org.bouncycastle.crypto.params
Class SM9SigPrivateKeyParameters

java.lang.Object
  org.bouncycastle.crypto.params.AsymmetricKeyParameter
      org.bouncycastle.crypto.params.SM9SigPrivateKeyParameters

All Implemented Interfaces:

CipherParameters, javax.security.auth.Destroyable

public class SM9SigPrivateKeyParameters

extends AsymmetricKeyParameter

implements javax.security.auth.Destroyable

A user's SM9 signature private key ds_A = [t2]P1, a point of G1 (GM/T 0044.2-2016). Generated by the KGC from the signature master private key and the user's identity. Carries the identity (needed by nothing in this class directly, but part of what a caller needs to identify the key) and a reference to the master public key, which the signer needs to compute g = e(P1, P_pub-s).

Method Summary

void	destroy() Destroy this object, dropping its reference to the private point ds and zeroizing the identity.
static SM9SigPrivateKeyParameters	fromEncoded(byte[] enc, SM9SigMasterPublicKeyParameters masterPublicKey, byte[] identity) Rebuild a signature user key from its bare point encoding, under the master public key and identity it was derived for, which the encoding does not carry.
byte[]	getEncoded() The user's signature private key point ds of G1 in uncompressed form (0x04 || x || y, 65 bytes).
byte[]	getIdentity() The identity this key was derived for.
SM9SigMasterPublicKeyParameters	getMasterPublicKey()
ECPoint	getPrivatePoint()
boolean	isDestroyed()

Methods inherited from class org.bouncycastle.crypto.params.AsymmetricKeyParameter

isPrivate

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Detail

getPrivatePoint

public ECPoint getPrivatePoint()

getMasterPublicKey

public SM9SigMasterPublicKeyParameters getMasterPublicKey()

getIdentity

public byte[] getIdentity()

The identity this key was derived for. Synchronized with destroy(), which zeroes the array in place: the flag is set before the clear, but reading a byte the clear has already written does not order the reader after the flag, so an unsynchronized copy could return a partly zeroed identity with the flag still reading false.

getEncoded

public byte[] getEncoded()

The user's signature private key point ds of G1 in uncompressed form (0x04 || x || y, 65 bytes). The master public key and identity are not part of this encoding; supply them via fromEncoded(byte[], org.bouncycastle.crypto.params.SM9SigMasterPublicKeyParameters, byte[]) to rebuild a usable key.

fromEncoded

public static SM9SigPrivateKeyParameters fromEncoded(byte[] enc,
                                                     SM9SigMasterPublicKeyParameters masterPublicKey,
                                                     byte[] identity)

Rebuild a signature user key from its bare point encoding, under the master public key and identity it was derived for, which the encoding does not carry. The point is refused unless it is a point of G1 other than the point at infinity.

The point is also checked against the master public key and identity, by the KGC's own relation e(ds, [H1(ID || hid, N)]P2 + P_pub-s) = e(P1, P_pub-s), which holds exactly when ds = [ks * (H1(ID || hid, N) + ks)^-1]P1 for the ks behind that P_pub-s: a point paired with another master public key, or filed under another identity, is refused with an IllegalArgumentException rather than imported as a key whose signatures would not verify. ds is secret and the pairing takes its G1 argument to be public, so the relation is checked on [r]ds for a random r, against e(P1, P_pub-s)^r, raised as signing raises it. The check costs a pairing and about what a signature costs.

Parameters:

enc - the encoding getEncoded() writes.

masterPublicKey - the signature master public key the key was derived under.

identity - the identity the key was derived for.

Returns:

the rebuilt key.

destroy

public void destroy()

Destroy this object, dropping its reference to the private point ds and zeroizing the identity.

As the point's coordinates are immutable they cannot be zeroized in place; destruction drops the reference and marks the key destroyed, after which getPrivatePoint(), getEncoded() and getIdentity() throw IllegalStateException. The master public key remains available.

Specified by:

destroy in interface javax.security.auth.Destroyable

isDestroyed

public boolean isDestroyed()

Specified by:

isDestroyed in interface javax.security.auth.Destroyable