Package co.ankatech.ankasecure.sdk.model

Class ResignResult

java.lang.Object
co.ankatech.ankasecure.sdk.model.ResignResult
public final class ResignResult extends Object
Result of a re-signature operation.

Contains the new compact JWS token produced by server-side re-signature from one key to another, along with comprehensive metadata for both the old verification key and the new signing key. The signed payload is never exposed to the client during this operation.

Use Cases

  • Signing key rotation without re-generating documents
  • Migrating signed data to stronger signature algorithms
  • Compliance-driven periodic key rotation
  • Upgrading from classical to post-quantum signatures

JWS Token Structure

The getJwsToken() returns a compact JWS (RFC 7515) containing three Base64URL segments:


 BASE64URL(Header).BASE64URL(Payload).BASE64URL(Signature)

Thread Safety

Instances are effectively immutable after construction. All setters are for internal SDK use during deserialization. Once returned from SDK methods, instances are safe to share across threads.

Example


 // Re-sign from RSA to ML-DSA
 ResignResult result = sdk.resign("new-ml-dsa-key", oldJwsToken);

 System.out.println("Re-signature complete");
 System.out.println("Old signature: " + result.getOldKeyRequested() +
                    " (" + result.getOldKeyAlgorithmUsed() + ")");
 System.out.println("New signature: " + result.getNewKeyRequested() +
                    " (" + result.getNewKeyAlgorithmUsed() + ")");
 System.out.println("Material versions: " + result.getSourceMaterialVersion() +
                    " -> " + result.getTargetMaterialVersion());

 // New JWS token ready for distribution
 String newJws = result.getJwsToken();
Since:
3.0.0
See Also:

  • Constructor Details

    • ResignResult

      public ResignResult()

  • Method Details

    • getJwsToken

      public String getJwsToken()
      Returns the new compact JWS token after re-signing.
      Returns:
      the compact JWS string (three Base64URL segments); never null

    • getOldKeyRequested

      public String getOldKeyRequested()
      Returns the key identifier originally requested for verification.
      Returns:
      non-null old kid

    • getSourceMaterialVersion

      public Integer getSourceMaterialVersion()
      Returns the key-material version that verified the original signature under the source Stable KID.
      Returns:
      source material version; null when not resolvable — never 0

    • getOldKeyAlgorithmUsed

      public String getOldKeyAlgorithmUsed()
      Returns the algorithm used for verification.
      Returns:
      non-null algorithm identifier

    • getNewKeyRequested

      public String getNewKeyRequested()
      Returns the key identifier originally requested for signing.
      Returns:
      non-null new kid

    • getTargetMaterialVersion

      public Integer getTargetMaterialVersion()
      Returns the PRIMARY key-material version that signed the new payload under the target Stable KID.
      Returns:
      target material version; null when not resolvable — never 0

    • getNewKeyAlgorithmUsed

      public String getNewKeyAlgorithmUsed()
      Returns the algorithm used for signing.
      Returns:
      non-null algorithm identifier

    • getWarnings

      public List<CryptoWarning> getWarnings()
      Returns non-fatal warnings encountered during the re-signing operation.

      Warnings are type-safe instances that may relate to either the old verification key or the new signing key. Use pattern matching for programmatic handling: 

      
 ResignResult result = sdk.resign("new-signing-key", oldJwsToken);

 if (result.getWarnings() != null && !result.getWarnings().isEmpty()) {
     for (CryptoWarning warning : result.getWarnings()) {
         switch (warning) {
             case KeyExpirationWarning kew -> {
                 logger.warn("Key expiring in {} days - Old: {}, New: {}",
                     kew.daysRemaining(),
                     result.getOldKeyRequested(),
                     result.getNewKeyRequested());
                 if (kew.severity() == WarningSeverity.CRITICAL) {
                     rotateSigningKey(result.getNewKeyRequested());
                 }
             }
             case UsageLimitWarning ulw when ulw.invocationsRemaining() <= 100 ->
                 alertOps("Signing key usage critical: " + ulw.recommendedAction());
             case GenericWarning gw ->
                 logger.info("Re-signing warning: {}", gw.rawMessage());
         }
     }
 }

      Common warning types:

      Returns:
      unmodifiable list of warnings (null if no warnings, never empty if non-null)