Class SphincsPlusPublicKeySpec

java.lang.Object
zeroecho.core.alg.sphincsplus.SphincsPlusPublicKeySpec
All Implemented Interfaces:
AlgorithmKeySpec
public final class SphincsPlusPublicKeySpec extends Object implements AlgorithmKeySpec
Encoded representation of a SPHINCS+ public key.

SphincsPlusPublicKeySpec wraps an X.509-encoded SPHINCS+ public key along with the provider name that should be used for import. It is a simple immutable holder designed for use with SphincsPlusPublicKeyBuilder.

Encoding

  • The key is stored as a defensive copy of the provided X.509 byte array.
  • Marshalling and unmarshalling methods convert between this object and a PairSeq representation using Base64 encoding.
  • The providerName defaults to "BC" (Bouncy Castle provider) if not explicitly supplied.

Thread-safety

Instances are immutable and can be shared safely across threads. Defensive copies are returned for all sensitive material.

Example

// Wrap an X.509-encoded public key
byte[] x509 = ...;
SphincsPlusPublicKeySpec spec = new SphincsPlusPublicKeySpec(x509);

// Import the key via the builder
PublicKey pub = new SphincsPlusPublicKeyBuilder().importPublic(spec);

// Serialize to PairSeq for transport or persistence
PairSeq seq = SphincsPlusPublicKeySpec.marshal(spec);

// Reconstruct from PairSeq
SphincsPlusPublicKeySpec restored = SphincsPlusPublicKeySpec.unmarshal(seq);
Since:
1.0

  • Constructor Details

    • SphincsPlusPublicKeySpec

      public SphincsPlusPublicKeySpec(byte[] encodedX509)
      Constructs a new specification with the default provider "BC".
      Parameters:
      encodedX509 - X.509-encoded SPHINCS+ public key bytes
      Throws:
      IllegalArgumentException - if encodedX509 is null

    • SphincsPlusPublicKeySpec

      public SphincsPlusPublicKeySpec(byte[] encodedX509, String providerName)
      Constructs a new specification with the given provider.
      Parameters:
      encodedX509 - X.509-encoded SPHINCS+ public key bytes
      providerName - JCA provider to use for import; if null, defaults to "BC"
      Throws:
      IllegalArgumentException - if encodedX509 is null or the provider is legacy "BCPQC"

  • Method Details

    • encoded

      public byte[] encoded()
      Returns a defensive copy of the X.509-encoded public key.
      Returns:
      clone of the encoded key bytes

    • providerName

      public String providerName()
      Returns the provider name associated with this specification.
      Returns:
      provider name, never null

    • marshal

      public static PairSeq marshal(SphincsPlusPublicKeySpec spec)
      Serializes this specification into a PairSeq.

      The key bytes are Base64-encoded under the key "x509.b64". The provider name is stored under the key "provider".

      Parameters:
      spec - public key spec to marshal
      Returns:
      serialized PairSeq representation

    • unmarshal

      public static SphincsPlusPublicKeySpec unmarshal(PairSeq p)
      Deserializes a SphincsPlusPublicKeySpec from a PairSeq.

      Expects keys "x509.b64" (required, Base64 string) and "provider" (optional, defaults to "BC").

      Parameters:
      p - serialized input
      Returns:
      a reconstructed public key spec
      Throws:
      IllegalArgumentException - if the encoded key is missing, malformed Base64, or the provider is legacy "BCPQC"