Package zeroecho.sdk.hybrid.signature

package zeroecho.sdk.hybrid.signature
Hybrid signature composition for streaming pipelines.

This package provides SDK-level hybrid signatures that combine two independent signature schemes (typically a classical and a post-quantum algorithm) and expose them as a single streaming signature engine suitable for TagTrailerDataContentBuilder and related pipeline stages.

Concept

A hybrid signature computes two component signatures over the same message stream and then aggregates verification according to a configured rule:

  • AND - verification succeeds only if both component signatures verify.
  • OR - verification succeeds if at least one component signature verifies.

The AND rule is intended for security-hardening scenarios (both schemes must hold). The OR rule is intended for migration/fallback scenarios (accept if at least one scheme verifies), and should be used with clear policy and operational intent.

Main types

  • HybridSignatureProfile - immutable configuration describing the two component algorithms, optional per-algorithm specs, and the verification rule.
  • HybridSignatureContexts - factory methods for creating hybrid signing and verification contexts from keys and a HybridSignatureProfile.
  • HybridSignatureContext - the streaming hybrid SignatureContext implementation that computes/verifies two signatures in a single pass.

Integration with pipeline builders

The hybrid signature contexts created by this package are intended to be used as engines in trailer-oriented pipeline stages. In particular:

Streaming and resource management

Hybrid signature computation and verification are streaming operations. The resulting contexts and streams must be closed to release resources and to finalize tag/signature production or verification.

Security notes

  • Hybrid verification should be configured explicitly for mismatch handling (throw-on-mismatch vs. capture/flag) at the pipeline layer. This package focuses on computing/verifying the two component signatures and returning an aggregated result.
  • Implementations must not log or otherwise expose sensitive material (private keys, seeds, message contents, intermediate state).

Thread safety

Context instances are not thread-safe and are intended for single-use in a single pipeline execution. Create a new context instance for each independent signing or verification operation.

Since:
1.0