Class SM9EncUserPrivateKeySpec

java.lang.Object
java.security.spec.EncodedKeySpec
org.bouncycastle.jcajce.spec.SM9EncUserPrivateKeySpec
All Implemented Interfaces:
KeySpec
public class SM9EncUserPrivateKeySpec extends EncodedKeySpec
Key spec for rebuilding a user's SM9 encryption (KEM / decryption) private key (de, GM/T 0044.4) from its PKCS#8 encoding through KeyFactory.SM9. The encoding alone does not determine a usable key - decryption also needs the encryption master public key, the user's identity (part of the decryption KDF input) and the hid the KGC derived the key under, none of which are part of it - so the spec carries all four, letting a stored user key be reconstituted without access to the master private key.

This extends EncodedKeySpec rather than PKCS8EncodedKeySpec: the encoded bytes are a real PKCS#8 encoding (reflected in getFormat()), but the spec is not self-sufficient the way a plain PKCS8EncodedKeySpec is meant to be, and subclassing the concrete JDK type would let generic code treat it as one.

The matching spec is returned by the factory's getKeySpec method, so a user key round-trips: store getEncoded() (or ask for this spec), rebuild with generatePrivate. A key-exchange user key rebuilds the same way with exchangeKey set - the encoding does not record which usage the KGC derived the key for, so the flag is the importer's claim, and the consumers enforce whichever usage the rebuilt key carries (KeyAgreement.SM9 accepts only exchange keys; the KEM and cipher only non-exchange keys).

  • Constructor Details

    • SM9EncUserPrivateKeySpec

      public SM9EncUserPrivateKeySpec(byte[] pkcs8Encoding, SM9EncMasterPublicKey masterPublicKey, byte[] identity, byte hid)
      Base constructor, for a KEM / decryption user key.
      Parameters:
      pkcs8Encoding - the user private key's PKCS#8 encoding, as returned by the key's getEncoded().
      masterPublicKey - the encryption master public key the user key was derived under.
      identity - the user's identity.
      hid - the private-key generation function identifier the KGC derived the key under.

    • SM9EncUserPrivateKeySpec

      public SM9EncUserPrivateKeySpec(byte[] pkcs8Encoding, SM9EncMasterPublicKey masterPublicKey, byte[] identity, byte hid, boolean exchangeKey)
      Parameters:
      pkcs8Encoding - the user private key's PKCS#8 encoding, as returned by the key's getEncoded().
      masterPublicKey - the encryption master public key the user key was derived under.
      identity - the user's identity.
      hid - the private-key generation function identifier the KGC derived the key under.
      exchangeKey - whether the KGC derived the key for the key exchange (from generateExchangeKeyPair) rather than for KEM / decryption.

  • Method Details

    • getMasterPublicKey

      public SM9EncMasterPublicKey getMasterPublicKey()

    • getIdentity

      public byte[] getIdentity()

    • getHid

      public byte getHid()
      The private-key generation function identifier hid the key was derived under - the KGC's published choice, not sensitive.

    • isExchangeKey

      public boolean isExchangeKey()
      Whether the key rebuilds as a key-exchange user key rather than a KEM / decryption one.

    • getFormat

      public String getFormat()
      Specified by:
      getFormat in class EncodedKeySpec