Docs

Java (JCA provider)

An IRON3 receipt records which enrolled voters sealed a message under an application identifier. Keep the original bytes, the exact identifier (including case) and the returned receipt together.

Install

Java 17 or later. Add com.axowl.roost:roost-jca as a Maven dependency; the provider and its JSON dependency must be on the classpath.

Sign and verify

import com.axowl.roost.RoostProvider;
import java.net.URI;
import java.nio.charset.StandardCharsets;
import java.security.Signature;

var provider = new RoostProvider(URI.create("https://roost-gateway.example"));
byte[] message = "release 104 approved".getBytes(StandardCharsets.UTF_8);
String keyId = "release-ledger";
var signature = Signature.getInstance(RoostProvider.ALGORITHM, provider);
signature.initSign(provider.signingKey(keyId));
signature.update(message);
byte[] receipt = signature.sign();

signature.initVerify(provider.verificationKey(keyId));
signature.update(message);
boolean confirmed = signature.verify(receipt);

The algorithm name is AXOWL-IRON3. The two handles select an application identifier; they contain no private signing material. A negative verification returns false. An unavailable quorum, a connection failure or a refused request raises SignatureException. Only a positive result establishes that the quorum verified the receipt.

Mutual TLS

Pass an application-managed SSLContext to the provider. Plain HTTP is allowed only on a literal loopback address.