Class Pkcs11SigningProviderFactory

java.lang.Object

zeroecho.pki.impl.crypto.pkcs11.Pkcs11SigningProviderFactory

All Implemented Interfaces:

ConfigurableProvider<SigningProvider>, SigningProviderFactory

public final class Pkcs11SigningProviderFactory
extends Object
implements SigningProviderFactory

ServiceLoader factory for the PKCS#11 / HSM signing provider.

Keys are generated on the HSM and never exported. Cryptographic operations execute on the HSM token via the JDK's built-in SunPKCS11 provider. This satisfies FIPS 140-3 Level 3 requirements for key non-exportability.

Configuration keys

• pkcs11ConfigFile (required): path to the SunPKCS11 library config file
• pinVariable (required): name of the environment variable holding the HSM PIN
• slot (optional, default 0): PKCS#11 slot index
• keyLabelPattern (optional, default zeroecho-{authorityId}): key label template
• keyRefPrefix (optional): prefix applied to key references
• operationHorizon (optional, ISO-8601 duration, default P90D)
• sessionPoolSize (optional, default 2): number of PKCS#11 sessions
• supportedAlgorithms (optional, comma-separated JCA names)

Security

The PIN is read from the environment variable named by pinVariable, never from the config file itself. Configuration values must not be logged.

Since:

1.0

Field Summary

Fields

Modifier and Type	Field	Description
static final String	DC_HSM_KEYSTORE_OPEN_FAILED	Stable failure code when the HSM KeyStore cannot be opened.
static final String	DC_PIN_ENV_NOT_SET	Stable failure code when the HSM PIN environment variable is absent or empty.
static final String	DC_PKCS11_PROVIDER_LOAD_FAILED	Stable failure code when the PKCS#11 provider cannot be loaded.

Constructor Summary

Constructors

Constructor	Description
Pkcs11SigningProviderFactory()	Creates a provider factory without opening an HSM session.

Method Summary

Modifier and Type	Method	Description
SigningProvider	allocate(ProviderConfig config)	Allocates a new instance using the provided configuration.
SigningProvider	allocate(ProviderConfig config, SigningProviderRuntimeDependencies dependencies)	Allocates a provider with explicit process-local runtime dependencies.
String	id()	Returns a stable backend identifier (e.g.
Set<String>	supportedKeys()	Returns the configuration keys understood by this backend.
void	validateConfig(ProviderConfig config)	Validates configuration for the PKCS#11 signing provider.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

DC_PIN_ENV_NOT_SET

public static final String DC_PIN_ENV_NOT_SET

Stable failure code when the HSM PIN environment variable is absent or empty.

See Also:

• Constant Field Values

DC_PKCS11_PROVIDER_LOAD_FAILED

public static final String DC_PKCS11_PROVIDER_LOAD_FAILED

Stable failure code when the PKCS#11 provider cannot be loaded.

See Also:

• Constant Field Values

DC_HSM_KEYSTORE_OPEN_FAILED

public static final String DC_HSM_KEYSTORE_OPEN_FAILED

Stable failure code when the HSM KeyStore cannot be opened.

See Also:

• Constant Field Values

Constructor Details

Pkcs11SigningProviderFactory

public Pkcs11SigningProviderFactory()

Creates a provider factory without opening an HSM session.

Method Details

id

public String id()

Description copied from interface: ConfigurableProvider

Returns a stable backend identifier (e.g. "fs", "jdbc").

Specified by:

id in interface ConfigurableProvider<SigningProvider>

Returns:

backend identifier (never null, never blank)

supportedKeys

public Set<String> supportedKeys()

Description copied from interface: ConfigurableProvider

Returns the configuration keys understood by this backend.

Keys are informational (diagnostics/validation/help). Unknown keys must be ignored by implementations for forward compatibility.

Specified by:

supportedKeys in interface ConfigurableProvider<SigningProvider>

Returns:

supported configuration keys (never null)

validateConfig

public void validateConfig(ProviderConfig config)

Validates configuration for the PKCS#11 signing provider.

Specified by:

validateConfig in interface ConfigurableProvider<SigningProvider>

Parameters:

config - provider configuration (never null)

Throws:

IllegalArgumentException - if the configuration is incomplete or invalid

allocate

public SigningProvider allocate(ProviderConfig config)

Description copied from interface: ConfigurableProvider

Allocates a new instance using the provided configuration.

Implementations must validate required keys and throw IllegalArgumentException if configuration is incomplete or invalid.

Specified by:

allocate in interface ConfigurableProvider<SigningProvider>

Parameters:

config - configuration (never null)

Returns:

new instance (never null)

allocate

public SigningProvider allocate(ProviderConfig config,
 SigningProviderRuntimeDependencies dependencies)

Description copied from interface: SigningProviderFactory

Allocates a provider with explicit process-local runtime dependencies.

Specified by:

allocate in interface SigningProviderFactory

Parameters:

config - validated persistent provider configuration

dependencies - process-local security capabilities

Returns:

opened signing provider owned by the caller