Package org.bouncycastle.jcajce.spec

Class SM9EncUserPrivateKeySpec

java.lang.Object

java.security.spec.EncodedKeySpec

org.bouncycastle.jcajce.spec.SM9EncUserPrivateKeySpec

All Implemented Interfaces:

java.security.spec.KeySpec

public class SM9EncUserPrivateKeySpec
extends java.security.spec.EncodedKeySpec

Key spec for rebuilding a user's SM9 encryption (KEM / decryption) private key (de, GM/T 0044.4) from its PKCS#8 encoding through KeyFactory.SM9. The encoding alone does not determine a usable key - decryption also needs the encryption master public key, the user's identity (part of the decryption KDF input) and the hid the KGC derived the key under, none of which are part of it - so the spec carries all four, letting a stored user key be reconstituted without access to the master private key.

This extends EncodedKeySpec rather than PKCS8EncodedKeySpec: the encoded bytes are a real PKCS#8 encoding (reflected in getFormat()), but the spec is not self-sufficient the way a plain PKCS8EncodedKeySpec is meant to be, and subclassing the concrete JDK type would let generic code treat it as one.

The matching spec is returned by the factory's getKeySpec method, so a user key round-trips: store getEncoded() (or ask for this spec), rebuild with generatePrivate. A key-exchange user key rebuilds the same way with exchangeKey set - the encoding does not record which usage the KGC derived the key for, so the flag is the importer's claim, and the consumers enforce whichever usage the rebuilt key carries (KeyAgreement.SM9 accepts only exchange keys; the KEM and cipher only non-exchange keys).

Constructor Summary

Constructors

Constructor	Description
SM9EncUserPrivateKeySpec(byte[] pkcs8Encoding, SM9EncMasterPublicKey masterPublicKey, byte[] identity, byte hid)	Base constructor, for a KEM / decryption user key.
SM9EncUserPrivateKeySpec(byte[] pkcs8Encoding, SM9EncMasterPublicKey masterPublicKey, byte[] identity, byte hid, boolean exchangeKey)

Method Summary

Modifier and Type	Method	Description
java.lang.String	getFormat()
byte	getHid()	The private-key generation function identifier hid the key was derived under - the KGC's published choice, not sensitive.
byte[]	getIdentity()
SM9EncMasterPublicKey	getMasterPublicKey()
boolean	isExchangeKey()	Whether the key rebuilds as a key-exchange user key rather than a KEM / decryption one.

Methods inherited from class java.security.spec.EncodedKeySpec

getAlgorithm, getEncoded

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

SM9EncUserPrivateKeySpec

public SM9EncUserPrivateKeySpec(byte[] pkcs8Encoding,
                                SM9EncMasterPublicKey masterPublicKey,
                                byte[] identity,
                                byte hid)

Base constructor, for a KEM / decryption user key.

Parameters:

pkcs8Encoding - the user private key's PKCS#8 encoding, as returned by the key's getEncoded().

masterPublicKey - the encryption master public key the user key was derived under.

identity - the user's identity.

hid - the private-key generation function identifier the KGC derived the key under.

SM9EncUserPrivateKeySpec

public SM9EncUserPrivateKeySpec(byte[] pkcs8Encoding,
                                SM9EncMasterPublicKey masterPublicKey,
                                byte[] identity,
                                byte hid,
                                boolean exchangeKey)

Parameters:

pkcs8Encoding - the user private key's PKCS#8 encoding, as returned by the key's getEncoded().

masterPublicKey - the encryption master public key the user key was derived under.

identity - the user's identity.

hid - the private-key generation function identifier the KGC derived the key under.

exchangeKey - whether the KGC derived the key for the key exchange (from generateExchangeKeyPair) rather than for KEM / decryption.

Method Detail

getMasterPublicKey

public SM9EncMasterPublicKey getMasterPublicKey()

getIdentity

public byte[] getIdentity()

getHid

public byte getHid()

The private-key generation function identifier hid the key was derived under - the KGC's published choice, not sensitive.

isExchangeKey

public boolean isExchangeKey()

Whether the key rebuilds as a key-exchange user key rather than a KEM / decryption one.

getFormat

public java.lang.String getFormat()

Specified by:

getFormat in class java.security.spec.EncodedKeySpec