Package co.ankatech.ankasecure.sdk.model

Class SignEncryptResult

java.lang.Object
co.ankatech.ankasecure.sdk.model.SignEncryptResult
public class SignEncryptResult extends Object
Result of a sign-then-encrypt combined operation.

Contains the nested JWE(JWS) token produced by first signing the plaintext (creating JWS) then encrypting the JWS (creating JWE). This provides both authenticity (signature) and confidentiality (encryption) in a single operation.

Security Model

  • Inner layer (JWS): Digital signature proves authenticity and integrity
  • Outer layer (JWE): Encryption provides confidentiality
  • Result: Confidential, authenticated, tamper-proof message

Token Structure


 JWE( JWS(plaintext) )

 Outer: BASE64URL(JWE Header).BASE64URL(Encrypted Key).BASE64URL(IV).BASE64URL(Ciphertext).BASE64URL(Tag)
 Inner: BASE64URL(JWS Header).BASE64URL(Payload).BASE64URL(Signature)

Metadata Separation

The result provides separate metadata for the signing layer and encryption layer, allowing inspection of which keys and algorithms were used at each step.

Thread Safety

Instances are mutable during construction but should be treated as effectively immutable after being returned by SDK methods. Avoid invoking setters after receiving the result.

Example


 SignEncryptResult result = sdk.signThenEncrypt(
     "company-signing-key",
     "partner-encryption-key",
     sensitiveData
 );

 System.out.println("Sign-then-encrypt complete");
 System.out.println("Signed with: " + result.getSignKeyRequested() +
                    " (" + result.getSignAlgorithmUsed() + ")"
                    + " material version " + result.getSignMaterialVersion());
 System.out.println("Encrypted with: " + result.getEncryptKeyRequested() +
                    " (" + result.getEncryptAlgorithmUsed() + ")"
                    + " material version " + result.getEncryptMaterialVersion());

 // Send to partner
 String protectedMessage = result.getJweToken();
Since:
3.0.0
See Also:

  • Constructor Details

    • SignEncryptResult

      public SignEncryptResult()
      Default constructor initializing empty warning lists.

  • Method Details

    • getJweToken

      public String getJweToken()
      Returns the nested JWE(JWS) token.

      The outer layer is a JWE (encrypted), and the inner layer is a JWS (signed). Only the holder of the decryption key can access the inner signed payload.

      Returns:
      compact JWE token containing encrypted JWS; never null

    • setJweToken

      public SignEncryptResult setJweToken(String jweToken)
      Sets the nested JWE(JWS) token.
      Parameters:
      jweToken - the token
      Returns:
      this instance for fluent API

    • getSignKeyRequested

      public String getSignKeyRequested()
      Gets the key identifier requested for signing.
      Returns:
      requested sign key ID

    • setSignKeyRequested

      public SignEncryptResult setSignKeyRequested(String signKeyRequested)
      Sets the key identifier requested for signing.
      Parameters:
      signKeyRequested - the key ID
      Returns:
      this instance for fluent API

    • getSignMaterialVersion

      public Integer getSignMaterialVersion()
      Gets the key-material version (ank_kv) that performed the signing operation under the requested Stable KID.
      Returns:
      sign material version; null when not resolvable — never 0

    • setSignMaterialVersion

      public SignEncryptResult setSignMaterialVersion(Integer signMaterialVersion)
      Sets the key-material version that performed the signing operation.
      Parameters:
      signMaterialVersion - the material version
      Returns:
      this instance for fluent API

    • getSignAlgorithmUsed

      public String getSignAlgorithmUsed()
      Gets the algorithm used for signing.

      Example: "ML-DSA-87", "ECDSA-P256-SHA256"

      Returns:
      signature algorithm

    • setSignAlgorithmUsed

      public SignEncryptResult setSignAlgorithmUsed(String signAlgorithmUsed)
      Sets the algorithm used for signing.
      Parameters:
      signAlgorithmUsed - the algorithm
      Returns:
      this instance for fluent API

    • getSignWarnings

      public List<CryptoWarning> getSignWarnings()
      Gets structured warnings related to the signing operation.

      Warnings are type-safe instances allowing pattern matching: 

      
 for (CryptoWarning warning : result.getSignWarnings()) {
     switch (warning) {
         case KeyExpirationWarning kew when kew.severity() == WarningSeverity.CRITICAL ->
             rotateSigningKey();
         case UsageLimitWarning ulw ->
             logger.warn("Signing key usage: {}", ulw.message());
         case GenericWarning gw ->
             logger.info("Sign warning: {}", gw.rawMessage());
     }
 }
      Returns:
      unmodifiable list of sign warnings (never null, may be empty)

    • setSignWarnings

      public SignEncryptResult setSignWarnings(List<CryptoWarning> signWarnings)
      Sets warnings related to the signing operation.
      Parameters:
      signWarnings - the warnings
      Returns:
      this instance for fluent API

    • getEncryptKeyRequested

      public String getEncryptKeyRequested()
      Gets the key identifier requested for encryption.
      Returns:
      requested encrypt key ID

    • setEncryptKeyRequested

      public SignEncryptResult setEncryptKeyRequested(String encryptKeyRequested)
      Sets the key identifier requested for encryption.
      Parameters:
      encryptKeyRequested - the key ID
      Returns:
      this instance for fluent API

    • getEncryptMaterialVersion

      public Integer getEncryptMaterialVersion()
      Gets the key-material version (ank_kv) that performed the encryption operation under the requested Stable KID.
      Returns:
      encrypt material version; null when not resolvable — never 0

    • setEncryptMaterialVersion

      public SignEncryptResult setEncryptMaterialVersion(Integer encryptMaterialVersion)
      Sets the key-material version that performed the encryption operation.
      Parameters:
      encryptMaterialVersion - the material version
      Returns:
      this instance for fluent API

    • getEncryptAlgorithmUsed

      public String getEncryptAlgorithmUsed()
      Gets the algorithm used for encryption.

      Example: "ML-KEM-1024+A256GCM", "RSA-OAEP-256+A256GCM"

      Returns:
      encryption algorithm

    • setEncryptAlgorithmUsed

      public SignEncryptResult setEncryptAlgorithmUsed(String encryptAlgorithmUsed)
      Sets the algorithm used for encryption.
      Parameters:
      encryptAlgorithmUsed - the algorithm
      Returns:
      this instance for fluent API

    • getEncryptWarnings

      public List<CryptoWarning> getEncryptWarnings()
      Gets structured warnings related to the encryption operation.

      Warnings are type-safe instances allowing pattern matching: 

      
 for (CryptoWarning warning : result.getEncryptWarnings()) {
     switch (warning) {
         case KeyExpirationWarning kew when kew.daysRemaining() <= 14 ->
             scheduleKeyRotation(kew.daysRemaining());
         case UsageLimitWarning ulw ->
             logger.warn("Encryption key usage: {}", ulw.message());
         case GenericWarning gw ->
             logger.info("Encrypt warning: {}", gw.rawMessage());
     }
 }
      Returns:
      unmodifiable list of encrypt warnings (never null, may be empty)

    • setEncryptWarnings

      public SignEncryptResult setEncryptWarnings(List<CryptoWarning> encryptWarnings)
      Sets warnings related to the encryption operation.
      Parameters:
      encryptWarnings - the warnings
      Returns:
      this instance for fluent API

    • hasAnyWarnings

      public boolean hasAnyWarnings()
      Checks if there are any warnings (sign or encrypt).
      Returns:
      true if either signing or encryption produced warnings

    • hasSignWarnings

      public boolean hasSignWarnings()
      Checks if signing operation produced warnings.
      Returns:
      true if sign warnings list is non-empty

    • hasEncryptWarnings

      public boolean hasEncryptWarnings()
      Checks if encryption operation produced warnings.
      Returns:
      true if encrypt warnings list is non-empty

    • toString

      public String toString()
      Returns string representation for debugging.
      Overrides:
      toString in class Object
      Returns:
      debug string