Package zeroecho.core.alg.ntru

package zeroecho.core.alg.ntru
NTRU post-quantum key encapsulation integration.

This package wires the NTRU KEM into the core layer. It provides the algorithm descriptor, a runtime KEM context, a key generation specification selecting parameter sets, and encoded key specifications for import and export. Provider specifics are kept behind small factories while roles and metadata remain explicit for higher layers.

Scope and responsibilities

  • Register NTRU under a canonical identifier and declare ENCAPSULATE and DECAPSULATE roles, with an optional message-style agreement adapter.
  • Provide a KemContext bound to either a public key (encapsulation) or a private key (decapsulation).
  • Expose immutable key-generation specifications and defensively copying encoded-key carriers with simple marshalling helpers; private-key carriers are destroyable.
  • Validate the presence of a suitable PQC provider before performing JCA operations.

Components

  • NtruAlgorithm: algorithm descriptor that wires KEM and optional agreement roles and registers asymmetric key builders for generation and encoded-key import.
  • NtruKemContext: runtime context that performs encapsulation and decapsulation using provider primitives.
  • NtruKeyGenSpec: immutable selection of NTRU variants from HPS and HRSS families, with convenience factories.
  • NtruPublicKeySpec and NtruPrivateKeySpec: wrappers over X.509 and PKCS#8 encodings with defensive copying and compact marshalling utilities.

Design notes

  • Algorithm descriptors are immutable and safe to share across threads.
  • KEM contexts are stateful and not thread-safe; create one per operation.
  • Encoded key specs preserve the provided encodings without internal parsing and clone byte arrays on input and output.
  • An agreement adapter allows NTRU KEM to participate in initiator and responder exchanges through a message-based interface when needed.
Since:
1.0
  • Class
    Description
    NtruAlgorithm
    NtruAlgorithm exposes the NTRU KEM from the Bouncy Castle PQC provider and adapts it for both KEM and message-based agreement roles.
    NtruKemContext
    NtruKemContext performs NTRU key encapsulation and decapsulation against a single key and parameter set.
    NtruKeyGenSpec
    NtruKeyGenSpec selects an NTRU parameter set for key pair generation.
    NtruKeyGenSpec.Variant
    Variant enumerates supported NTRU parameter sets for key generation.
    NtruPrivateKeySpec
    NtruPrivateKeySpec holds a PKCS#8-encoded NTRU private key and supports a simple marshal/unmarshal form.
    NtruPublicKeySpec
    NtruPublicKeySpec holds an X.509 SubjectPublicKeyInfo encoded NTRU public key and supports a simple marshal/unmarshal form.