Class RsaAlgorithm

java.lang.Object

zeroecho.core.CryptoAlgorithm

zeroecho.core.alg.AbstractCryptoAlgorithm

zeroecho.core.alg.rsa.RsaAlgorithm

public final class RsaAlgorithm
extends AbstractCryptoAlgorithm

RSA algorithm binding for encryption/decryption and signature/verification.

This class wires RSA to the ZeroEcho algorithm registry by declaring its capabilities, supported roles, and key builders. It supports both encryption (typically RSA-OAEP) and digital signatures (typically RSA-PSS).

Capabilities

• Encryption/Decryption: Uses RsaEncSpec, with OAEP (SHA-256) as the default padding scheme.
• Signing/Verification: Uses RsaSigSpec, with PSS (SHA-256, 32-byte salt) as the default signature scheme.

Key builders

• RsaKeyGenSpec: Generates RSA key pairs with configurable key size and public exponent (default: 2048 bits, exponent 65537).
• RsaPublicKeySpec: Imports an X.509-encoded public key.
• RsaPrivateKeySpec: Imports a PKCS#8-encoded private key.

Example

RsaAlgorithm rsa = new RsaAlgorithm();

// Generate a new RSA-2048 key pair
KeyPair kp = rsa.asymmetricKeyPairGenerator(RsaKeyGenSpec.class)
                .generateKeyPair(RsaKeyGenSpec.rsa2048());

// Encrypt with OAEP (SHA-256)
EncryptionContext enc = rsa.createContext(KeyUsage.ENCRYPT, kp.getPublic(), null);

// Sign with PSS (SHA-256)
SignatureContext sig = rsa.createContext(KeyUsage.SIGN, kp.getPrivate(), null);

Security note: This implementation defaults to OAEP with SHA-256 for encryption and PSS with SHA-256 for signatures, which are considered secure and modern choices. Legacy padding modes such as PKCS#1 v1.5 are deliberately not exposed to avoid misuse.

Since:

1.0

Constructor Summary

Constructors

Constructor	Description
RsaAlgorithm()	Constructs a new RSA algorithm definition and registers its roles and key builders.

Method Summary

Modifier and Type	Method	Description
List<ParameterSetDescriptor<? extends AlgorithmKeySpec>>	parameterSets()	Returns the discoverable parameter sets (or parameterized templates) supported by this algorithm.

Methods inherited from class AbstractCryptoAlgorithm

capability

Methods inherited from class CryptoAlgorithm

addCapability, asymmetricKeyPairGenerator, bindContext, createContext, displayName, id, keyOperations, listCapabilities, priority, privateKeyImporter, providerName, publicKeyImporter, registerAsymmetricKeyPairGenerator, registerPrivateKeyImporter, registerPublicKeyImporter, registerSymmetricKeyGenerator, registerSymmetricKeyImporter, requiresStatefulSigning, roles, supports, symmetricKeyGenerator, symmetricKeyImporter

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

RsaAlgorithm

public RsaAlgorithm()

Constructs a new RSA algorithm definition and registers its roles and key builders.

The constructor wires the following:

• KeyUsage.ENCRYPT / KeyUsage.DECRYPT using RsaEncSpec, with OAEP (SHA-256) as the default scheme.
• KeyUsage.SIGN / KeyUsage.VERIFY using RsaSigSpec, with PSS (SHA-256, 32-byte salt) as the default scheme.
• RsaKeyGenSpec: RSA key pair generation (default: 2048-bit, public exponent 65537).
• RsaPublicKeySpec: Import of X.509-encoded public keys.
• RsaPrivateKeySpec: Import of PKCS#8-encoded private keys.

All roles are registered under the AlgorithmFamily.ASYMMETRIC family. Default specs are chosen to be modern and secure, excluding legacy padding modes such as PKCS#1 v1.5.

Throws:

IllegalArgumentException - if an RSA context cannot be initialized due to provider-level constraints (e.g., unsupported parameters).

Method Details

parameterSets

public List<ParameterSetDescriptor<? extends AlgorithmKeySpec>> parameterSets()

Description copied from class: CryptoAlgorithm

Returns the discoverable parameter sets (or parameterized templates) supported by this algorithm.

Callers (UIs, provisioning tools, policy engines) use this list to present users with valid, named key-generation options without prior knowledge of the concrete algorithm. Each entry is either a pre-built ParameterSetDescriptor.Concrete (ready spec) or a ParameterSetDescriptor.Template (user-supplied arguments produce the spec).

The default implementation returns an empty list. Algorithms with finite, enumerable parameter sets should override this method. Overrides must return immutable lists in stable order, with unique nonblank descriptor identifiers. Registry loading validates a snapshot; external providers remain responsible for maintaining the contract on subsequent calls. Implementations may use ParameterSetDescriptor.snapshot(List) to validate and copy their list.

Overrides:

parameterSets in class CryptoAlgorithm

Returns:

immutable list of parameter set descriptors; never null