Class RsaSignatureContext

java.lang.Object
zeroecho.core.alg.rsa.RsaSignatureContext
All Implemented Interfaces:
Closeable, AutoCloseable, CryptoContext, SignatureContext, TagEngine<Signature>
public final class RsaSignatureContext extends Object implements SignatureContext
Streaming RSA signature context for signing or verifying data in a pull pipeline.

This context binds an RSA key and a signature specification, exposes a passthrough view via wrap(java.io.InputStream), and finalizes at end-of-stream. In produce (SIGN) mode the signature is emitted as a trailer. In verify (VERIFY) mode the computed signature is compared against an expected tag using a configured verification approach.

Modes

Usage

Sign with RSASSA-PSS (SHA-256, salt 32)


RsaSigSpec spec = RsaSigSpec.pss(RsaSigSpec.Hash.SHA256, 32);
try (RsaSignatureContext ctx = new RsaSignatureContext(algo, privateKey, spec);
     InputStream in  = Files.newInputStream(msgPath);
     InputStream out = ctx.wrap(in)) {
    // out yields message bytes, then signature trailer of length ctx.tagLength()
    Files.copy(out, signedPayloadPath);
}

Verify a detached RSA signature


byte[] sig = Files.readAllBytes(sigPath);
RsaSigSpec spec = RsaSigSpec.pss(RsaSigSpec.Hash.SHA256, 32);
try (RsaSignatureContext ctx = new RsaSignatureContext(algo, publicKey, spec);
     InputStream in  = Files.newInputStream(bodyWithoutTrailer);
     InputStream out = ctx.wrap(in)) {
    ctx.setExpectedTag(sig);
    // Throw on mismatch at EOF:
    ctx.setVerificationApproach(ctx.getVerificationCore().getThrowOnMismatch());
    Files.copy(out, recoveredMsgPath);
}

Notes

  • Supported modes: PKCS#1 v1.5 and RSASSA-PSS. If pssSaltLen in the spec is -1, the salt length defaults to the digest size.
  • tagLength() equals the RSA modulus length in bytes.
  • Instances are single-use and not thread-safe. Calling wrap(InputStream) more than once throws IllegalStateException.

  • Constructor Details

    • RsaSignatureContext

      public RsaSignatureContext(CryptoAlgorithm alg, PrivateKey k, RsaSigSpec spec) throws GeneralSecurityException
      Constructs a signing context using the given private key and signature specification.

      The context operates in SIGN mode. At end-of-stream, a signature of length tagLength() is produced and emitted as a trailer by the wrapped stream.

      Parameters:
      alg - algorithm descriptor owning this context; must not be null
      k - private key used for signing; must not be null
      spec - RSA signature specification (PKCS#1 v1.5 or PSS); must not be null
      Throws:
      GeneralSecurityException - if the JCA signature engine cannot be initialized
      NullPointerException - if any argument is null

    • RsaSignatureContext

      public RsaSignatureContext(CryptoAlgorithm alg, PublicKey k, RsaSigSpec spec) throws GeneralSecurityException
      Constructs a verification context using the given public key and signature specification.

      The context operates in VERIFY mode. Provide the expected signature via setExpectedTag(byte[]) before the wrapped stream reaches EOF. Final verification occurs at EOF using the configured verification approach.

      Parameters:
      alg - algorithm descriptor owning this context; must not be null
      k - public key used for verification; must not be null
      spec - RSA signature specification (PKCS#1 v1.5 or PSS); must not be null
      Throws:
      GeneralSecurityException - if the JCA signature engine cannot be initialized
      NullPointerException - if any argument is null

  • Method Details