Class SlhDsaSignatureContext

java.lang.Object
zeroecho.core.alg.slhdsa.SlhDsaSignatureContext
All Implemented Interfaces:
Closeable, AutoCloseable, CryptoContext, SignatureContext, TagEngine<Signature>
public final class SlhDsaSignatureContext extends Object implements SignatureContext
Streaming signature context for SLH-DSA (FIPS 205).

SlhDsaSignatureContext adapts a JCA Signature engine for use within the ZeroEcho streaming signature infrastructure. It supports both signing and verification and delegates the low-level mechanics to GenericJcaSignatureContext.

Provider and algorithm

  • JCA algorithm: "SLH-DSA".
  • Provider: "BC" (Bouncy Castle core provider).

Streaming contract

  • SIGN: the wrapped stream emits the message body and appends a detached signature trailer at EOF.
  • VERIFY: the wrapped stream emits the body only; verification is performed at EOF against a caller-supplied expected tag.

Security

This class never logs secrets, key material, plaintext, or signature bytes.

Since:
1.0

  • Constructor Details

    • SlhDsaSignatureContext

      public SlhDsaSignatureContext(CryptoAlgorithm algorithm, PrivateKey privateKey) throws GeneralSecurityException
      Creates a signing context bound to a private key.

      The produced signature length is resolved by probing the JCA engine via GenericJcaSignatureContext.SignLengthResolver.probeWith(String, String).

      Parameters:
      algorithm - the parent algorithm instance; must not be null
      privateKey - SLH-DSA private key; must not be null
      Throws:
      GeneralSecurityException - if the JCA signature engine cannot be initialized

    • SlhDsaSignatureContext

      public SlhDsaSignatureContext(CryptoAlgorithm algorithm, PublicKey publicKey) throws GeneralSecurityException
      Creates a verification context bound to a public key.

      The expected signature length is derived from the public key parameter set via SLHDSAParameterSpec.getName() and the canonical SLH-DSA sizes.

      Parameters:
      algorithm - the parent algorithm instance; must not be null
      publicKey - SLH-DSA public key; must not be null
      Throws:
      GeneralSecurityException - if the key is invalid or the parameter set is unsupported

  • Method Details

    • algorithm

      public CryptoAlgorithm algorithm()
      Returns the parent CryptoAlgorithm associated with this context.
      Specified by:
      algorithm in interface CryptoContext
      Returns:
      the algorithm instance

    • key

      public Key key()
      Returns the key bound to this context.
      Specified by:
      key in interface CryptoContext
      Returns:
      signing PrivateKey or verification PublicKey

    • close

      public void close()
      Closes this context and releases any underlying resources.

      Once closed, the context must not be reused.

      Specified by:
      close in interface AutoCloseable
      Specified by:
      close in interface Closeable
      Specified by:
      close in interface CryptoContext

    • wrap

      public InputStream wrap(InputStream upstream) throws IOException
      Wraps an input stream such that bytes read from the returned stream update the underlying signature engine.

      In SIGN mode, the wrapper appends the signature trailer at EOF. In VERIFY mode, the wrapper compares the computed signature at EOF against the expected tag configured via setExpectedTag(byte[]).

      Specified by:
      wrap in interface TagEngine<Signature>
      Parameters:
      upstream - input stream providing message bytes; must not be null
      Returns:
      wrapped stream that performs signing or verification as bytes are read
      Throws:
      IOException - if wrapping fails

    • tagLength

      public int tagLength()
      Returns the signature (tag) length in bytes for the parameter set in use.
      Specified by:
      tagLength in interface TagEngine<Signature>
      Returns:
      signature length in bytes

    • setExpectedTag

      public void setExpectedTag(byte[] expected)
      Supplies the expected signature (tag) for VERIFY mode.

      Implementations may defensively copy the provided array. Callers should treat this value as sensitive and avoid logging or persisting it unless explicitly required by the application.

      Specified by:
      setExpectedTag in interface TagEngine<Signature>
      Parameters:
      expected - expected signature bytes; must not be null

    • setVerificationApproach

      public void setVerificationApproach(ThrowingBiPredicate.VerificationBiPredicate<Signature> strategy)
      Sets the verification approach used at EOF to compare the computed and expected signatures.
      Specified by:
      setVerificationApproach in interface TagEngine<Signature>
      Parameters:
      strategy - verification predicate; must not be null

    • getVerificationCore

      public ThrowingBiPredicate.VerificationBiPredicate<Signature> getVerificationCore()
      Returns the verification predicate core that can be used to select a particular mismatch handling strategy (e.g., throw on mismatch).
      Specified by:
      getVerificationCore in interface TagEngine<Signature>
      Returns:
      the verification predicate core