Interface StateAwareSignature

All Known Implementing Classes:
XMSSMTSignatureSpi, XMSSMTSignatureSpi.generic, XMSSMTSignatureSpi.withSha256, XMSSMTSignatureSpi.withSha256andPrehash, XMSSMTSignatureSpi.withSha512, XMSSMTSignatureSpi.withSha512andPrehash, XMSSMTSignatureSpi.withShake128, XMSSMTSignatureSpi.withShake128_512andPrehash, XMSSMTSignatureSpi.withShake128andPrehash, XMSSMTSignatureSpi.withShake256, XMSSMTSignatureSpi.withShake256_1024andPrehash, XMSSMTSignatureSpi.withShake256andPrehash, XMSSSignatureSpi, XMSSSignatureSpi.generic, XMSSSignatureSpi.withSha256, XMSSSignatureSpi.withSha256andPrehash, XMSSSignatureSpi.withSha512, XMSSSignatureSpi.withSha512andPrehash, XMSSSignatureSpi.withShake128, XMSSSignatureSpi.withShake128_512andPrehash, XMSSSignatureSpi.withShake128andPrehash, XMSSSignatureSpi.withShake256, XMSSSignatureSpi.withShake256_1024andPrehash, XMSSSignatureSpi.withShake256andPrehash
public interface StateAwareSignature
Deprecated.
it's better to avoid this and use extractKeyShard methods where possible.
This interface is implemented by Signature classes returned by the PQC provider where the signature algorithm is one where the private key is updated for each signature generated. Examples of these are algorithms such as GMSS, XMSS, and XMSS^MT.

  • Method Details

    • initVerify

      void initVerify(PublicKey publicKey) throws InvalidKeyException
      Deprecated.
      Throws:
      InvalidKeyException

    • initVerify

      void initVerify(Certificate certificate) throws InvalidKeyException
      Deprecated.
      Throws:
      InvalidKeyException

    • initSign

      void initSign(PrivateKey privateKey) throws InvalidKeyException
      Deprecated.
      Throws:
      InvalidKeyException

    • initSign

      void initSign(PrivateKey privateKey, SecureRandom random) throws InvalidKeyException
      Deprecated.
      Throws:
      InvalidKeyException

    • sign

      byte[] sign() throws SignatureException
      Deprecated.
      Throws:
      SignatureException

    • sign

      int sign(byte[] outbuf, int offset, int len) throws SignatureException
      Deprecated.
      Throws:
      SignatureException

    • verify

      boolean verify(byte[] signature) throws SignatureException
      Deprecated.
      Throws:
      SignatureException

    • verify

      boolean verify(byte[] signature, int offset, int length) throws SignatureException
      Deprecated.
      Throws:
      SignatureException

    • update

      void update(byte b) throws SignatureException
      Deprecated.
      Throws:
      SignatureException

    • update

      void update(byte[] data) throws SignatureException
      Deprecated.
      Throws:
      SignatureException

    • update

      void update(byte[] data, int off, int len) throws SignatureException
      Deprecated.
      Throws:
      SignatureException

    • update

      void update(ByteBuffer data) throws SignatureException
      Deprecated.
      Throws:
      SignatureException

    • getAlgorithm

      String getAlgorithm()
      Deprecated.

    • isSigningCapable

      boolean isSigningCapable()
      Deprecated.
      Return true if this Signature object can be used for signing. False otherwise.
      Returns:
      true if we are capable of making signatures.

    • getUpdatedPrivateKey

      PrivateKey getUpdatedPrivateKey()
      Deprecated.
      Return the current version of the private key with the updated state.

      Note: what this leaves behind depends on whether a signature has been generated since initSign(). After one, the key handed back is the key that signature spent and the Signature object keeps nothing: it cannot generate another signature without a further call to initSign(), and a second call to this method throws. Before one, the object keeps a single usage to sign with and hands back the rest, so it remains capable of exactly one signature - that is the whole point of collecting first, since the state a caller is obliged to persist is then durable before the one-time key covering it is spent. A second call in that state hands back the same key again rather than a further shard.

      Collecting first and then signing joins the two: the signature spends the one usage the object kept, and a collection after it throws rather than handing that spent shard over. Everything the caller has to store it was given by the first collection, and the shard adds nothing to it - so a caller that collects in a finally beside an explicit collection is refused instead of overwriting the remainder with a key reporting nothing remaining.

      The key that comes back may report no usages remaining - a Signature object initialised on a spent key still has state its caller has to store - so a non-null return is not on its own a statement that anything is left to sign with. isSigningCapable() is what answers that, and the two do differ in that case.

      Returns:
      an updated private key object, which can be used for later signature generation.