Class RsaSigDataContentBuilder

java.lang.Object
zeroecho.sdk.builders.alg.RsaSigDataContentBuilder
All Implemented Interfaces:
DataContentBuilder<PlainContent>
public final class RsaSigDataContentBuilder extends Object implements DataContentBuilder<PlainContent>
RsaSigDataContentBuilder builds streaming RSA signature pipelines that sign or verify as an InputStream is consumed.

Overview

The builder produces PlainContent that either passes the original bytes through while appending or checking a detached signature trailer, or emits only the signature or a boolean verification result. The signature variant (PKCS#1 v1.5 or PSS) is configured via spec(RsaSigSpec), pkcs1v15(RsaSigSpec.Hash), or pss(RsaSigSpec.Hash, int). Keys may be supplied, generated, or imported from standard encodings.

Usage examples

// Sign while passing the body through; capture signature via callback:
PlainContent sign = RsaSigDataContentBuilder.builder()
    .pss(RsaSigSpec.Hash.SHA256, 32)
    .withPrivateKey(priv)
    .onSignature(sig -> System.out.println(sig.length))
    .passThrough()
    .sign()
    .build(true);

// Emit a Base64 detached signature:
PlainContent sigOnly = RsaSigDataContentBuilder.builder()
    .pkcs1v15(RsaSigSpec.Hash.SHA512)
    .withPrivateKey(priv)
    .emitBase64Signature()
    .build(true);

// Verify against an expected signature and emit "true"/"false":
PlainContent verdict = RsaSigDataContentBuilder.builder()
    .withPublicKey(pub)
    .pss(RsaSigSpec.Hash.SHA256, 32)
    .expectedSignatureBase64(b64)
    .emitVerificationBoolean()
    .build(true);

Thread-safety

Instances are mutable and not thread-safe. Configure and use each builder instance from a single thread.
See Also:

  • Method Details

    • builder

      public static RsaSigDataContentBuilder builder(ZeroEchoSession session)
      Creates a new builder for constructing RSA signing or verification pipelines. 
      RsaSigDataContentBuilder b = RsaSigDataContentBuilder.builder();
      Parameters:
      session - active session used to create cryptographic contexts
      Returns:
      a new RsaSigDataContentBuilder instance

    • sign

      public RsaSigDataContentBuilder sign()
      Switches the builder to sign mode.
      Returns:
      this builder for chaining

    • verify

      public RsaSigDataContentBuilder verify()
      Switches the builder to verify mode.
      Returns:
      this builder for chaining

    • passThrough

      public RsaSigDataContentBuilder passThrough()
      Configures the pipeline to pass the input body through unchanged while appending or checking a trailer.
      Returns:
      this builder for chaining

    • emitRawSignature

      public RsaSigDataContentBuilder emitRawSignature()
      Configures sign mode to emit the finalized signature as raw bytes.
      Returns:
      this builder for chaining

    • emitHexSignature

      public RsaSigDataContentBuilder emitHexSignature()
      Configures sign mode to emit the finalized signature as lowercase hexadecimal text.
      Returns:
      this builder for chaining

    • emitBase64Signature

      public RsaSigDataContentBuilder emitBase64Signature()
      Configures sign mode to emit the finalized signature as Base64 text.
      Returns:
      this builder for chaining

    • emitVerificationBoolean

      public RsaSigDataContentBuilder emitVerificationBoolean()
      Configures verify mode to emit a textual boolean result.
      Returns:
      this builder for chaining

    • spec

      public RsaSigDataContentBuilder spec(RsaSigSpec s)
      Sets the RSA signature specification, including padding mode and hash options.
      Parameters:
      s - the RSA signature spec; must not be null
      Returns:
      this builder for chaining
      Throws:
      NullPointerException - if s is null

    • pkcs1v15

      public RsaSigDataContentBuilder pkcs1v15(RsaSigSpec.Hash h)
      Selects the PKCS#1 v1.5 signature scheme with the given hash function.
      Parameters:
      h - the hash function to use
      Returns:
      this builder for chaining
      Throws:
      NullPointerException - if h is null

    • pss

      public RsaSigDataContentBuilder pss(RsaSigSpec.Hash h, int saltLen)
      Selects the RSASSA-PSS signature scheme with the given hash function and salt length.
      Parameters:
      h - the hash function to use for both message hash and MGF1
      saltLen - the salt length in bytes
      Returns:
      this builder for chaining

    • withPrivateKey

      public RsaSigDataContentBuilder withPrivateKey(PrivateKey k)
      Supplies the private key to use for signing.
      Parameters:
      k - the private key; must not be null
      Returns:
      this builder for chaining
      Throws:
      NullPointerException - if k is null

    • withPublicKey

      public RsaSigDataContentBuilder withPublicKey(PublicKey k)
      Supplies the public key to use for verification.
      Parameters:
      k - the public key; must not be null
      Returns:
      this builder for chaining
      Throws:
      NullPointerException - if k is null

    • generateKeyPair

      public RsaSigDataContentBuilder generateKeyPair(RsaKeyGenSpec spec)
      Requests generation of a fresh RSA key pair with the provided key generation specification.
      Parameters:
      spec - the RSA key generation spec; must not be null
      Returns:
      this builder for chaining
      Throws:
      NullPointerException - if spec is null

    • importPrivatePkcs8

      public RsaSigDataContentBuilder importPrivatePkcs8(byte[] pkcs8)
      Imports a private key from PKCS#8-encoded bytes.
      Parameters:
      pkcs8 - PKCS#8 PrivateKeyInfo bytes; must not be null
      Returns:
      this builder for chaining
      Throws:
      NullPointerException - if pkcs8 is null

    • importPublicX509

      public RsaSigDataContentBuilder importPublicX509(byte[] x509)
      Imports a public key from X.509 SubjectPublicKeyInfo bytes.
      Parameters:
      x509 - X.509 public key bytes; must not be null
      Returns:
      this builder for chaining
      Throws:
      NullPointerException - if x509 is null

    • expectedSignature

      public RsaSigDataContentBuilder expectedSignature(byte[] raw)
      Supplies the expected signature as raw bytes for verification.
      Parameters:
      raw - the expected signature bytes; must not be null
      Returns:
      this builder for chaining
      Throws:
      NullPointerException - if raw is null

    • expectedSignatureHex

      public RsaSigDataContentBuilder expectedSignatureHex(String hex)
      Supplies the expected signature as a hexadecimal string for verification.
      Parameters:
      hex - the expected signature in hexadecimal; must not be null
      Returns:
      this builder for chaining
      Throws:
      NullPointerException - if hex is null
      IllegalArgumentException - if hex is not valid hexadecimal

    • expectedSignatureBase64

      public RsaSigDataContentBuilder expectedSignatureBase64(String b64)
      Supplies the expected signature as a Base64 string for verification.
      Parameters:
      b64 - the expected signature in Base64; must not be null
      Returns:
      this builder for chaining
      Throws:
      NullPointerException - if b64 is null
      IllegalArgumentException - if b64 is not valid Base64

    • onSignature

      public RsaSigDataContentBuilder onSignature(Consumer<byte[]> cb)
      Registers a callback that receives a defensive copy of the finalized signature bytes in sign mode.
      Parameters:
      cb - the callback to invoke; may be null to clear
      Returns:
      this builder for chaining

    • onVerified

      public RsaSigDataContentBuilder onVerified(Consumer<Boolean> cb)
      Registers a callback that receives the verification result in verify mode.
      Parameters:
      cb - the callback to invoke with true on success and false on failure; may be null to clear
      Returns:
      this builder for chaining

    • build

      public PlainContent build(boolean ignored)
      Builds a streaming signing or verification pipeline according to the current configuration.

      The boolean parameter is ignored and exists only to satisfy the DataContentBuilder interface; behavior is determined by sign() or verify() and the selected output.

      Result

      • Sign mode: returns pass-through content that strips the trailer and optionally invokes onSignature(Consumer) or an emitter of the signature in raw, hex, or Base64.
      • Verify mode: returns pass-through content that throws on mismatch and can invoke onVerified(Consumer), or an emitter of "true"/"false".
      Specified by:
      build in interface DataContentBuilder<PlainContent>
      Parameters:
      ignored - ignored parameter from the interface
      Returns:
      a PlainContent pipeline performing the configured RSA signature operation
      Throws:
      IllegalStateException - if required key material is missing or key setup fails