Package com.privatechain.crypto

Class ECDSASignatureUtil

java.lang.Object
com.privatechain.crypto.ECDSASignatureUtil
public final class ECDSASignatureUtil extends Object
Utility class for ECDSA signing and signature verification using the secp256k1 elliptic curve and the SHA-256withECDSA algorithm.

All operations use BouncyCastle as the JCA provider because secp256k1 is not available in the standard JDK provider on all JVM versions (FR-CRYPTO-04, FR-CRYPTO-05).

Usage


 ECKeyPair keyPair = KeyPairGenerator.generateECKeyPair();

 // Signing
 byte[] data      = tx.toSignableBytes();
 byte[] signature = ECDSASignatureUtil.sign(data, keyPair.getPrivateKey());

 // Verification
 boolean valid = ECDSASignatureUtil.verify(data, signature, keyPair.getPublicKey());

Thread safety

All methods create fresh Signature instances per call, so they are safe to call concurrently from multiple threads.
Since:
1.0.0
See Also:

  • Method Summary

    Modifier and Type
    Method
    Description
    static byte[]
    sign(byte[] data, ECKeyPair keyPair)
    Convenience overload that accepts an ECKeyPair directly.
    static byte[]
    sign(byte[] data, PrivateKey privateKey)
    Signs a byte array with the given ECDSA private key using SHA-256withECDSA.
    static boolean
    verify(byte[] data, byte[] signature, ECKeyPair keyPair)
    Convenience overload that accepts an ECKeyPair for verification.
    static boolean
    verify(byte[] data, byte[] signature, PublicKey publicKey)
    Verifies a DER-encoded ECDSA signature against raw data and a public key.

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Method Details

    • sign

      public static byte[] sign(byte[] data, PrivateKey privateKey)
      Signs a byte array with the given ECDSA private key using SHA-256withECDSA.

      The returned DER-encoded signature may be passed to verify(byte[], byte[], PublicKey) to confirm the signer's identity.

      Parameters:
      data - the raw bytes to sign (non-null; may be empty but typically non-empty)
      privateKey - the signer's secp256k1 private key (non-null)
      Returns:
      DER-encoded ECDSA signature bytes (typically 70–72 bytes)
      Throws:
      NullPointerException - if data or privateKey is null
      IllegalStateException - if the BouncyCastle provider is unavailable or the key is rejected by the JCA engine

    • sign

      public static byte[] sign(byte[] data, ECKeyPair keyPair)
      Convenience overload that accepts an ECKeyPair directly.
      Parameters:
      data - the raw bytes to sign (non-null)
      keyPair - the key pair whose private key will be used (non-null)
      Returns:
      DER-encoded ECDSA signature bytes
      Throws:
      NullPointerException - if data or keyPair is null
      IllegalStateException - if signing fails

    • verify

      public static boolean verify(byte[] data, byte[] signature, PublicKey publicKey)
      Verifies a DER-encoded ECDSA signature against raw data and a public key.

      This method must be called before any transaction enters the mempool (NFR-SEC-02). It returns false — rather than throwing — on any verification failure so that callers can treat invalid signatures as normal validation failures rather than exceptional errors.

      Parameters:
      data - the original data that was signed (non-null)
      signature - the DER-encoded ECDSA signature to verify (non-null)
      publicKey - the signer's secp256k1 public key (non-null)
      Returns:
      true if the signature is valid; false otherwise
      Throws:
      NullPointerException - if any argument is null
      IllegalStateException - if the BouncyCastle provider is unavailable

    • verify

      public static boolean verify(byte[] data, byte[] signature, ECKeyPair keyPair)
      Convenience overload that accepts an ECKeyPair for verification.
      Parameters:
      data - the original data that was signed (non-null)
      signature - the DER-encoded ECDSA signature to verify (non-null)
      keyPair - the key pair whose public key will be used (non-null)
      Returns:
      true if the signature is valid
      Throws:
      NullPointerException - if any argument is null