Class SphincsPlusKeyGenSpec

java.lang.Object

zeroecho.core.alg.sphincsplus.SphincsPlusKeyGenSpec

All Implemented Interfaces:

AlgorithmKeySpec

public final class SphincsPlusKeyGenSpec
extends Object
implements AlgorithmKeySpec

Specification for generating SPHINCS+ key pairs.

SphincsPlusKeyGenSpec selects the hash family, security strength, signature variant, and mode for the current SLH-DSA compatibility binding. ROBUST and HARAKA remain representable for source compatibility but generation rejects them with IllegalArgumentException; they are never remapped. It also carries an optional provider name and explicit Bouncy Castle parameter constant for direct mapping.

Parameters

• SphincsPlusKeyGenSpec.Hash: underlying hash/XOF function (SHA2, SHAKE, or HARAKA).
• SphincsPlusKeyGenSpec.Security: NIST security level, expressed as 128, 192, or 256 bits.
• SphincsPlusKeyGenSpec.Variant: tradeoff between FAST (larger signatures, higher signing speed) and SMALL (shorter signatures, slower signing). Security is unaffected.
• SphincsPlusKeyGenSpec.Mode: only SIMPLE is executable in this binding.
• providerName: JCA provider name (e.g., "BC" for Bouncy Castle). Legacy "BCPQC" generation is rejected.
• explicitParamConstant: optional override; the exact field name of a SLHDSAParameterSpec constant in the Bouncy Castle API. If non-null, it overrides automatic hash/strength/variant mapping, but cannot bypass rejection of ROBUST, HARAKA or prehash parameter constants.

Defaults

The defaultSpec() uses:

• Provider: "BC"
• Hash: SphincsPlusKeyGenSpec.Hash.SHAKE
• Security: SphincsPlusKeyGenSpec.Security.L5_256
• Variant: SphincsPlusKeyGenSpec.Variant.SMALL
• Mode: SphincsPlusKeyGenSpec.Mode.SIMPLE

Example

// Pure SLH-DSA, NIST Level 3 security, SHA-2 based
SphincsPlusKeyGenSpec spec = SphincsPlusKeyGenSpec.of(
    "BC",
    SphincsPlusKeyGenSpec.Hash.SHA2,
    SphincsPlusKeyGenSpec.Security.L3_192,
    SphincsPlusKeyGenSpec.Variant.FAST,
    SphincsPlusKeyGenSpec.Mode.SIMPLE);

KeyPair kp = new SphincsPlusKeyGenBuilder().generateKeyPair(spec);

Since:

1.0

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static enum	SphincsPlusKeyGenSpec.Hash	Hash function families supported by SPHINCS+.
static enum	SphincsPlusKeyGenSpec.Mode	Legacy construction selector.
static enum	SphincsPlusKeyGenSpec.Security	Security levels as defined by NIST PQC (L1, L3, L5).
static enum	SphincsPlusKeyGenSpec.Variant	Signature variants trading performance against signature size.

Method Summary

Modifier and Type	Method	Description
static SphincsPlusKeyGenSpec	defaultSpec()	Returns the default SPHINCS+ key generation spec.
String	explicitParamConstant()	Returns the explicit parameter constant override, if set.
SphincsPlusKeyGenSpec.Hash	hash()	Returns the hash family of this specification.
SphincsPlusKeyGenSpec.Mode	mode()	Returns the construction mode of this specification.
static SphincsPlusKeyGenSpec	of(String providerName, SphincsPlusKeyGenSpec.Hash hash, SphincsPlusKeyGenSpec.Security sec, SphincsPlusKeyGenSpec.Variant var, SphincsPlusKeyGenSpec.Mode mode)	Creates a new specification with explicit algorithm parameters.
String	providerName()	Returns the provider name used for key generation.
SphincsPlusKeyGenSpec.Security	security()	Returns the security level of this specification.
SphincsPlusKeyGenSpec.Variant	variant()	Returns the variant of this specification.
SphincsPlusKeyGenSpec	withExplicitParamConstant(String name)	Returns a copy of this specification with an explicit Bouncy Castle parameter constant override.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

defaultSpec

public static SphincsPlusKeyGenSpec defaultSpec()

Returns the default SPHINCS+ key generation spec.

Returns:

a singleton default specification (SHAKE, L5, SMALL, SIMPLE)

of

public static SphincsPlusKeyGenSpec of(String providerName,
 SphincsPlusKeyGenSpec.Hash hash,
 SphincsPlusKeyGenSpec.Security sec,
 SphincsPlusKeyGenSpec.Variant var,
 SphincsPlusKeyGenSpec.Mode mode)

Creates a new specification with explicit algorithm parameters.

Parameters:

providerName - JCA provider name (e.g., "BC")

hash - hash function family

sec - security level

var - signature variant (FAST vs SMALL)

mode - construction mode (ROBUST vs SIMPLE)

Returns:

a new SphincsPlusKeyGenSpec

withExplicitParamConstant

public SphincsPlusKeyGenSpec withExplicitParamConstant(String name)

Returns a copy of this specification with an explicit Bouncy Castle parameter constant override.

This overrides automatic mapping of hash family, security and variant among the twelve pure SLH-DSA constants. It cannot bypass rejection of ROBUST, HARAKA or prehash parameters. A null name restores automatic mapping.

Parameters:

name - the name of the static field in SLHDSAParameterSpec

Returns:

a new SphincsPlusKeyGenSpec with the override

providerName

public String providerName()

Returns the provider name used for key generation.

Returns:

provider name (never null)

hash

public SphincsPlusKeyGenSpec.Hash hash()

Returns the hash family of this specification.

Returns:

hash family

security

public SphincsPlusKeyGenSpec.Security security()

Returns the security level of this specification.

Returns:

security level

variant

public SphincsPlusKeyGenSpec.Variant variant()

Returns the variant of this specification.

Returns:

signature variant

mode

public SphincsPlusKeyGenSpec.Mode mode()

Returns the construction mode of this specification.

Returns:

construction mode

explicitParamConstant

public String explicitParamConstant()

Returns the explicit parameter constant override, if set.

Returns:

constant name, or null if automatic mapping is used