying signature engine.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

MldsaSignatureContext

public MldsaSignatureContext(CryptoAlgorithm algorithm,
 PrivateKey privateKey)
                      throws GeneralSecurityException

Creates a signing context bound to a private key.

The produced signature length is resolved by probing the JCA engine via GenericJcaSignatureContext.SignLengthResolver.probeWith(String, String).

Parameters:

algorithm - the parent algorithm instance; must not be null

privateKey - ML-DSA private key; must not be null

Throws:

GeneralSecurityException - if the JCA signature engine cannot be initialized

MldsaSignatureContext

public MldsaSignatureContext(CryptoAlgorithm algorithm,
 PublicKey publicKey)
                      throws GeneralSecurityException

Creates a verification context bound to a public key.

The expected signature length is derived from the public key parameter set via MLDSAParameterSpec.getName() and canonical ML-DSA signature sizes.

Parameters:

algorithm - the parent algorithm instance; must not be null

publicKey - ML-DSA public key; must not be null

Throws:

GeneralSecurityException - if the key is invalid or the parameter set is unsupported

Method Details

algorithm

public CryptoAlgorithm algorithm()

Returns the parent CryptoAlgorithm associated with this context.

Specified by:

algorithm in interface CryptoContext

Returns:

the algorithm instance

key

public Key key()

Returns the key bound to this context.

Specified by:

key in interface CryptoContext

Returns:

signing PrivateKey or verification PublicKey

close

public void close()

Closes this context and releases any underlying resources.

Once closed, the context must not be reused.

Specified by:

close in interface AutoCloseable

Specified by:

close in interface Closeable

Specified by:

close in interface CryptoContext

wrap

public InputStream wrap(InputStream upstream)
                 throws IOException

Wraps an input stream such that bytes read from the returned stream update the underlying signature engine.

Specified by:

wrap in interface TagEngine<Signature>

Parameters:

upstream - input stream providing message bytes; must not be null

Returns:

wrapped stream that performs signing or verification as bytes are read

Throws:

IOException - if wrapping fails

tagLength

public int tagLength()

Returns the signature (tag) length in bytes for the parameter set in use.

Specified by:

tagLength in interface TagEngine<Signature>

Returns:

signature length in bytes

setExpectedTag

public void setExpectedTag(byte[] expected)

Supplies the expected signature (tag) for VERIFY mode.

Specified by:

setExpectedTag in interface TagEngine<Signature>

Parameters:

expected - expected signature bytes; must not be null

setVerificationApproach

public void setVerificationApproach(ThrowingBiPredicate.VerificationBiPredicate<Signature> strategy)

Sets the verification approach used at EOF to compare the computed and expected signatures.

Specified by:

setVerificationApproach in interface TagEngine<Signature>

Parameters:

strategy - verification predicate; must not be null

getVerificationCore

public ThrowingBiPredicate.VerificationBiPredicate<Signature> getVerificationCore()

Returns the verification predicate core that can be used to select a mismatch handling strategy.

Specified by:

getVerificationCore in interface TagEngine<Signature>

Returns:

the verification predicate core