APIdia Launch Partner
Top Description Inners Constructors Methods
sun.security.util

public Class SignatureUtil

extends Object
Class Inheritance
Imports
java.io.IOException, java.security.*, java.security.interfaces.EdECKey, .EdECPrivateKey, .RSAKey, java.security.spec.*, java.util.Locale, sun.security.pkcs.NamedPKCS8Key, sun.security.rsa.RSAUtil, jdk.internal.access.SharedSecrets, sun.security.x509.AlgorithmId
Utility class for Signature related operations. Currently used by various internal PKI classes such as sun.security.x509.X509CertImpl, sun.security.pkcs.SignerInfo, for setting signature parameters.
Since
11

Nested and Inner Type Summary

Modifier and TypeClass and Description
public static class
SignatureUtil.DigestAlgHolder

private static class
SignatureUtil.PSSParamsHolder

Constructor Summary

AccessConstructor and Description
public
SignatureUtil()

Method Summary

Modifier and TypeMethod and Description
private static Signature
autoInitInternal(String alg, PrivateKey key, Signature s)

public static void
checkKeyAndSigAlgMatch(PrivateKey
must not be null
key, String
must not be null
sAlg)

Checks if a signature algorithm matches a key, i.e. if this signature can be initialized with this key.

private static String

Returns:

the matching algorithm name or the OID string in upper case.
checkName(String
input, could be in any form
algName)

Convert OID.1.2.3.4 or 1.2.3.4 to its matching stdName, and return upper case algorithm name.

private static AlgorithmParameters
createAlgorithmParameters(String algName, byte[] paramBytes)

private static String
ecStrength(int bitLength)

Return the default message digest algorithm based on the specified EC key size.

public static String
extractDigestAlgFromDwithE(String signatureAlgorithm)

Extracts the digest algorithm name from a signature algorithm name in either the "DIGESTwithENCRYPTION" or the "DIGESTwithENCRYPTIONandWHATEVER" format.

public static String

Returns:

the key algorithm name, or null if the input is not in either of the formats.
extractKeyAlgFromDwithE(String signatureAlgorithm)

Extracts the key algorithm name from a signature algorithm name in either the "DIGESTwithENCRYPTION" or the "DIGESTwithENCRYPTIONandWHATEVER" format.

public static Signature
fromKey(String
signature algorithms
sigAlg, PrivateKey
private key
key, String
(optional) provider
provider)

Create a Signature that has been initialized with proper key and params.

public static Signature
fromKey(String
signature algorithms
sigAlg, PrivateKey
private key
key, Provider
(optional) provider
provider)

Create a Signature that has been initialized with proper key and params.

public static AlgorithmId

Returns:

the AlgorithmId, not null
fromSignature(Signature
the signature object
sigEngine, PrivateKey
the private key
key)

Derives AlgorithmId from a signature object and a key.

public static AlgorithmParameterSpec
getDefaultParamSpec(String sigAlg, Key k)

Returns default AlgorithmParameterSpec for a key used in a signature.

public static String

Returns:

the default alg, might be null if unsupported
getDefaultSigAlgForKey(PrivateKey
cannot be null
k)

Returns the default signature algorithm for a private key.

public static AlgorithmId

Returns:

the digest algId
getDigestAlgInPkcs7SignerInfo(Signature
Signature object that tells you RSASSA-PSS params
signer, String
Signature algorithm
sigalg, PrivateKey
key tells you EdDSA params
privateKey, PublicKey
key tells you HSS/LMS hash algorithm
publicKey, boolean
Ed448 uses different digest algs depending on this
directsign)

Determines the digestEncryptionAlgorithmId in PKCS7 SignerInfo.

public static AlgorithmParameterSpec

Returns:

an AlgorithmParameterSpec, null if params is null
getParamSpec(String
signature algorithm
sigName, AlgorithmParameters
(optional) parameters
params)

Utility method for converting the specified AlgorithmParameters object into an AlgorithmParameterSpec object.

public static AlgorithmParameterSpec

Returns:

an AlgorithmParameterSpec, null if paramBytes is null
getParamSpec(String
signature algorithm
sigName, byte[]
(optional) parameter bytes
paramBytes)

Utility method for converting the specified parameter bytes into an AlgorithmParameterSpec object.

private static String
ifcFfcStrength(int bitLength)

Return the default message digest algorithm based on both the security strength of the specified IFC/FFC key size, i.e. RSA, RSASSA-PSS, and the recommendation from NIST CNSA, e.g. use SHA-384 and min 3072-bit.

public static void
initSignWithParam(Signature s, PrivateKey key, AlgorithmParameterSpec params, SecureRandom sr)

public static void
initVerifyWithParam(Signature s, PublicKey key, AlgorithmParameterSpec params)

public static void
initVerifyWithParam(Signature s, Certificate cert, AlgorithmParameterSpec params)

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Constructor Detail

SignatureUtilback to summary
public SignatureUtil()

Method Detail

autoInitInternalback to summary
private static Signature autoInitInternal(String alg, PrivateKey key, Signature s) throws InvalidKeyException
checkKeyAndSigAlgMatchback to summary
public static void checkKeyAndSigAlgMatch(PrivateKey key, String sAlg)

Checks if a signature algorithm matches a key, i.e. if this signature can be initialized with this key. Currently used in jdk.security.jarsigner.JarSigner to fail early.

Note

Unknown signature algorithms are allowed.

Parameters
key:PrivateKey

must not be null

sAlg:String

must not be null

Exceptions
IllegalArgumentException:
if they are known to not match
checkNameback to summary
private static String checkName(String algName)

Convert OID.1.2.3.4 or 1.2.3.4 to its matching stdName, and return upper case algorithm name.

Parameters
algName:String

input, could be in any form

Returns:String

the matching algorithm name or the OID string in upper case.

createAlgorithmParametersback to summary
private static AlgorithmParameters createAlgorithmParameters(String algName, byte[] paramBytes) throws ProviderException
ecStrengthback to summary
private static String ecStrength(int bitLength)

Return the default message digest algorithm based on the specified EC key size. Attention: sync with the @implNote inside jdk.security.jarsigner.JarSigner.Builder#getDefaultSignatureAlgorithm.

extractDigestAlgFromDwithEback to summary
public static String extractDigestAlgFromDwithE(String signatureAlgorithm)

Extracts the digest algorithm name from a signature algorithm name in either the "DIGESTwithENCRYPTION" or the "DIGESTwithENCRYPTIONandWHATEVER" format. It's OK to return "SHA1" instead of "SHA-1".

extractKeyAlgFromDwithEback to summary
public static String extractKeyAlgFromDwithE(String signatureAlgorithm)

Extracts the key algorithm name from a signature algorithm name in either the "DIGESTwithENCRYPTION" or the "DIGESTwithENCRYPTIONandWHATEVER" format.

Returns:String

the key algorithm name, or null if the input is not in either of the formats.

fromKeyback to summary
public static Signature fromKey(String sigAlg, PrivateKey key, String provider) throws NoSuchAlgorithmException, NoSuchProviderException, InvalidKeyException

Create a Signature that has been initialized with proper key and params.

Parameters
sigAlg:String

signature algorithms

key:PrivateKey

private key

provider:String

(optional) provider

fromKeyback to summary
public static Signature fromKey(String sigAlg, PrivateKey key, Provider provider) throws NoSuchAlgorithmException, InvalidKeyException

Create a Signature that has been initialized with proper key and params.

Parameters
sigAlg:String

signature algorithms

key:PrivateKey

private key

provider:Provider

(optional) provider

fromSignatureback to summary
public static AlgorithmId fromSignature(Signature sigEngine, PrivateKey key) throws SignatureException

Derives AlgorithmId from a signature object and a key.

Parameters
sigEngine:Signature

the signature object

key:PrivateKey

the private key

Returns:AlgorithmId

the AlgorithmId, not null

Exceptions
SignatureException:
if cannot find one
getDefaultParamSpecback to summary
public static AlgorithmParameterSpec getDefaultParamSpec(String sigAlg, Key k)

Returns default AlgorithmParameterSpec for a key used in a signature. This is only useful for RSASSA-PSS now, which is the only algorithm that must be initialized with a AlgorithmParameterSpec now.

getDefaultSigAlgForKeyback to summary
public static String getDefaultSigAlgForKey(PrivateKey k)

Returns the default signature algorithm for a private key.

Parameters
k:PrivateKey

cannot be null

Returns:String

the default alg, might be null if unsupported

getDigestAlgInPkcs7SignerInfoback to summary
public static AlgorithmId getDigestAlgInPkcs7SignerInfo(Signature signer, String sigalg, PrivateKey privateKey, PublicKey publicKey, boolean directsign) throws NoSuchAlgorithmException

Determines the digestEncryptionAlgorithmId in PKCS7 SignerInfo.

Parameters
signer:Signature

Signature object that tells you RSASSA-PSS params

sigalg:String

Signature algorithm

privateKey:PrivateKey

key tells you EdDSA params

publicKey:PublicKey

key tells you HSS/LMS hash algorithm

directsign:boolean

Ed448 uses different digest algs depending on this

Returns:AlgorithmId

the digest algId

getParamSpecback to summary
public static AlgorithmParameterSpec getParamSpec(String sigName, AlgorithmParameters params) throws ProviderException

Utility method for converting the specified AlgorithmParameters object into an AlgorithmParameterSpec object.

Parameters
sigName:String

signature algorithm

params:AlgorithmParameters

(optional) parameters

Returns:AlgorithmParameterSpec

an AlgorithmParameterSpec, null if params is null

getParamSpecback to summary
public static AlgorithmParameterSpec getParamSpec(String sigName, byte[] paramBytes) throws ProviderException

Utility method for converting the specified parameter bytes into an AlgorithmParameterSpec object.

Parameters
sigName:String

signature algorithm

paramBytes:byte[]

(optional) parameter bytes

Returns:AlgorithmParameterSpec

an AlgorithmParameterSpec, null if paramBytes is null

ifcFfcStrengthback to summary
private static String ifcFfcStrength(int bitLength)

Return the default message digest algorithm based on both the security strength of the specified IFC/FFC key size, i.e. RSA, RSASSA-PSS, and the recommendation from NIST CNSA, e.g. use SHA-384 and min 3072-bit. Attention: sync with the @implNote inside jdk.security.jarsigner.JarSigner.Builder#getDefaultSignatureAlgorithm.

initSignWithParamback to summary
public static void initSignWithParam(Signature s, PrivateKey key, AlgorithmParameterSpec params, SecureRandom sr) throws InvalidAlgorithmParameterException, InvalidKeyException
initVerifyWithParamback to summary
public static void initVerifyWithParam(Signature s, PublicKey key, AlgorithmParameterSpec params) throws InvalidAlgorithmParameterException, InvalidKeyException
initVerifyWithParamback to summary
public static void initVerifyWithParam(Signature s, Certificate cert, AlgorithmParameterSpec params) throws InvalidAlgorithmParameterException, InvalidKeyException
sun.security.util back to summary

public Class SignatureUtil.DigestAlgHolder

extends Object
Class Inheritance

Field Summary

Modifier and TypeField and Description
public static final AlgorithmId
sha512

public static final AlgorithmId
shake256_512

public static final AlgorithmId
shake256lenWith512

Constructor Summary

AccessConstructor and Description
public
DigestAlgHolder()

Method Summary

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

sha512back to summary
public static final AlgorithmId sha512
shake256_512back to summary
public static final AlgorithmId shake256_512
shake256lenWith512back to summary
public static final AlgorithmId shake256lenWith512

Constructor Detail

DigestAlgHolderback to summary
public DigestAlgHolder()
sun.security.util back to summary

private Class SignatureUtil.PSSParamsHolder

extends Object
Class Inheritance

Field Summary

Modifier and TypeField and Description
pack-priv static final PSSParameterSpec
PSS_256_SPEC

pack-priv static final PSSParameterSpec
PSS_384_SPEC

pack-priv static final PSSParameterSpec
PSS_512_SPEC

Constructor Summary

AccessConstructor and Description
private
PSSParamsHolder()

Method Summary

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

PSS_256_SPECback to summary
pack-priv static final PSSParameterSpec PSS_256_SPEC
PSS_384_SPECback to summary
pack-priv static final PSSParameterSpec PSS_384_SPEC
PSS_512_SPECback to summary
pack-priv static final PSSParameterSpec PSS_512_SPEC

Constructor Detail

PSSParamsHolderback to summary
private PSSParamsHolder()