Class RsaCipherContext

java.lang.Object
zeroecho.core.alg.rsa.RsaCipherContext
All Implemented Interfaces:
Closeable, AutoCloseable, CryptoContext, EncryptionContext
public final class RsaCipherContext extends Object implements EncryptionContext
Streaming RSA cipher context that transforms data block-by-block using OAEP or PKCS#1 v1.5 padding.

An instance is created for a specific role (encrypt or decrypt) and a concrete RsaEncSpec. The context exposes a pull-style pipeline via attach(java.io.InputStream) that converts bytes on-the-fly, making it suitable for large streams without buffering the whole message in memory.

Behavior

  • Encryption reads plaintext in RSA-size blocks according to the selected padding, producing fixed-size ciphertext blocks equal to the modulus length.
  • Decryption requires ciphertext in full modulus-length blocks and yields variable-size plaintext blocks determined by padding.
  • Finalization occurs on end of stream; decryption rejects trailing partial ciphertext blocks.

Example

RsaEncSpec spec = RsaEncSpec.oaep(RsaEncSpec.Hash.SHA256);
try (RsaCipherContext ctx = new RsaCipherContext(algo, pubKey, true, spec);
     InputStream in  = Files.newInputStream(plaintextPath);
     InputStream enc = ctx.attach(in)) {
    Files.copy(enc, ciphertextPath);
}

Security note: OAEP with SHA-256 is preferred over PKCS#1 v1.5. Decryption enforces full ciphertext blocks to avoid truncation hazards. The context does not manage or destroy keys.

  • Constructor Details

    • RsaCipherContext

      public RsaCipherContext(CryptoAlgorithm algorithm, Key key, boolean encrypt, RsaEncSpec spec)
      Creates a new RSA cipher context for encryption or decryption with the given parameters.

      The encrypt flag selects the role of this context: true for encryption (public key is typical), false for decryption (private key is required). The spec defines padding and hash parameters; for OAEP the hash is used both for the digest and MGF1 unless specified otherwise by the spec.

      Parameters:
      algorithm - the owning algorithm descriptor used for metadata and auditing
      key - the RSA key for this role; public for encryption/verify, private for decrypt/sign
      encrypt - true to encrypt, false to decrypt
      spec - RSA encryption specification including padding mode and hash
      Throws:
      NullPointerException - if any argument is null

  • Method Details

    • algorithm

      public CryptoAlgorithm algorithm()
      Returns the algorithm descriptor associated with this context.
      Specified by:
      algorithm in interface CryptoContext
      Returns:
      the algorithm that created this context

    • key

      public Key key()
      Returns the key bound to this context.
      Specified by:
      key in interface CryptoContext
      Returns:
      the RSA key used by this context

    • close

      public void close()
      Closes the context and releases resources.

      This implementation is a no-op because the attached stream performs finalize-on-close.

      Specified by:
      close in interface AutoCloseable
      Specified by:
      close in interface Closeable
      Specified by:
      close in interface CryptoContext

    • attach

      public InputStream attach(InputStream upstream) throws IOException
      Attaches this cipher to an upstream stream and returns a transforming stream.

      The returned stream pulls from upstream and emits encrypted or decrypted bytes according to the constructor-selected role and RsaEncSpec. On EOF, encryption will process a final short plaintext block if present, while decryption requires that the final buffered ciphertext forms a complete modulus-sized block.

      The caller is responsible for closing the returned stream to ensure finalization and resource cleanup.

      Specified by:
      attach in interface EncryptionContext
      Parameters:
      upstream - the source stream to transform
      Returns:
      a new input stream that produces transformed bytes
      Throws:
      NullPointerException - if upstream is null
      IOException - if the cipher cannot be initialized or a block transform fails