Class NtruAlgorithm

java.lang.Object

zeroecho.core.CryptoAlgorithm

zeroecho.core.alg.AbstractCryptoAlgorithm

zeroecho.core.alg.ntru.NtruAlgorithm

public final class NtruAlgorithm
extends AbstractCryptoAlgorithm

NtruAlgorithm exposes the NTRU KEM from the Bouncy Castle PQC provider and adapts it for both KEM and message-based agreement roles.

Capabilities registered

• KEM:
  • KeyUsage.ENCAPSULATE with PublicKey producing a KemContext.
  • KeyUsage.DECAPSULATE with PrivateKey producing a KemContext.
• AGREEMENT:
  • KeyUsage.AGREEMENT (initiator) using a PublicKey, exposed as MessageAgreementContext via a KEM-to-agreement adapter.
  • KeyUsage.AGREEMENT (responder) using a PrivateKey, exposed as MessageAgreementContext via a KEM-to-agreement adapter.

Usage

KEM, initiator and responder

NtruAlgorithm alg = new NtruAlgorithm();
// Generate a key pair (or import one). hrss701 is the default.
KeyPair kp = alg.asymmetricKeyPairGenerator(NtruKeyGenSpec.class)
                .generateKeyPair(NtruKeyGenSpec.hrss701());

// Initiator encapsulates using recipient's public key
KemContext enc = alg.createContext(KeyUsage.ENCAPSULATE, kp.getPublic(), VoidSpec.INSTANCE);
KemResult kem = enc.encapsulate();

// Responder decapsulates using their private key
KemContext dec = alg.createContext(KeyUsage.DECAPSULATE, kp.getPrivate(), VoidSpec.INSTANCE);
byte[] secret = dec.decapsulate(kem.encapsulation());

Agreement over messages using the KEM adapter

NtruAlgorithm alg = new NtruAlgorithm();
KeyPair kpBob = alg.asymmetricKeyPairGenerator(NtruKeyGenSpec.class)
                   .generateKeyPair(NtruKeyGenSpec.hrss701());

// Alice (initiator) - has Bob's public key
MessageAgreementContext alice = alg.createContext(
    KeyUsage.AGREEMENT, kpBob.getPublic(), VoidSpec.INSTANCE);

// Alice produces the peer message she must send to Bob
byte[] toBob = alice.getPeerMessage();

// Bob (responder) - has his private key
MessageAgreementContext bob = alg.createContext(
    KeyUsage.AGREEMENT, kpBob.getPrivate(), VoidSpec.INSTANCE);

// Bob supplies Alice's message so he can complete decapsulation
bob.setPeerMessage(toBob);

// Both parties now hold the same derived secret via the AgreementContext API.

Key builders

• NtruKeyGenSpec - generates key pairs with a selected NTRU parameter set (default: hrss701).
• NtruPublicKeySpec - imports an X.509 SubjectPublicKeyInfo public key.
• NtruPrivateKeySpec - imports a PKCS#8 PrivateKeyInfo private key.

Provider requirements

This implementation uses KeyPairGenerator and KeyFactory with the algorithm string "NTRU" from the Bouncy Castle PQC provider (BouncyCastlePQCProvider.PROVIDER_NAME). If the provider is not present, attempts to generate or import keys will fail with NoSuchProviderException.

Thread-safety

Instances are stateless after construction and may be safely shared across threads. Contexts returned from this algorithm are not guaranteed to be thread-safe.

Since:

1.0

See Also:

• AlgorithmFamily
• KeyUsage
• KemContext
• MessageAgreementContext

Constructor Summary

Constructors

Constructor	Description
NtruAlgorithm()	Creates an algorithm instance that registers KEM and AGREEMENT roles and wires asymmetric key builders for generation and X.509/PKCS#8 import.

Method Summary

Modifier and Type	Method	Description
List<ParameterSetDescriptor<? extends AlgorithmKeySpec>>	parameterSets()	Returns the discoverable parameter sets (or parameterized templates) supported by this algorithm.

Methods inherited from class AbstractCryptoAlgorithm

capability

Methods inherited from class CryptoAlgorithm

addCapability, asymmetricKeyPairGenerator, bindContext, createContext, displayName, id, keyOperations, listCapabilities, priority, privateKeyImporter, providerName, publicKeyImporter, registerAsymmetricKeyPairGenerator, registerPrivateKeyImporter, registerPublicKeyImporter, registerSymmetricKeyGenerator, registerSymmetricKeyImporter, requiresStatefulSigning, roles, supports, symmetricKeyGenerator, symmetricKeyImporter

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

NtruAlgorithm

public NtruAlgorithm()

Creates an algorithm instance that registers KEM and AGREEMENT roles and wires asymmetric key builders for generation and X.509/PKCS#8 import.

The default key generation spec is NtruKeyGenSpec.hrss701().

Method Details

parameterSets

public List<ParameterSetDescriptor<? extends AlgorithmKeySpec>> parameterSets()

Description copied from class: CryptoAlgorithm

Returns the discoverable parameter sets (or parameterized templates) supported by this algorithm.

Callers (UIs, provisioning tools, policy engines) use this list to present users with valid, named key-generation options without prior knowledge of the concrete algorithm. Each entry is either a pre-built ParameterSetDescriptor.Concrete (ready spec) or a ParameterSetDescriptor.Template (user-supplied arguments produce the spec).

The default implementation returns an empty list. Algorithms with finite, enumerable parameter sets should override this method. Overrides must return immutable lists in stable order, with unique nonblank descriptor identifiers. Registry loading validates a snapshot; external providers remain responsible for maintaining the contract on subsequent calls. Implementations may use ParameterSetDescriptor.snapshot(List) to validate and copy their list.

Overrides:

parameterSets in class CryptoAlgorithm

Returns:

immutable list of parameter set descriptors; never null