Package co.ankatech.ankasecure.sdk.model

Class ResignResult

java.lang.Object
co.ankatech.ankasecure.sdk.model.ResignResult
public final class ResignResult extends Object
Result of a re-signature operation.

Contains the new compact JWS token produced by server-side re-signature from one key to another, along with comprehensive metadata for both the old verification key and the new signing key. The signed payload is never exposed to the client during this operation.

Use Cases

  • Signing key rotation without re-generating documents
  • Migrating signed data to stronger signature algorithms
  • Compliance-driven periodic key rotation
  • Upgrading from classical to post-quantum signatures

JWS Token Structure

The getJwsToken() returns a compact JWS (RFC 7515 §7.1) containing three base64url segments, or the §7.2 JWS JSON Serialization when the result carries more than Compact can (a JAdES qualified timestamp):


 BASE64URL(Header).BASE64URL(Payload).BASE64URL(Signature)

Every signature of the input JWS

getSignatureResults() lists every signature of the input JWS, in token order, each verified under its own key before the new signature was computed. For a JWS signed by several keys, the one named by sourceKid is the signature that is replaced.

Thread Safety

Instances are effectively immutable after construction. All setters are for internal SDK use during deserialization. Once returned from SDK methods, instances are safe to share across threads.

Example


 // Re-sign from RSA to ML-DSA
 ResignResult result = sdk.resign("new-ml-dsa-key", oldJwsToken);

 System.out.println("Re-signature complete");
 System.out.println("Old signature: " + result.getOldKeyRequested() +
                    " (" + result.getOldKeyAlgorithmUsed() + ")");
 System.out.println("New signature: " + result.getNewKeyRequested() +
                    " (" + result.getNewKeyAlgorithmUsed() + ")");
 System.out.println("Material versions: " + result.getSourceMaterialVersion() +
                    " -> " + result.getTargetMaterialVersion());

 // New JWS token ready for distribution
 String newJws = result.getJwsToken();
See Also:

  • Constructor Details

    • ResignResult

      public ResignResult()

  • Method Details

    • getJwsToken

      public String getJwsToken()
      Returns the new JWS after re-signing.

      Server-supplied and unrendered: display it through InertText.text(String).

      Returns:
      the Compact JWS, or the JWS JSON Serialization when it carries a JAdES qualified timestamp; never null

    • getOldKeyRequested

      public String getOldKeyRequested()
      Returns the key identifier originally requested for verification.

      Server-supplied and unrendered: display it through InertText.text(String).

      Returns:
      non-null old kid

    • getSourceMaterialVersion

      public Integer getSourceMaterialVersion()
      Returns the key-material version that verified the original signature under the source Stable KID.
      Returns:
      source material version; null when not resolvable — never 0

    • getOldKeyAlgorithmUsed

      public String getOldKeyAlgorithmUsed()
      Returns the algorithm used for verification.

      Server-supplied and unrendered: display it through InertText.text(String).

      Returns:
      non-null algorithm identifier

    • getNewKeyRequested

      public String getNewKeyRequested()
      Returns the key identifier originally requested for signing.

      Server-supplied and unrendered: display it through InertText.text(String).

      Returns:
      non-null new kid

    • getTargetMaterialVersion

      public Integer getTargetMaterialVersion()
      Returns the PRIMARY key-material version that signed the new payload under the target Stable KID.
      Returns:
      target material version; null when not resolvable — never 0

    • getNewKeyAlgorithmUsed

      public String getNewKeyAlgorithmUsed()
      Returns the algorithm used for signing.

      Server-supplied and unrendered: display it through InertText.text(String).

      Returns:
      non-null algorithm identifier

    • getSignatureResults

      public List<co.ankatech.secure.client.model.SignatureResult> getSignatureResults()
      Returns every signature of the input JWS, in token order (RFC 7515 §7.2.1): the key it names, that key's catalogue algorithm, the key-material version it resolved to, and whether it verified.

      One entry for a JWS signed by one key; one per signature for a JWS signed by several, including the one replaced. Every entry reports verified = true: an input with any signature that does not verify is refused with HTTP 400 and nothing is signed.

      Example:

      
 ResignResult result = sdk.resign("ml-dsa-2026", "legal-rsa-2019", countersignedJws);
 result.getSignatureResults().forEach(s ->
     log.info("input signer {} ({} v{})", s.getKid(), s.getAlgorithm(), s.getMaterialVersion()));
      Returns:
      the signatures of the input JWS, unmodifiable, and each call returns fresh copies of the entries, so changing one changes nothing in this result; null on the streaming path, whose response carries no signature list

    • getWarnings

      public List<CryptoWarning> getWarnings()
      Returns non-fatal warnings encountered during the re-signing operation.

      Warnings are type-safe instances that may relate to either the old verification key or the new signing key. Use pattern matching for programmatic handling: 

      
 ResignResult result = sdk.resign("new-signing-key", oldJwsToken);

 if (result.getWarnings() != null && !result.getWarnings().isEmpty()) {
     for (CryptoWarning warning : result.getWarnings()) {
         switch (warning) {
             case KeyExpirationWarning kew -> {
                 logger.warn("Key expiring in {} days - Old: {}, New: {}",
                     kew.daysRemaining(),
                     result.getOldKeyRequested(),
                     result.getNewKeyRequested());
                 if (kew.severity() == WarningSeverity.CRITICAL) {
                     rotateSigningKey(result.getNewKeyRequested());
                 }
             }
             case UsageLimitWarning ulw when ulw.invocationsRemaining() <= 100 ->
                 alertOps("Signing key usage critical: " + ulw.recommendedAction());
             case GenericWarning gw ->
                 logger.info("Re-signing warning: {}", gw.rawMessage());
         }
     }
 }

      Common warning types:

      Returns:
      unmodifiable list of warnings (null if no warnings, never empty if non-null)