Interface SignatureContext

All Superinterfaces:

AutoCloseable, Closeable, CryptoContext, TagEngine<Signature>

All Known Implementing Classes:

CommonEdDSASignatureContext, Ed25519SignatureContext, Ed448SignatureContext, GenericJcaSignatureContext, LmsSignatureContext, MldsaSignatureContext, RsaSignatureContext, SlhDsaSignatureContext, SphincsPlusSignatureContext, XmssSignatureContext

public non-sealed interface SignatureContext
extends TagEngine<Signature>, CryptoContext

Context for streaming digital signature operations in pull-based pipelines.

A SignatureContext encapsulates the state of a signature algorithm such as Ed25519, ECDSA, or RSA-PSS and exposes it through the TagEngine contract. In produce (SIGN) mode it consumes the message bytes and appends the computed signature as a trailer; in verify (VERIFY) mode it consumes the message bytes and checks an expected signature supplied by the caller.

Operation

• Produce mode: TagEngine.wrap(java.io.InputStream) returns a passthrough stream that emits the original data and, at end-of-stream, appends the signature trailer.
• Verify mode: Provide the expected signature with TagEngine.setExpectedTag(byte[]) and ensure the upstream body does not include a trailer. At end-of-stream the computed signature is compared against the expected one using the configured verification approach set via TagEngine.setVerificationApproach(ThrowingBiPredicate.VerificationBiPredicate).

Usage

Sign with Ed25519

TagEngine<java.security.Signature> eng =
    TagEngineBuilder.ed25519Sign(session, privateKey).get();

try (java.io.InputStream in = eng.wrap(upstream)) {
    in.transferTo(out); // body, then detached signature trailer
}

Verify a detached signature and throw on mismatch

byte[] expectedSig = ...; // obtained via a trusted channel
TagEngine<java.security.Signature> eng =
    TagEngineBuilder.ed25519Verify(publicKey).get();

// Throw if verification fails at EOF:
eng.setVerificationApproach(eng.getVerificationCore().getThrowOnMismatch());
eng.setExpectedTag(expectedSig);

try (java.io.InputStream in = eng.wrap(bodyWithoutTrailer)) {
    in.transferTo(java.io.OutputStream.nullOutputStream()); // compare at EOF
}

Notes

• Instances bind to a specific key and are single-use; they are not thread-safe.
• The signature length reported by TagEngine.tagLength() is algorithm specific and can be used by higher layers to handle trailers.
• Verification failures are handled by the configured approach, for example ThrowingBiPredicate.VerificationBiPredicate.getThrowOnMismatch() or ThrowingBiPredicate.VerificationBiPredicate.getFlagOkInCtx(conflux.CtxInterface, conflux.Key).

Since:

1.0

Field Summary

Fields inherited from interface TagEngine

LOG

Method Summary

Methods inherited from interface CryptoContext

algorithm, close, key

Methods inherited from interface TagEngine

getVerificationCore, setExpectedTag, setVerificationApproach, tagLength, wrap