Class SlhDsaPrivateKeySpec

java.lang.Object
zeroecho.core.alg.slhdsa.SlhDsaPrivateKeySpec
All Implemented Interfaces:
Destroyable, AlgorithmKeySpec
public final class SlhDsaPrivateKeySpec extends Object implements AlgorithmKeySpec, Destroyable
Encoded representation of an SLH-DSA private key.

SlhDsaPrivateKeySpec is a destroyable value object that wraps a PKCS#8-encoded SLH-DSA private key together with the JCA provider name that should be used when importing the key.

Encoding

  • The private key material is stored as a defensive copy of the provided PKCS#8 byte array.
  • Marshalling/unmarshalling uses PairSeq with Base64 encoding under "pkcs8.b64".

Provider selection

The default provider is "BC" because SLH-DSA is registered by the Bouncy Castle core provider (as opposed to the PQC-only provider).

Security considerations

  • All byte arrays returned by this class are defensive copies.
  • This class performs no cryptographic operations.
  • Callers must protect serialized private key material at rest and in transit.

Thread-safety

Access and destruction are synchronized.

Since:
1.0

  • Constructor Details

    • SlhDsaPrivateKeySpec

      public SlhDsaPrivateKeySpec(byte[] encodedPkcs8)
      Creates a new specification using the default provider "BC".
      Parameters:
      encodedPkcs8 - PKCS#8-encoded SLH-DSA private key bytes
      Throws:
      IllegalArgumentException - if encodedPkcs8 is null

    • SlhDsaPrivateKeySpec

      public SlhDsaPrivateKeySpec(byte[] encodedPkcs8, String providerName)
      Creates a new specification using the supplied provider.

      If providerName is null, the default provider "BC" is used.

      Parameters:
      encodedPkcs8 - PKCS#8-encoded SLH-DSA private key bytes
      providerName - JCA provider name to use for import; may be null
      Throws:
      IllegalArgumentException - if encodedPkcs8 is null

  • Method Details

    • encoded

      public byte[] encoded()
      Returns a defensive copy of the PKCS#8-encoded private key bytes.
      Returns:
      a copy of the encoded private key

    • providerName

      public String providerName()
      Returns the provider name associated with this specification.
      Returns:
      provider name, never null

    • marshal

      public static PairSeq marshal(SlhDsaPrivateKeySpec spec)
      Serializes the given spec into a PairSeq.

      The encoded key is stored as Base64 without padding under "pkcs8.b64". The provider is stored under "provider".

      Parameters:
      spec - the private key specification to serialize
      Returns:
      serialized representation
      Throws:
      NullPointerException - if spec is null

    • unmarshal

      public static SlhDsaPrivateKeySpec unmarshal(PairSeq p)
      Deserializes a SlhDsaPrivateKeySpec from a PairSeq.

      Expects key "pkcs8.b64" (required) and "provider" (optional; defaults to "BC").

      Parameters:
      p - serialized input
      Returns:
      reconstructed private key specification
      Throws:
      IllegalArgumentException - if "pkcs8.b64" is missing
      NullPointerException - if p is null

    • destroy

      public void destroy()
      Specified by:
      destroy in interface Destroyable

    • isDestroyed

      public boolean isDestroyed()
      Specified by:
      isDestroyed in interface Destroyable