com.amazonaws.cloudhsm.jce.provider

Class MldsaKeyPairGenerator

java.lang.Object

java.security.KeyPairGeneratorSpi

com.amazonaws.cloudhsm.jce.provider.MldsaKeyPairGenerator

Direct Known Subclasses:

MldsaKeyPairGenerator.MlDsa44, MldsaKeyPairGenerator.MlDsa65, MldsaKeyPairGenerator.MlDsa87

public class MldsaKeyPairGenerator
extends java.security.KeyPairGeneratorSpi

MldsaKeyPairGenerator extends KeyPairGeneratorSpi for generating an ML-DSA key pair in CloudHSM.

See Also:

KeyPairGenerator, KeyPairGeneratorSpi

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	MldsaKeyPairGenerator.MlDsa44 Pre-bound to ML-DSA-44; registered under algorithm name "ML-DSA-44".
static class	MldsaKeyPairGenerator.MlDsa65 Pre-bound to ML-DSA-65; registered under algorithm name "ML-DSA-65".
static class	MldsaKeyPairGenerator.MlDsa87 Pre-bound to ML-DSA-87; registered under algorithm name "ML-DSA-87".

Constructor Summary

Constructors

Constructor and Description
MldsaKeyPairGenerator(CloudHsmProvider provider) Constructs ML-DSA key pair generator.
MldsaKeyPairGenerator(CloudHsmProvider provider, com.amazonaws.cloudhsm.jce.jni.MldsaAlgorithm mldsaAlgorithm) Constructs ML-DSA key pair generator pre-bound to a specific parameter set.

Method Summary

Modifier and Type	Method and Description
java.security.KeyPair	generateKeyPair()
void	initialize(java.security.spec.AlgorithmParameterSpec spec, java.security.SecureRandom random)
void	initialize(int keysize, java.security.SecureRandom random)

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

MldsaKeyPairGenerator

public MldsaKeyPairGenerator(CloudHsmProvider provider)

Constructs ML-DSA key pair generator.

Parameters:

provider - the CloudHSM provider instance

MldsaKeyPairGenerator

public MldsaKeyPairGenerator(CloudHsmProvider provider,
                             com.amazonaws.cloudhsm.jce.jni.MldsaAlgorithm mldsaAlgorithm)

Constructs ML-DSA key pair generator pre-bound to a specific parameter set.

Used when the provider is registered under a parameter-set-specific algorithm name (e.g. "ML-DSA-65"), so that keytool's -keyalg ML-DSA-65 works without requiring a separate initialize() call.

Parameters:

provider - the CloudHSM provider instance

mldsaAlgorithm - the ML-DSA algorithm variant for this generator (e.g. MldsaAlgorithm.MlDsa65)

Method Detail

initialize

public void initialize(java.security.spec.AlgorithmParameterSpec spec,
                       java.security.SecureRandom random)
                throws java.security.InvalidAlgorithmParameterException

Accepts KeyPairAttributesMap (CloudHSM attribute map). Sets ML-DSA defaults: ENCRYPT=false and WRAP=false on public keys, DECRYPT=false and UNWRAP=false on private keys, since ML-DSA is a signature-only algorithm. User-provided attributes are applied on top and can override these defaults.

Throws:

java.security.InvalidAlgorithmParameterException

generateKeyPair

public java.security.KeyPair generateKeyPair()

If initialize() was never called but this generator was obtained via a parameter-set-specific algorithm name (e.g. "ML-DSA-65"), the parameter set is inferred automatically so that keytool's -keyalg ML-DSA-65 works.

initialize

public void initialize(int keysize,
                       java.security.SecureRandom random)
                throws java.security.InvalidParameterException

When this generator is pre-bound to a parameter set via mldsaAlgorithm (e.g. obtained as "ML-DSA-65"), any integer key size passed by keytool on Java 8 is silently ignored. The parameter set from mldsaAlgorithm is used instead when generateKeyPair() is called.

Throws:

java.security.InvalidParameterException