AES, RSA, DES Encryption Explained: What Actually Matters in Production

package io.thecodeforge.dsa;

import javax.crypto.Cipher;
import javax.crypto.SecretKey;
import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.DESedeKeySpec;
import java.nio.charset.StandardCharsets;
import java.util.Base64;

/**
 * DO NOT USE THIS IN NEW CODE.
 * This class exists solely to MIGRATE data encrypted with legacy 3DES.
 * After migration, delete this class and rotate all keys.
 * Reference: SWEET32 attack (CVE-2016-2183) — 64-bit block cipher birthday bound.
 */
public class LegacyDesDecryptor {

    // 3DES requires exactly 24 bytes (192-bit key, 112 bits effective security)
    // The first and third 8-byte segments are typically identical in 2-key 3DES,
    // which is why 112 bits is the effective strength, not 168.
    private static final String ALGORITHM = "DESede"; // Triple DES
    private static final String TRANSFORMATION = "DESede/CBC/PKCS5Padding"; // At least use CBC, never ECB

    /**
     * Decrypts a 3DES-encrypted Base64 string for migration purposes only.
     * You'd call this in a one-time migration job that re-encrypts output with AES-GCM.
     *
     * @param encryptedBase64 the legacy ciphertext stored in your database
     * @param rawKey          the 24-byte key — retrieve from your secrets manager, NOT from code
     * @param iv              the 8-byte initialisation vector stored alongside the ciphertext
     * @return the plaintext so you can immediately re-encrypt it with AES-GCM
     */
    public static String decryptForMigration(String encryptedBase64, byte[] rawKey, byte[] iv) throws Exception {
        // Validate key length before touching the cipher — avoids misleading crypto errors downstream
        if (rawKey.length != 24) {
            throw new IllegalArgumentException(
                "3DES key must be 24 bytes. Got: " + rawKey.length +
                ". If your legacy system used a 16-byte key, pad the last 8 bytes as a copy of the first 8."
            );
        }

        DESedeKeySpec keySpec = new DESedeKeySpec(rawKey);
        SecretKeyFactory keyFactory = SecretKeyFactory.getInstance(ALGORITHM);
        SecretKey secretKey = keyFactory.generateSecret(keySpec);

        Cipher cipher = Cipher.getInstance(TRANSFORMATION);

        // IV for 3DES/CBC must be exactly 8 bytes (64-bit block size — the SWEET32 problem)
        javax.crypto.spec.IvParameterSpec ivSpec = new javax.crypto.spec.IvParameterSpec(iv);
        cipher.init(Cipher.DECRYPT_MODE, secretKey, ivSpec);

        byte[] cipherBytes = Base64.getDecoder().decode(encryptedBase64);
        byte[] plainBytes = cipher.doFinal(cipherBytes);

        return new String(plainBytes, StandardCharsets.UTF_8);
    }

    public static void main(String[] args) throws Exception {
        // Simulate what a migration job would look like — decrypt 3DES, immediately re-encrypt with AES
        // In production this key comes from Vault/AWS Secrets Manager, NEVER hardcoded
        byte[] legacyKey = "ThisIsA24ByteLegacyKey!!".getBytes(StandardCharsets.UTF_8); // exactly 24 bytes
        byte[] legacyIv  = "8ByteIV!".getBytes(StandardCharsets.UTF_8); // exactly 8 bytes

        // Simulate legacy encrypted data (normally read from DB)
        // We'll encrypt first so the decrypt demo is self-contained
        DESedeKeySpec keySpec = new DESedeKeySpec(legacyKey);
        SecretKey secretKey = SecretKeyFactory.getInstance("DESede").generateSecret(keySpec);
        Cipher encCipher = Cipher.getInstance("DESede/CBC/PKCS5Padding");
        encCipher.init(Cipher.ENCRYPT_MODE, secretKey, new javax.crypto.spec.IvParameterSpec(legacyIv));
        byte[] encrypted = encCipher.doFinal("4111111111111111".getBytes(StandardCharsets.UTF_8)); // fake PAN
        String encryptedBase64 = Base64.getEncoder().encodeToString(encrypted);

        System.out.println("Legacy 3DES ciphertext (Base64): " + encryptedBase64);

        // Now decrypt it — this is the migration step
        String recovered = decryptForMigration(encryptedBase64, legacyKey, legacyIv);
        System.out.println("Recovered plaintext for re-encryption: " + recovered);
        System.out.println("NEXT STEP: Pass recovered plaintext to AesGcmEncryptor.encrypt() immediately.");
    }
}

package io.thecodeforge.dsa;

import javax.crypto.Cipher;
import javax.crypto.KeyGenerator;
import javax.crypto.SecretKey;
import javax.crypto.spec.GCMParameterSpec;
import javax.crypto.spec.SecretKeySpec;
import java.nio.ByteBuffer;
import java.nio.charset.StandardCharsets;
import java.security.SecureRandom;
import java.util.Base64;

/**
 * Production-grade AES-256-GCM encryption for a user PII service.
 * This pattern is used when you need to store sensitive fields (SSN, card number, health data)
 * in a database and need both confidentiality AND tamper detection.
 *
 * Key lifecycle: the secretKey here would come from AWS KMS, HashiCorp Vault,
 * or Google Cloud KMS in real production — never generated and stored in the same service.
 */
public class AesGcmEncryptor {

    // GCM authentication tag length in bits — 128 is the maximum and what you should use.
    // Shorter tags (96, 64) exist but reduce forgery resistance. Don't compromise here.
    private static final int GCM_TAG_LENGTH_BITS = 128;

    // 12 bytes (96 bits) is the recommended nonce size for GCM.
    // With a random nonce, you get a collision probability of ~2^-32 after 2^32 encryptions.
    // If you need more than 2^32 encryptions under one key, rotate the key.
    private static final int GCM_NONCE_LENGTH_BYTES = 12;

    private final SecretKey encryptionKey;
    private final SecureRandom secureRandom;

    public AesGcmEncryptor(SecretKey encryptionKey) {
        this.encryptionKey = encryptionKey;
        // SecureRandom is thread-safe but can be a bottleneck under extreme load.
        // On Linux, it defaults to /dev/urandom (non-blocking). On some JVMs/OS configs
        // it may block on /dev/random — verify with -Djava.security.egd=file:/dev/urandom
        this.secureRandom = new SecureRandom();
    }

    /**
     * Encrypts a plaintext string and returns a Base64-encoded payload that includes
     * the nonce prepended to the ciphertext. This self-contained format means you
     * don't need a separate column for the nonce — just store one Base64 blob.
     *
     * Format: [12-byte nonce][ciphertext + 16-byte GCM auth tag]
     *
     * @param plaintext the sensitive value to encrypt (e.g., "123-45-6789" for SSN)
     * @return Base64-encoded nonce+ciphertext+tag
     */
    public String encrypt(String plaintext) throws Exception {
        byte[] nonce = new byte[GCM_NONCE_LENGTH_BYTES];
        secureRandom.nextBytes(nonce); // Cryptographically random — never use Math.random() or UUID bytes here

        Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
        // GCMParameterSpec: first arg is auth tag length in bits, second is the nonce
        GCMParameterSpec parameterSpec = new GCMParameterSpec(GCM_TAG_LENGTH_BITS, nonce);
        cipher.init(Cipher.ENCRYPT_MODE, encryptionKey, parameterSpec);

        byte[] plaintextBytes = plaintext.getBytes(StandardCharsets.UTF_8);
        byte[] ciphertextWithTag = cipher.doFinal(plaintextBytes);
        // doFinal() appends the 16-byte auth tag to the ciphertext automatically in Java's GCM impl

        // Pack nonce + ciphertext+tag into a single byte array for clean storage
        ByteBuffer byteBuffer = ByteBuffer.allocate(GCM_NONCE_LENGTH_BYTES + ciphertextWithTag.length);
        byteBuffer.put(nonce);
        byteBuffer.put(ciphertextWithTag);

        return Base64.getEncoder().encodeToString(byteBuffer.array());
    }

    /**
     * Decrypts an AES-GCM payload produced by encrypt().
     * If the ciphertext or auth tag has been tampered with, this throws
     * javax.crypto.AEADBadTagException — treat this as a security event, log and alert.
     *
     * @param encryptedBase64 the Base64 blob from your database column
     * @return the original plaintext
     */
    public String decrypt(String encryptedBase64) throws Exception {
        byte[] encryptedPayload = Base64.getDecoder().decode(encryptedBase64);

        // Extract nonce from the first 12 bytes — this is why we prepended it during encrypt
        ByteBuffer byteBuffer = ByteBuffer.wrap(encryptedPayload);
        byte[] nonce = new byte[GCM_NONCE_LENGTH_BYTES];
        byteBuffer.get(nonce);

        // Remaining bytes are ciphertext + auth tag
        byte[] ciphertextWithTag = new byte[byteBuffer.remaining()];
        byteBuffer.get(ciphertextWithTag);

        Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
        GCMParameterSpec parameterSpec = new GCMParameterSpec(GCM_TAG_LENGTH_BITS, nonce);
        cipher.init(Cipher.DECRYPT_MODE, encryptionKey, parameterSpec);

        // If the auth tag doesn't match, this throws AEADBadTagException.
        // Do NOT catch and ignore this exception — it means someone tampered with your data.
        byte[] plaintextBytes = cipher.doFinal(ciphertextWithTag);
        return new String(plaintextBytes, StandardCharsets.UTF_8);
    }

    /**
     * Generates a new AES-256 key. In production, you'd get this from your KMS,
     * not generate it locally. This is here to make the demo self-contained.
     */
    public static SecretKey generateKey() throws Exception {
        KeyGenerator keyGen = KeyGenerator.getInstance("AES");
        keyGen.init(256, new SecureRandom()); // 256-bit key — use this, not 128
        return keyGen.generateKey();
    }

    public static void main(String[] args) throws Exception {
        // Simulating a PII service encrypting a Social Security Number before DB write
        SecretKey key = generateKey();
        AesGcmEncryptor encryptor = new AesGcmEncryptor(key);

        String ssn = "123-45-6789";
        System.out.println("Original SSN:       " + ssn);

        String encryptedSsn = encryptor.encrypt(ssn);
        System.out.println("Encrypted (Base64): " + encryptedSsn);

        String decryptedSsn = encryptor.decrypt(encryptedSsn);
        System.out.println("Decrypted SSN:      " + decryptedSsn);

        // Demonstrate tamper detection — the key GCM feature that CBC doesn't give you
        System.out.println("\n--- Tamper Detection Demo ---");
        byte[] tamperedBytes = Base64.getDecoder().decode(encryptedSsn);
        tamperedBytes[15] ^= 0xFF; // flip bits in the ciphertext
        String tamperedBase64 = Base64.getEncoder().encodeToString(tamperedBytes);
        try {
            encryptor.decrypt(tamperedBase64);
        } catch (javax.crypto.AEADBadTagException e) {
            System.out.println("Tamper detected — AEADBadTagException thrown. Alert your security team.");
        }
    }
}

package io.thecodeforge.dsa;

import javax.crypto.Cipher;
import javax.crypto.KeyGenerator;
import javax.crypto.SecretKey;
import javax.crypto.spec.GCMParameterSpec;
import javax.crypto.spec.OAEPParameterSpec;
import javax.crypto.spec.SecretKeySpec;
import java.nio.ByteBuffer;
import java.nio.charset.StandardCharsets;
import java.security.*;
import java.security.spec.MGF1ParameterSpec;
import java.security.spec.PSource;
import java.util.Base64;

/**
 * Hybrid encryption — the pattern used by every serious secure messaging system,
 * TLS, PGP, and S/MIME. RSA wraps an ephemeral AES-GCM key; AES-GCM encrypts the payload.
 *
 * Real-world use case: a document storage service where the server never needs to
 * decrypt user files (end-to-end encryption). The user's public RSA key is stored;
 * their private RSA key never leaves their device.
 */
public class HybridEncryptionService {

    private static final int AES_KEY_SIZE_BITS = 256;
    private static final int GCM_TAG_LENGTH_BITS = 128;
    private static final int GCM_NONCE_LENGTH_BYTES = 12;

    /**
     * Encrypts a large payload (document, medical record, etc.) using hybrid encryption.
     * Generates a fresh AES-256 key for each call — this is the ephemeral session key.
     * That AES key is RSA-OAEP encrypted with the recipient's public key.
     *
     * Wire format: [4-byte encryptedKeyLength][RSA-wrapped AES key][12-byte nonce][AES-GCM ciphertext+tag]
     *
     * @param payload          the large plaintext to encrypt
     * @param recipientPublicKey the recipient's RSA public key (2048 or 4096-bit)
     * @return Base64-encoded hybrid ciphertext
     */
    public static String encrypt(String payload, PublicKey recipientPublicKey) throws Exception {
        // Step 1: Generate a fresh ephemeral AES-256 key for this message only.
        // Never reuse this key — its entire job is to encrypt exactly one payload.
        KeyGenerator aesKeyGen = KeyGenerator.getInstance("AES");
        aesKeyGen.init(AES_KEY_SIZE_BITS, new SecureRandom());
        SecretKey ephemeralAesKey = aesKeyGen.generateKey();

        // Step 2: Wrap (encrypt) the AES key with RSA-OAEP.
        // OAEP with SHA-256 is what you want. PKCS1v15 is broken — do not use it.
        // SHA-256 for the hash and MGF1 mask generation function is current best practice.
        Cipher rsaCipher = Cipher.getInstance("RSA/ECB/OAEPWithSHA-256AndMGF1Padding");
        OAEPParameterSpec oaepParams = new OAEPParameterSpec(
            "SHA-256",        // hash algorithm for OAEP
            "MGF1",           // mask generation function
            MGF1ParameterSpec.SHA256,  // hash for MGF1 — must match OAEP hash
            PSource.PSpecified.DEFAULT // optional label — empty is correct for most use cases
        );
        rsaCipher.init(Cipher.ENCRYPT_MODE, recipientPublicKey, oaepParams);
        byte[] encryptedAesKey = rsaCipher.doFinal(ephemeralAesKey.getEncoded());
        // RSA-2048 with OAEP-SHA256 can wrap up to 190 bytes. AES-256 key is 32 bytes. Fine.

        // Step 3: Encrypt the actual payload with AES-256-GCM using the ephemeral key
        byte[] nonce = new byte[GCM_NONCE_LENGTH_BYTES];
        new SecureRandom().nextBytes(nonce);

        Cipher aesCipher = Cipher.getInstance("AES/GCM/NoPadding");
        aesCipher.init(Cipher.ENCRYPT_MODE, ephemeralAesKey, new GCMParameterSpec(GCM_TAG_LENGTH_BITS, nonce));
        byte[] aesCiphertext = aesCipher.doFinal(payload.getBytes(StandardCharsets.UTF_8));

        // Pack everything into one blob: [keyLen(4)][encryptedKey][nonce][ciphertext+tag]
        int keyLen = encryptedAesKey.length;
        ByteBuffer buffer = ByteBuffer.allocate(4 + keyLen + GCM_NONCE_LENGTH_BYTES + aesCiphertext.length);
        buffer.putInt(keyLen);             // 4-byte length prefix lets decryptor know where the key ends
        buffer.put(encryptedAesKey);
        buffer.put(nonce);
        buffer.put(aesCiphertext);

        return Base64.getEncoder().encodeToString(buffer.array());
    }

    /**
     * Decrypts a hybrid-encrypted payload using the recipient's RSA private key.
     * Only the holder of the private key can unwrap the AES key and recover the plaintext.
     *
     * @param hybridCiphertextBase64 the Base64 blob from encrypt()
     * @param recipientPrivateKey    the recipient's RSA private key — never transmitted
     * @return the original plaintext payload
     */
    public static String decrypt(String hybridCiphertextBase64, PrivateKey recipientPrivateKey) throws Exception {
        byte[] payload = Base64.getDecoder().decode(hybridCiphertextBase64);
        ByteBuffer buffer = ByteBuffer.wrap(payload);

        // Read the 4-byte key length prefix to know how many bytes the wrapped AES key occupies
        int keyLen = buffer.getInt();
        byte[] encryptedAesKey = new byte[keyLen];
        buffer.get(encryptedAesKey);

        // Step 1: Unwrap the AES key using RSA-OAEP with the private key
        Cipher rsaCipher = Cipher.getInstance("RSA/ECB/OAEPWithSHA-256AndMGF1Padding");
        OAEPParameterSpec oaepParams = new OAEPParameterSpec(
            "SHA-256", "MGF1", MGF1ParameterSpec.SHA256, PSource.PSpecified.DEFAULT
        );
        rsaCipher.init(Cipher.DECRYPT_MODE, recipientPrivateKey, oaepParams);
        byte[] aesKeyBytes = rsaCipher.doFinal(encryptedAesKey);
        SecretKey ephemeralAesKey = new SecretKeySpec(aesKeyBytes, "AES");

        // Step 2: Extract nonce and decrypt with AES-GCM
        byte[] nonce = new byte[GCM_NONCE_LENGTH_BYTES];
        buffer.get(nonce);
        byte[] aesCiphertext = new byte[buffer.remaining()];
        buffer.get(aesCiphertext);

        Cipher aesCipher = Cipher.getInstance("AES/GCM/NoPadding");
        aesCipher.init(Cipher.DECRYPT_MODE, ephemeralAesKey, new GCMParameterSpec(GCM_TAG_LENGTH_BITS, nonce));
        byte[] plaintextBytes = aesCipher.doFinal(aesCiphertext);

        return new String(plaintextBytes, StandardCharsets.UTF_8);
    }

    public static void main(String[] args) throws Exception {
        // Generate an RSA-2048 key pair — in production, the private key lives in an HSM
        // or is generated and stored exclusively on the client device
        KeyPairGenerator rsaGen = KeyPairGenerator.getInstance("RSA");
        rsaGen.initialize(2048, new SecureRandom()); // 2048 minimum; prefer 4096 for long-lived keys
        KeyPair keyPair = rsaGen.generateKeyPair();

        String sensitiveDocument = "{\"patientId\":\"P-9921\",\"diagnosis\":\"T2 Diabetes\",\"notes\":\"Prescribed metformin 500mg\"}";

        System.out.println("Original document:  " + sensitiveDocument);

        // Encrypt with the recipient's public key (server stores this, everyone can have it)
        String encrypted = encrypt(sensitiveDocument, keyPair.getPublic());
        System.out.println("Encrypted (Base64): " + encrypted.substring(0, 60) + "... [truncated for display]");

        // Decrypt with the recipient's private key (only the patient's device has this)
        String decrypted = decrypt(encrypted, keyPair.getPrivate());
        System.out.println("Decrypted document: " + decrypted);
    }
}

package io.thecodeforge.dsa;

import javax.crypto.Mac;
import javax.crypto.SecretKey;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.security.*;
import java.util.Base64;

/**
 * Demonstrates the three most commonly confused crypto operations in production:
 * 1. AES-GCM      — confidentiality + integrity (encrypt sensitive data)
 * 2. HMAC-SHA256  — integrity only (verify a message hasn't been tampered with)
 * 3. RSA-PSS      — digital signature (prove who sent a message, non-repudiation)
 *
 * These are NOT interchangeable. Using the wrong one for the job is a security vulnerability.
 */
public class EncryptionStrategySelector {

    // -------------------------------------------------------------------------
    // Use Case 1: HMAC-SHA256 for webhook payload integrity verification.
    // GitHub, Stripe, Twilio all use HMAC-SHA256 for webhook signatures.
    // This does NOT encrypt the payload — it only lets the receiver verify it wasn't modified.
    // -------------------------------------------------------------------------

    /**
     * Generates an HMAC-SHA256 signature for a webhook payload.
     * The secret is shared out-of-band (configured in your dashboard, stored in Secrets Manager).
     * This is identical to how Stripe verifies webhook events.
     *
     * @param webhookPayload the raw JSON body as a string (must be the exact bytes, before any parsing)
     * @param sharedSecret   the webhook signing secret from your secrets manager
     * @return hex-encoded HMAC signature to compare against the inbound X-Signature header
     */
    public static String computeWebhookSignature(String webhookPayload, byte[] sharedSecret) throws Exception {
        // HMAC-SHA256 requires a symmetric secret — both sides must have it.
        // It provides integrity and authentication but NOT confidentiality.
        // The payload is still readable by anyone who intercepts it — use TLS for confidentiality.
        Mac hmac = Mac.getInstance("HmacSHA256");
        SecretKeySpec signingKey = new SecretKeySpec(sharedSecret, "HmacSHA256");
        hmac.init(signingKey);
        byte[] signatureBytes = hmac.doFinal(webhookPayload.getBytes(StandardCharsets.UTF_8));

        // Convert to hex string — most webhook providers use hex, some use Base64
        StringBuilder hexBuilder = new StringBuilder();
        for (byte b : signatureBytes) {
            hexBuilder.append(String.format("%02x", b));
        }
        return hexBuilder.toString();
    }

    /**
     * Verifies a webhook signature using constant-time comparison.
     * CRITICAL: Do NOT use .equals() for signature comparison — it short-circuits on first
     * mismatch, creating a timing side-channel that lets attackers guess signatures byte by byte.
     * MessageDigest.isEqual() runs in constant time regardless of where the mismatch occurs.
     */
    public static boolean verifyWebhookSignature(String payload, byte[] sharedSecret, String expectedSignature) throws Exception {
        String computedSignature = computeWebhookSignature(payload, sharedSecret);
        // MessageDigest.isEqual() is constant-time — this is not optional
        return MessageDigest.isEqual(
            computedSignature.getBytes(StandardCharsets.UTF_8),
            expectedSignature.getBytes(StandardCharsets.UTF_8)
        );
    }

    // -------------------------------------------------------------------------
    // Use Case 2: RSA-PSS Digital Signature for document signing.
    // Use this when you need non-repudiation: proof that a specific private key signed a document.
    // JWT RS256 tokens, code signing, and contract signing all use this pattern.
    // -------------------------------------------------------------------------

    /**
     * Signs a document (e.g., a financial transaction record) with RSA-PSS.
     * PSS (Probabilistic Signature Scheme) is what you use — PKCS#1 v1.5 signatures
     * have known vulnerabilities (e.g., Bleichenbacher's 2006 attack on RSA-PKCS1-v1_5 sigs).
     *
     * @param documentJson  the document content to sign as a JSON string
     * @param signingKey    the signer's RSA private key — lives in HSM in production
     * @return Base64-encoded signature to store alongside the document
     */
    public static String signDocument(String documentJson, PrivateKey signingKey) throws Exception {
        Signature rsaPss = Signature.getInstance("RSASSA-PSS");
        // SHA-256 with PSS parameters — explicitly specify rather than relying on JVM defaults
        java.security.spec.PSSParameterSpec pssParams = new java.security.spec.PSSParameterSpec(
            "SHA-256",   // hash algorithm
            "MGF1",      // mask generation function
            java.security.spec.MGF1ParameterSpec.SHA256,
            32,          // salt length in bytes — should match hash output length (SHA-256 = 32 bytes)
            1            // trailer field — always 1 per RFC 8017
        );
        rsaPss.setParameter(pssParams);
        rsaPss.initSign(signingKey);
        rsaPss.update(documentJson.getBytes(StandardCharsets.UTF_8));
        byte[] signatureBytes = rsaPss.sign();
        return Base64.getEncoder().encodeToString(signatureBytes);
    }

    /**
     * Verifies an RSA-PSS signature using the signer's public key.
     * Anyone with the public key can verify — only the private key holder can sign.
     * This is non-repudiation: the signer can't later claim they didn't sign it.
     */
    public static boolean verifyDocumentSignature(String documentJson, String signatureBase64, PublicKey verifyingKey) throws Exception {
        Signature rsaPss = Signature.getInstance("RSASSA-PSS");
        java.security.spec.PSSParameterSpec pssParams = new java.security.spec.PSSParameterSpec(
            "SHA-256", "MGF1", java.security.spec.MGF1ParameterSpec.SHA256, 32, 1
        );
        rsaPss.setParameter(pssParams);
        rsaPss.initVerify(verifyingKey);
        rsaPss.update(documentJson.getBytes(StandardCharsets.UTF_8));
        return rsaPss.verify(Base64.getDecoder().decode(signatureBase64));
    }

    public static void main(String[] args) throws Exception {
        System.out.println("=== Scenario 1: Webhook Signature Verification (Stripe-style) ===");
        String webhookBody = "{\"event\":\"payment.completed\",\"amount\":9999,\"currency\":\"USD\"}";
        byte[] webhookSecret = "whsec_prod_k9mXv3Rp2nTqLwYs".getBytes(StandardCharsets.UTF_8);

        String signature = computeWebhookSignature(webhookBody, webhookSecret);
        System.out.println("Webhook signature (hex): " + signature.substring(0, 20) + "...");

        boolean valid = verifyWebhookSignature(webhookBody, webhookSecret, signature);
        System.out.println("Signature valid: " + valid);

        // Simulate tampered payload
        boolean tamperedValid = verifyWebhookSignature(
            webhookBody.replace("9999", "1"), webhookSecret, signature
        );
        System.out.println("Tampered payload signature valid: " + tamperedValid);

        System.out.println("\n=== Scenario 2: Document Signing (RSA-PSS) ===");
        KeyPairGenerator rsaGen = KeyPairGenerator.getInstance("RSA");
        rsaGen.initialize(2048, new SecureRandom());
        KeyPair contractSigningKeys = rsaGen.generateKeyPair();

        String loanAgreement = "{\"loanId\":\"LN-44821\",\"borrower\":\"Alice Smith\",\"amount\":250000,\"rate\":\"4.5%\"}";
        String docSignature = signDocument(loanAgreement, contractSigningKeys.getPrivate());
        System.out.println("Document signature (Base64): " + docSignature.substring(0, 30) + "...");

        boolean sigValid = verifyDocumentSignature(loanAgreement, docSignature, contractSigningKeys.getPublic());
        System.out.println("Signature valid: " + sigValid);

        boolean alteredSigValid = verifyDocumentSignature(
            loanAgreement.replace("250000", "1"), docSignature, contractSigningKeys.getPublic()
        );
        System.out.println("Altered document signature valid: " + alteredSigValid);
    }
}