Class SphincsPlusPrivateKeySpec

java.lang.Object
zeroecho.core.alg.sphincsplus.SphincsPlusPrivateKeySpec
All Implemented Interfaces:
Destroyable, AlgorithmKeySpec
public final class SphincsPlusPrivateKeySpec extends Object implements AlgorithmKeySpec, Destroyable
Encoded representation of a SPHINCS+ private key.

SphincsPlusPrivateKeySpec wraps a PKCS#8-encoded SPHINCS+ private key along with the provider name that should be used for import. It is a simple destroyable holder designed for use with SphincsPlusPrivateKeyBuilder.

Encoding

  • The key is stored as a defensive copy of the provided PKCS#8 byte array.
  • Marshalling and unmarshalling methods convert between this object and a PairSeq representation using Base64 encoding.
  • The providerName defaults to "BC" (Bouncy Castle provider) if not explicitly supplied.

Thread-safety

Access and destruction are synchronized. Defensive copies are returned for all sensitive material.

Example

// Wrap a PKCS#8-encoded private key
byte[] pkcs8 = ...;
SphincsPlusPrivateKeySpec spec = new SphincsPlusPrivateKeySpec(pkcs8);

// Import the key via the builder
PrivateKey priv = new SphincsPlusPrivateKeyBuilder().importPrivate(spec);

// Serialize to PairSeq for transport or persistence
PairSeq seq = SphincsPlusPrivateKeySpec.marshal(spec);

// Reconstruct from PairSeq
SphincsPlusPrivateKeySpec restored = SphincsPlusPrivateKeySpec.unmarshal(seq);
Since:
1.0

  • Constructor Details

    • SphincsPlusPrivateKeySpec

      public SphincsPlusPrivateKeySpec(byte[] encodedPkcs8)
      Constructs a new specification with the default provider "BC".
      Parameters:
      encodedPkcs8 - PKCS#8-encoded SPHINCS+ private key bytes
      Throws:
      IllegalArgumentException - if encodedPkcs8 is null

    • SphincsPlusPrivateKeySpec

      public SphincsPlusPrivateKeySpec(byte[] encodedPkcs8, String providerName)
      Constructs a new specification with the given provider.
      Parameters:
      encodedPkcs8 - PKCS#8-encoded SPHINCS+ private key bytes
      providerName - JCA provider to use for import; if null, defaults to "BC"
      Throws:
      IllegalArgumentException - if encodedPkcs8 is null or the provider is legacy "BCPQC"

  • Method Details

    • encoded

      public byte[] encoded()
      Returns a defensive copy of the PKCS#8-encoded private key.
      Returns:
      clone of the encoded key bytes

    • providerName

      public String providerName()
      Returns the provider name associated with this specification.
      Returns:
      provider name, never null

    • marshal

      public static PairSeq marshal(SphincsPlusPrivateKeySpec spec)
      Serializes this specification into a PairSeq.

      The key bytes are Base64-encoded under the key "pkcs8.b64". The provider name is stored under the key "provider".

      Parameters:
      spec - private key spec to marshal
      Returns:
      serialized PairSeq representation

    • unmarshal

      public static SphincsPlusPrivateKeySpec unmarshal(PairSeq p)
      Deserializes a SphincsPlusPrivateKeySpec from a PairSeq.

      Expects keys "pkcs8.b64" (required, Base64 string) and "provider" (optional, defaults to "BC").

      Parameters:
      p - serialized input
      Returns:
      a reconstructed private key spec
      Throws:
      IllegalArgumentException - if the encoded key is missing, malformed Base64, or the provider is legacy "BCPQC"

    • destroy

      public void destroy()
      Specified by:
      destroy in interface Destroyable

    • isDestroyed

      public boolean isDestroyed()
      Specified by:
      isDestroyed in interface Destroyable