Package co.ankatech.ankasecure.sdk.operations

Class CombinedOperations

java.lang.Object

co.ankatech.ankasecure.sdk.operations.CombinedOperations

public final class CombinedOperations
extends Object

Combined cryptographic operations facade.

Public facade for combined operations (re-encryption, re-signature, sign-then-encrypt, decrypt-then-verify, and utility operations with external keys). All methods are exposed via AuthenticatedSdk.

Stateful signing keys

The operations that produce a signature — resign* (with the new key) and signThenEncrypt* (with the signing key) — can be refused for a stateful hash-based key (XMSS, XMSS^MT, LMS/HSS) with SdkErrorCode.STATEFUL_KEY_EXHAUSTED (rotate the key; do not retry) or SdkErrorCode.STATEFUL_KEY_BUSY (retry after AnkaSecureSdkException.getRetryAfterSeconds()), decided before any output exists. A streaming re-sign reserves the one-time signature before it reads the request body, so a request then refused for its body still spends one.

Constructor Summary

Constructors

Constructor	Description
CombinedOperations(InternalServiceFactory svc, TokenSource tokenSource, BooleanSupplier timingMetricsEnabled, org.slf4j.Logger userLogger)

Method Summary

Modifier and Type	Method	Description
DecryptVerifyResult	decryptThenVerify(String recipientKid, String jweToken)
DecryptVerifyResult	decryptThenVerifyFileCompact(String recipientKid, Path input, Path output)
DecryptVerifyResult	decryptThenVerifyFileStream(String recipientKid, Path input, Path output)
EncryptResult	encryptFileUtilityStream(String kty, String alg, String publicKeyB64, Path input, Path output)
ReencryptResult	reencrypt(String newKid, String sourceKid, String jweToken)
ReencryptResult	reencryptFileCompact(String newKid, String sourceKid, Path input, Path output)
ReencryptResult	reencryptFileStream(String newKid, String sourceKid, Path input, Path output)
ResignResult	resign(String newKid, String sourceKid, String jws)
ResignResult	resign(String newKid, String sourceKid, String jws, JwsSerialization serialization)	Re-signs a JWS with an explicit JWS serialization selection.
ResignResult	resignFileCompact(String newKid, String sourceKid, Path input, Path output)
ResignResult	resignFileCompact(String newKid, String sourceKid, Path input, Path output, JwsSerialization serialization)	Re-signs a file with an explicit JWS serialization selection.
ResignResult	resignFileStream(Path oldJwsHeader, String newKid, String sourceKid, Path input, Path output, SignOptions options)
SignEncryptResult	signThenEncrypt(String signKid, String encryptKid, byte[] data)
SignEncryptResult	signThenEncrypt(String signKid, String encryptKid, byte[] data, JwsSerialization serialization, SignOptions options)	Signs then encrypts with an explicit inner-JWS serialization selection.
SignEncryptResult	signThenEncryptFileCompact(String signKid, String encryptKid, Path input, Path output)
SignEncryptResult	signThenEncryptFileCompact(String signKid, String encryptKid, Path input, Path output, JwsSerialization serialization, SignOptions options)	Signs a file then encrypts it with an explicit inner-JWS serialization selection.
SignEncryptResult	signThenEncryptFileStream(String signKid, String encryptKid, Path input, Path output, SignEncryptStreamOptions options)
VerifySignatureResult	verifySignatureUtilityStream(String kty, String alg, String publicKeyB64, String signatureB64, Path dataFile)

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

CombinedOperations

public CombinedOperations(InternalServiceFactory svc,
 TokenSource tokenSource,
 BooleanSupplier timingMetricsEnabled,
 org.slf4j.Logger userLogger)

Method Details

reencrypt

public ReencryptResult reencrypt(String newKid,
 String sourceKid,
 String jweToken)
                          throws AnkaSecureSdkException

Throws:

AnkaSecureSdkException

reencryptFileCompact

public ReencryptResult reencryptFileCompact(String newKid,
 String sourceKid,
 Path input,
 Path output)
                                     throws AnkaSecureSdkException

Throws:

AnkaSecureSdkException

reencryptFileStream

public ReencryptResult reencryptFileStream(String newKid,
 String sourceKid,
 Path input,
 Path output)
                                    throws AnkaSecureSdkException

Throws:

AnkaSecureSdkException

encryptFileUtilityStream

public EncryptResult encryptFileUtilityStream(String kty,
 String alg,
 String publicKeyB64,
 Path input,
 Path output)
                                       throws AnkaSecureSdkException

Throws:

AnkaSecureSdkException

verifySignatureUtilityStream

public VerifySignatureResult verifySignatureUtilityStream(String kty,
 String alg,
 String publicKeyB64,
 String signatureB64,
 Path dataFile)
                                                   throws AnkaSecureSdkException

Throws:

AnkaSecureSdkException

resign

public ResignResult resign(String newKid,
 String sourceKid,
 String jws)
                    throws AnkaSecureSdkException

Throws:

AnkaSecureSdkException

resign

public ResignResult resign(String newKid,
 String sourceKid,
 String jws,
 JwsSerialization serialization)
                    throws AnkaSecureSdkException

Re-signs a JWS with an explicit JWS serialization selection. Ergonomic overload of resign(String, String, String); a null serialization defers to the server.

Parameters:

newKid - destination key identifier; must not be null

sourceKid - the signer whose signature is replaced, or null when the protected header names one key

jws - the JWS to re-sign (compact or JWS-JSON); must not be null

serialization - requested serialization, or null to let the server choose

Returns:

re-signature result; never null

Throws:

AnkaSecureSdkException - on error, including HTTP 400 when COMPACT is requested but the deployment mandates a qualified timestamp

NullPointerException - if newKid or jws is null

resignFileCompact

public ResignResult resignFileCompact(String newKid,
 String sourceKid,
 Path input,
 Path output)
                               throws AnkaSecureSdkException

Throws:

AnkaSecureSdkException

resignFileCompact

public ResignResult resignFileCompact(String newKid,
 String sourceKid,
 Path input,
 Path output,
 JwsSerialization serialization)
                               throws AnkaSecureSdkException

Re-signs a file with an explicit JWS serialization selection. Ergonomic overload of resignFileCompact(String, String, Path, Path); a null serialization defers to the server. When the server mandates a qualified timestamp, the written output is a JWS-JSON artifact carrying the JAdES sigTst.

Parameters:

newKid - destination key identifier; must not be null

sourceKid - the signer whose signature is replaced, or null when the protected header names one key

input - input JWS file (compact or JWS-JSON); must not be null

output - output file; must not be null

serialization - requested serialization, or null to let the server choose

Returns:

re-signature result; never null

Throws:

AnkaSecureSdkException - on error, including HTTP 400 when COMPACT is requested but the deployment mandates a qualified timestamp

NullPointerException - if newKid, input, or output is null

resignFileStream

public ResignResult resignFileStream(Path oldJwsHeader,
 String newKid,
 String sourceKid,
 Path input,
 Path output,
 SignOptions options)
                              throws AnkaSecureSdkException

Throws:

AnkaSecureSdkException

signThenEncrypt

public SignEncryptResult signThenEncrypt(String signKid,
 String encryptKid,
 byte[] data)
                                  throws AnkaSecureSdkException

Throws:

AnkaSecureSdkException

signThenEncrypt

public SignEncryptResult signThenEncrypt(String signKid,
 String encryptKid,
 byte[] data,
 JwsSerialization serialization,
 SignOptions options)
                                  throws AnkaSecureSdkException

Signs then encrypts with an explicit inner-JWS serialization selection. Ergonomic overload of signThenEncrypt(String, String, byte[]); a null serialization defers to the server. Governs only the inner JWS representation and never changes the outer JWE.

Parameters:

signKid - private key identifier for signing; must not be null

encryptKid - public key identifier for encryption; must not be null

data - plaintext bytes to sign and encrypt; must not be null

serialization - requested inner-JWS serialization, or null to defer

Returns:

combined sign-encrypt result; never null

Throws:

AnkaSecureSdkException - on error, including HTTP 400 (before any signing or encryption) when COMPACT is requested but the deployment mandates a qualified timestamp

NullPointerException - if any of signKid, encryptKid, or data is null

decryptThenVerify

public DecryptVerifyResult decryptThenVerify(String recipientKid,
 String jweToken)
                                      throws AnkaSecureSdkException

Throws:

AnkaSecureSdkException

signThenEncryptFileCompact

public SignEncryptResult signThenEncryptFileCompact(String signKid,
 String encryptKid,
 Path input,
 Path output)
                                             throws AnkaSecureSdkException

Throws:

AnkaSecureSdkException

signThenEncryptFileCompact

public SignEncryptResult signThenEncryptFileCompact(String signKid,
 String encryptKid,
 Path input,
 Path output,
 JwsSerialization serialization,
 SignOptions options)
                                             throws AnkaSecureSdkException

Signs a file then encrypts it with an explicit inner-JWS serialization selection. Ergonomic overload of signThenEncryptFileCompact(String, String, Path, Path); a null serialization defers to the server.

Parameters:

signKid - private key identifier for signing; must not be null

encryptKid - public key identifier for encryption; must not be null

input - input file; must not be null

output - output file; must not be null

serialization - requested inner-JWS serialization, or null to defer

options - the inner signature's options; must not be null (SignOptions.none() sets nothing)

Returns:

combined sign-encrypt result; never null

Throws:

AnkaSecureSdkException - on error, including HTTP 400 (before any signing or encryption) when COMPACT is requested but the deployment mandates a qualified timestamp

NullPointerException - if any argument other than serialization is null

decryptThenVerifyFileCompact

public DecryptVerifyResult decryptThenVerifyFileCompact(String recipientKid,
 Path input,
 Path output)
                                                 throws AnkaSecureSdkException

Throws:

AnkaSecureSdkException

signThenEncryptFileStream

public SignEncryptResult signThenEncryptFileStream(String signKid,
 String encryptKid,
 Path input,
 Path output,
 SignEncryptStreamOptions options)
                                            throws AnkaSecureSdkException

Throws:

AnkaSecureSdkException

decryptThenVerifyFileStream

public DecryptVerifyResult decryptThenVerifyFileStream(String recipientKid,
 Path input,
 Path output)
                                                throws AnkaSecureSdkException

Throws:

AnkaSecureSdkException