Package co.ankatech.ankasecure.sdk.transport

Class PqcSessionManager

java.lang.Object
co.ankatech.ankasecure.sdk.transport.PqcSessionManager
public final class PqcSessionManager extends Object
Manages PQC transport sessions: generates a key pair for the configured KEM (PqcTransportConfig.getKemAlgorithm()), performs the handshake, unwraps the AES session key, and caches the session until its TTL expires.

One session is cached at a time, guarded by one lock. Every replacement of the cached session (TTL expiry, replaceIfCurrent(PqcTransportSession), invalidateSession()) closes the evicted session, which destroys its AES key. A request therefore never reads the key from a session another thread may close: it takes a PqcSessionManager.Lease, a private copy of the key taken under the same lock, and zeroes that copy when the request ends.

  • Constructor Details

    • PqcSessionManager

      public PqcSessionManager(co.ankatech.ankasecure.openapi.client.AnkaSecureOpenApiClient client, PqcTransportConfig config)
      Constructs manager with the given client and config.
      Parameters:
      client - ANKASecure client to perform handshake
      config - PQC transport config; its KEM is the one every handshake uses

  • Method Details

    • getSession

      public PqcTransportSession getSession() throws co.ankatech.secure.client.invoker.ApiException
      Returns an active session, or performs a new handshake if none exists or TTL expired.
      Returns:
      active transport session containing sessionId and AES key
      Throws:
      co.ankatech.secure.client.invoker.ApiException - on handshake or unwrap errors

    • invalidateSession

      public void invalidateSession()
      Invalidates the current session, forcing handshake on next request.