Class PSSSigner

java.lang.Object
org.bouncycastle.crypto.signers.PSSSigner
All Implemented Interfaces:
Signer
public class PSSSigner extends Object implements Signer
RSA-PSS as described in PKCS# 1 v 2.1.

Note: the usual value for the salt length is the number of bytes in the hash function.

The createRawSigner(AsymmetricBlockCipher, Digest) family builds a signer that operates on a pre-computed message hash (mHash) rather than the message itself. RFC 8017 (PKCS#1 v2.2) sec. 9.1 EMSA-PSS first hashes the message M to mHash and then salts and re-hashes; these factories replace only that first hash with a Prehash pass-through, so the caller supplies mHash via update(...) and the signer still performs the salt / M' / second-hash / masking steps. The bytes supplied must be exactly the content digest's output length, otherwise signing or verification fails with "Incorrect prehash size". This is the lightweight-API equivalent of a "sign/verify pre-computed hash" entry point (github #1145). See org.bouncycastle.crypto.examples.RSAPSSPreComputedHashExample.

  • Field Details

  • Constructor Details

  • Method Details

    • createRawSigner

      public static PSSSigner createRawSigner(AsymmetricBlockCipher cipher, Digest digest)
      Create a PSS signer/verifier that consumes a pre-computed message hash. The caller feeds exactly digest.getDigestSize() bytes (the hash of the message under digest) through update(...) before generateSignature() / verifySignature(...); digest is also used for the EMSA-PSS second hash and the MGF1 mask, and the salt length defaults to the digest output length with the implicit (0xBC) trailer.
      Parameters:
      cipher - the asymmetric cipher to use (e.g. a configured RSAEngine).
      digest - the digest the supplied hash was produced with.

    • createRawSigner

      public static PSSSigner createRawSigner(AsymmetricBlockCipher cipher, Digest contentDigest, Digest mgfDigest, int sLen, byte trailer)
      Create a PSS signer/verifier that consumes a pre-computed message hash, with the MGF digest, salt length and trailer specified explicitly. The caller feeds exactly contentDigest.getDigestSize() bytes (the pre-computed hash) through update(...); contentDigest performs the EMSA-PSS second hash and mgfDigest drives the MGF1 mask.
      Parameters:
      cipher - the asymmetric cipher to use.
      contentDigest - the digest the supplied hash was produced with, also used for the second hash.
      mgfDigest - the digest to use for the MGF1 mask generation function.
      sLen - the length of the salt to use (in bytes).
      trailer - the trailer byte (usually TRAILER_IMPLICIT).

    • createRawSigner

      public static PSSSigner createRawSigner(AsymmetricBlockCipher cipher, Digest contentDigest, Digest mgfDigest, byte[] salt, byte trailer)
      Create a PSS signer/verifier that consumes a pre-computed message hash, using a fixed salt (chiefly for known-answer testing where the salt must be reproducible). The caller feeds exactly contentDigest.getDigestSize() bytes (the pre-computed hash) through update(...).
      Parameters:
      cipher - the asymmetric cipher to use.
      contentDigest - the digest the supplied hash was produced with, also used for the second hash.
      mgfDigest - the digest to use for the MGF1 mask generation function.
      salt - the fixed salt to use.
      trailer - the trailer byte (usually TRAILER_IMPLICIT).

    • init

      public void init(boolean forSigning, CipherParameters param)
      Description copied from interface: Signer
      Initialise the signer for signing or verification.
      Specified by:
      init in interface Signer
      Parameters:
      forSigning - true if for signing, false otherwise
      param - necessary parameters.

    • update

      public void update(byte b)
      update the internal digest with the byte b
      Specified by:
      update in interface Signer

    • update

      public void update(byte[] in, int off, int len)
      update the internal digest with the byte array in
      Specified by:
      update in interface Signer

    • reset

      public void reset()
      reset the internal state
      Specified by:
      reset in interface Signer

    • generateSignature

      public byte[] generateSignature() throws CryptoException, DataLengthException
      generate a signature for the message we've been loaded with using the key we were initialised with.
      Specified by:
      generateSignature in interface Signer
      Throws:
      CryptoException
      DataLengthException

    • verifySignature

      public boolean verifySignature(byte[] signature)
      return true if the internal state represents the signature described in the passed in array.
      Specified by:
      verifySignature in interface Signer