Class SphincsPlusAlgorithm

java.lang.Object

zeroecho.core.CryptoAlgorithm

zeroecho.core.alg.AbstractCryptoAlgorithm

zeroecho.core.alg.sphincsplus.SphincsPlusAlgorithm

public final class SphincsPlusAlgorithm
extends AbstractCryptoAlgorithm

SPHINCS+ signature algorithm binding for the ZeroEcho framework.

SphincsPlusAlgorithm retains the SPHINCS+ identifier as a compatibility binding for pure SLH-DSA; legacy SPHINCS+ keys and ROBUST are unsupported. It registers signing and verification roles, along with asymmetric key builders for generation and import of SPHINCS+ key material.

Capabilities

• KeyUsage.SIGN: produces SPHINCS+ signatures using a PrivateKey.
• KeyUsage.VERIFY: verifies SPHINCS+ signatures using a PublicKey.

Each role is bound to a SignatureContext created via SphincsPlusSignatureContext. Both roles are configured with a VoidSpec, as SPHINCS+ requires no runtime context parameters.

Key builders

• SphincsPlusKeyGenSpec: generate new key pairs with parameter set selection (e.g., SHAKE-256s, SIMPLE mode with fast/small variants).
• SphincsPlusPublicKeySpec: import X.509-encoded public keys.
• SphincsPlusPrivateKeySpec: import PKCS#8-encoded private keys.

Example

CryptoAlgorithm alg = new SphincsPlusAlgorithm();
KeyPair kp = alg.asymmetricKeyPairGenerator(SphincsPlusKeyGenSpec.class)
                .generateKeyPair(SphincsPlusKeyGenSpec.defaultSpec());

try (SignatureContext signer =
         alg.createContext(KeyUsage.SIGN, kp.getPrivate(), null)) {
    signer.update(message);
    byte[] sig = signer.sign();
}

try (SignatureContext verifier =
         alg.createContext(KeyUsage.VERIFY, kp.getPublic(), null)) {
    verifier.update(message);
    boolean ok = verifier.verify(sig);
}

Thread-safety

Instances of this class are immutable and can be shared across threads. The created SignatureContext objects are not thread-safe.

Since:

1.0

Constructor Summary

Constructors

Constructor	Description
SphincsPlusAlgorithm()	Creates a new SPHINCS+ algorithm instance and registers its capabilities.

Method Summary

Modifier and Type	Method	Description
List<ParameterSetDescriptor<? extends AlgorithmKeySpec>>	parameterSets()	Returns the discoverable parameter sets (or parameterized templates) supported by this algorithm.

Methods inherited from class AbstractCryptoAlgorithm

capability

Methods inherited from class CryptoAlgorithm

addCapability, asymmetricKeyPairGenerator, bindContext, createContext, displayName, id, keyOperations, listCapabilities, priority, privateKeyImporter, providerName, publicKeyImporter, registerAsymmetricKeyPairGenerator, registerPrivateKeyImporter, registerPublicKeyImporter, registerSymmetricKeyGenerator, registerSymmetricKeyImporter, requiresStatefulSigning, roles, supports, symmetricKeyGenerator, symmetricKeyImporter

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

SphincsPlusAlgorithm

public SphincsPlusAlgorithm()

Creates a new SPHINCS+ algorithm instance and registers its capabilities.

The constructor binds the algorithm identifier "SPHINCS+" (with display name "SPHINCSPLUS") to the following:

• Capability for KeyUsage.SIGN, producing a SignatureContext from a PrivateKey.
• Capability for KeyUsage.VERIFY, producing a SignatureContext from a PublicKey.
• Asymmetric key builders for SphincsPlusKeyGenSpec, SphincsPlusPublicKeySpec, and SphincsPlusPrivateKeySpec to support key pair generation and key import from standard encodings.

Both signing and verifying contexts are configured with VoidSpec, since SPHINCS+ requires no runtime parameters beyond the key material.

Throws:

IllegalArgumentException - if a signature context cannot be initialized due to provider errors

Method Details

parameterSets

public List<ParameterSetDescriptor<? extends AlgorithmKeySpec>> parameterSets()

Description copied from class: CryptoAlgorithm

Returns the discoverable parameter sets (or parameterized templates) supported by this algorithm.

Callers (UIs, provisioning tools, policy engines) use this list to present users with valid, named key-generation options without prior knowledge of the concrete algorithm. Each entry is either a pre-built ParameterSetDescriptor.Concrete (ready spec) or a ParameterSetDescriptor.Template (user-supplied arguments produce the spec).

The default implementation returns an empty list. Algorithms with finite, enumerable parameter sets should override this method. Overrides must return immutable lists in stable order, with unique nonblank descriptor identifiers. Registry loading validates a snapshot; external providers remain responsible for maintaining the contract on subsequent calls. Implementations may use ParameterSetDescriptor.snapshot(List) to validate and copy their list.

Overrides:

parameterSets in class CryptoAlgorithm

Returns:

immutable list of parameter set descriptors; never null