Whitespace only checkstyle rules around tokens

checkstyle.xml

@@ -2,7 +2,7 @@
 <!--
 ###############################################################################
 #
-# Copyright IBM Corp. 2023
+# Copyright IBM Corp. 2023, 2026
 #
 # This code is free software; you can redistribute it and/or modify it
 # under the terms provided by IBM in the LICENSE file that accompanied
@@ -41,5 +41,8 @@
         <module name="UnusedImports"/>
         <module name="UnusedLocalVariable"/>
         <module name="WhitespaceAfter"/>
+        <module name="WhitespaceAround">
+          <property name="allowEmptyConstructors" value="true"/>
+        </module>
     </module>
 </module>

src/main/java/com/ibm/crypto/plus/provider/AESCCMCipher.java

@@ -770,7 +770,7 @@ protected int engineUpdate(ByteBuffer input, ByteBuffer output) throws ShortBuff
     }
 
     private Runnable cleanOCKResources(byte[] Key, OCKContext ockContext) {
-        return() -> {
+        return () -> {
             try {
                 if (ockContext != null) {
                     CCMCipher.doCCM_cleanup(ockContext);

src/main/java/com/ibm/crypto/plus/provider/AESGCMCipher.java

@@ -1445,7 +1445,7 @@ private void resetVars(boolean afterFailure) {
     }
 
     private Runnable cleanOCKResources(PrimitiveWrapper.ByteArray Key) {
-        return() -> {
+        return () -> {
             try {
                 //JS00684 - Leave cleanup of internal variables to GCMCipher that caches them
                 if (Key.getValue() != null) {

src/main/java/com/ibm/crypto/plus/provider/AESKey.java

@@ -1,5 +1,5 @@
 /*
- * Copyright IBM Corp. 2023, 2025
+ * Copyright IBM Corp. 2023, 2026
  *
  * This code is free software; you can redistribute it and/or modify it
  * under the terms provided by IBM in the LICENSE file that accompanied
@@ -157,12 +157,12 @@ private void checkDestroyed() {
     }
 
     private Runnable cleanOCKResources(byte[] key) {
-        return() -> {
+        return () -> {
             try {
                 if (key != null) {
                     Arrays.fill(key, (byte) 0x00);
                 }
-            } catch (Exception e){
+            } catch (Exception e) {
                 if (OpenJCEPlusProvider.getDebug() != null) {
                     OpenJCEPlusProvider.getDebug().println("An error occurred while cleaning : " + e.getMessage());
                     e.printStackTrace();

src/main/java/com/ibm/crypto/plus/provider/AESKeyWrapCipher.java

@@ -187,7 +187,7 @@ protected int engineGetOutputSize(int inputLen) {
         } else {
             result = Math.addExact(inputLen, 16);
         }
-        return (result < 0? 0:result);
+        return (result < 0 ? 0 : result);
     }
 
     @Override

src/main/java/com/ibm/crypto/plus/provider/ChaCha20Key.java

@@ -1,5 +1,5 @@
 /*
- * Copyright IBM Corp. 2023, 2025
+ * Copyright IBM Corp. 2023, 2026
  *
  * This code is free software; you can redistribute it and/or modify it
  * under the terms provided by IBM in the LICENSE file that accompanied
@@ -160,12 +160,12 @@ private void checkDestroyed() {
     }
 
     private Runnable cleanOCKResources(byte[] key) {
-        return() -> {
+        return () -> {
             try {
                 if (key != null) {
                     Arrays.fill(key, (byte) 0x00);
                 }
-            } catch (Exception e){
+            } catch (Exception e) {
                 if (OpenJCEPlusProvider.getDebug() != null) {
                     OpenJCEPlusProvider.getDebug().println("An error occurred while cleaning : " + e.getMessage());
                     e.printStackTrace();

src/main/java/com/ibm/crypto/plus/provider/DESedeKey.java

@@ -1,5 +1,5 @@
 /*
- * Copyright IBM Corp. 2023, 2025
+ * Copyright IBM Corp. 2023, 2026
  *
  * This code is free software; you can redistribute it and/or modify it
  * under the terms provided by IBM in the LICENSE file that accompanied
@@ -161,12 +161,12 @@ private void checkDestroyed() {
     }
 
     private Runnable cleanOCKResources(byte[] key) {
-        return() -> {
+        return () -> {
             try {
                 if (key != null) {
                     Arrays.fill(key, (byte) 0x00);
                 }
-            } catch (Exception e){
+            } catch (Exception e) {
                 if (OpenJCEPlusProvider.getDebug() != null) {
                     OpenJCEPlusProvider.getDebug().println("An error occurred while cleaning : " + e.getMessage());
                     e.printStackTrace();

src/main/java/com/ibm/crypto/plus/provider/ECDSASignature.java

@@ -133,7 +133,7 @@ protected void engineSetParameter(AlgorithmParameterSpec params)
             throw new InvalidAlgorithmParameterException(
                     "Parameters must be of type ECParameterSpec");
         }
-        java.security.interfaces.ECKey key = (this.privateKey == null? this.publicKey : this.privateKey);
+        java.security.interfaces.ECKey key = (this.privateKey == null ? this.publicKey : this.privateKey);
         if ((key != null) && !ECUtil.equals(ecparams, key.getParams())) {
             throw new InvalidAlgorithmParameterException(
                     "Signature params does not match key params");

src/main/java/com/ibm/crypto/plus/provider/ECKeyPairGenerator.java

@@ -25,7 +25,7 @@ public final class ECKeyPairGenerator extends KeyPairGeneratorSpi {
     private static final boolean legacyECdefault = Boolean.parseBoolean(System.getProperty(EC_LEGACY_DEFAULT_KEYSIZE));
 
     private OpenJCEPlusProvider provider = null;
-    private int keysize = legacyECdefault? 256 : 384;
+    private int keysize = legacyECdefault ? 256 : 384;
     private SecureRandom cryptoRandom = null;
     ECParameterSpec ecSpec;
     private ObjectIdentifier oid = null;

src/main/java/com/ibm/crypto/plus/provider/MLKEMImpl.java

@@ -109,7 +109,7 @@ public KEM.Encapsulated engineEncapsulate(int from, int to, String algorithm) {
             byte[] encapsulation = new byte[encapLen];
             byte[] secret = new byte[SECRETSIZE];
 
-            if (from < 0 || to > SECRETSIZE || ((to - from) < 0) || (from >= SECRETSIZE)){
+            if (from < 0 || to > SECRETSIZE || ((to - from) < 0) || (from >= SECRETSIZE)) {
                 throw new IndexOutOfBoundsException();
             }
             if (algorithm == null) {
@@ -191,7 +191,7 @@ public SecretKey engineDecapsulate(byte[] cipherText, int from, int to, String a
                 throws DecapsulateException {
             byte[] secret;
 
-            if (from < 0 || to > SECRETSIZE || ((to - from) < 0) || (from >= SECRETSIZE)){
+            if (from < 0 || to > SECRETSIZE || ((to - from) < 0) || (from >= SECRETSIZE)) {
                 throw new IndexOutOfBoundsException();
             }
             if (algorithm == null || cipherText == null) {

src/main/java/com/ibm/crypto/plus/provider/MessageDigest.java

@@ -38,7 +38,7 @@ protected void engineUpdate(byte[] input, int offset, int length) {
             throw new IllegalArgumentException("No input buffer given");
         }
         if ((offset < 0) || (length < 0) || (offset > input.length - length)) {
-            throw new ArrayIndexOutOfBoundsException("Range out of bounds for buffer of length " + input.length +" using offset: " + offset + ", input length: " + length);
+            throw new ArrayIndexOutOfBoundsException("Range out of bounds for buffer of length " + input.length + " using offset: " + offset + ", input length: " + length);
         }
         try {
             this.digest.update(input, offset, length);

src/main/java/com/ibm/crypto/plus/provider/OpenJCEPlusProvider.java

@@ -59,7 +59,7 @@ public abstract class OpenJCEPlusProvider extends java.security.Provider {
         super(name, PROVIDER_VER, info);
 
         numCleaners = Integer.getInteger("openjceplus.cleaners.num", DEFAULT_NUM_CLEANERS);
-        if (numCleaners < 1){
+        if (numCleaners < 1) {
             throw new IllegalArgumentException(numCleaners + " is an invalid number of cleaner threads, must be at least 1.");
         }
 

src/main/java/com/ibm/crypto/plus/provider/PBEKey.java

@@ -1,5 +1,5 @@
 /*
- * Copyright IBM Corp. 2025
+ * Copyright IBM Corp. 2025, 2026
  *
  * This code is free software; you can redistribute it and/or modify it
  * under the terms provided by IBM in the LICENSE file that accompanied
@@ -181,12 +181,12 @@ private Object writeReplace() throws java.io.ObjectStreamException {
 
 
     private Runnable cleanOCKResources(byte[] key) {
-        return() -> {
+        return () -> {
             try {
                 if (key != null) {
                     Arrays.fill(key, (byte) 0x00);
                 }
-            } catch (Exception e){
+            } catch (Exception e) {
                 if (OpenJCEPlusProvider.getDebug() != null) {
                     OpenJCEPlusProvider.getDebug().println("An error occurred while cleaning : " + e.getMessage());
                     e.printStackTrace();

src/main/java/com/ibm/crypto/plus/provider/PBEKeyFactory.java

@@ -193,7 +193,7 @@ protected KeySpec engineGetKeySpec(SecretKey key, Class<?> keySpecCl)
             if ((keySpecCl != null) && keySpecCl.isAssignableFrom(PBEKeySpec.class)) {
                 byte[] passwdBytes = key.getEncoded();
                 char[] passwdChars = new char[passwdBytes.length];
-                for (int i=0; i < passwdChars.length; i++)
+                for (int i = 0; i < passwdChars.length; i++)
                     passwdChars[i] = (char) (passwdBytes[i] & 0x7f);
                 PBEKeySpec ret = new PBEKeySpec(passwdChars);
                 // password char[] was cloned in PBEKeySpec constructor,

src/main/java/com/ibm/crypto/plus/provider/PBES1Core.java

@@ -239,10 +239,10 @@ private byte[] passwordBigEndian(byte[] password) {
         }
 
         byte[] pass = new byte[(password.length * 2) + 2];
-        for (int i = 0, j = 0; i < password.length; i++, j+=2) {
+        for (int i = 0, j = 0; i < password.length; i++, j += 2) {
             char passwordChar = (char) (password[i] & 0x7f);
             pass[j] = (byte) ((passwordChar >>> 8) & 0xFF);
-            pass[j+1] = (byte) (passwordChar & 0xFF);
+            pass[j + 1] = (byte) (passwordChar & 0xFF);
         }
 
         return pass;

src/main/java/com/ibm/crypto/plus/provider/PBES2Core.java

@@ -1,5 +1,5 @@
 /*
- * Copyright IBM Corp. 2025
+ * Copyright IBM Corp. 2025, 2026
  *
  * This code is free software; you can redistribute it and/or modify it
  * under the terms provided by IBM in the LICENSE file that accompanied
@@ -52,7 +52,7 @@ abstract class PBES2Core extends CipherSpi {
         if (cipherAlgo.equalsIgnoreCase("AES")) {
             cipher = new AESCipher(provider);
 
-            switch(kdfAlgo.toLowerCase()) {
+            switch (kdfAlgo.toLowerCase()) {
                 case "hmacsha1":
                     kdf = new PBKDF2Core.HmacSHA1(provider);
                     break;

src/main/java/com/ibm/crypto/plus/provider/PBKDF2KeyImpl.java

@@ -244,8 +244,8 @@ private void readObject(ObjectInputStream stream) throws IOException, ClassNotFo
         throw new InvalidObjectException("PBKDF2KeyImpl keys are not directly deserializable");
     }
 
-    private Runnable cleanOCKResources(byte[] key, char[] passwd, byte[] salt){
-        return() -> {
+    private Runnable cleanOCKResources(byte[] key, char[] passwd, byte[] salt) {
+        return () -> {
             try {
                 if (key != null) {
                     java.util.Arrays.fill(key, (byte) 0x00);
@@ -256,7 +256,7 @@ private Runnable cleanOCKResources(byte[] key, char[] passwd, byte[] salt){
                 if (salt != null) {
                     java.util.Arrays.fill(salt, (byte) 0x00);
                 }
-            } catch (Exception e){
+            } catch (Exception e) {
                 if (OpenJCEPlusProvider.getDebug() != null) {
                     OpenJCEPlusProvider.getDebug().println("An error occurred while cleaning : " + e.getMessage());
                     e.printStackTrace();

src/main/java/com/ibm/crypto/plus/provider/PQCKeyFactory.java

@@ -1,5 +1,5 @@
 /*
- * Copyright IBM Corp. 2025
+ * Copyright IBM Corp. 2025, 2026
  *
  * This code is free software; you can redistribute it and/or modify it
  * under the terms provided by IBM in the LICENSE file that accompanied
@@ -195,7 +195,7 @@ private boolean checkEncoded(byte[] key, boolean pub) {
                 for (int i = 2; i < 4; i++) {
                     sb.append(String.format("%02X", key[i]));
                 }
-                String s =sb.toString();
+                String s = sb.toString();
                 int b =  Integer.parseInt(s, 16);
                 if (b == (key.length - 4)) {
                     //This is an encoding

src/main/java/com/ibm/crypto/plus/provider/PQCKeyPairGenerator.java

@@ -59,7 +59,7 @@ public void initialize(AlgorithmParameterSpec params, SecureRandom random)
                 }
             } else if (!pqcAlg.equalsIgnoreCase(name)) {
                 throw new InvalidAlgorithmParameterException(
-                    "Algorithm in AlgorithmParameterSpec: " +spec.getName() + 
+                    "Algorithm in AlgorithmParameterSpec: " + spec.getName() + 
                     " must match the Algorithnm for this KeyPairGenerator: " + pqcAlg);
             }
         } else {
@@ -103,7 +103,7 @@ public KeyPair generateKeyPair() {
                                                         pqcAlg, pubKeyBytes, provider));
             return new KeyPair(pubKey, privKey);
         } catch (Exception e) {
-            throw provider.providerException("Failure in generateKeyPair - " +e.getCause(), e);
+            throw provider.providerException("Failure in generateKeyPair - " + e.getCause(), e);
         }
     }
 

src/main/java/com/ibm/crypto/plus/provider/PQCPrivateKey.java

@@ -222,7 +222,7 @@ private boolean OctectStringEncoded(byte[] key) {
                 for (int i = 2; i < 4; i++) {
                     sb.append(String.format("%02X", key[i]));
                 }
-                String s =sb.toString();
+                String s = sb.toString();
                 int b =  Integer.parseInt(s, 16);
                 if (b == (key.length - 4)) {
                     //This is an encoding

src/main/java/com/ibm/crypto/plus/provider/PQCPublicKey.java

@@ -66,11 +66,11 @@ final class PQCPublicKey extends X509Key
             this.name = PQCKnownOIDs.findMatch(this.algid.getName()).stdName();
 
             //OCKC puts the BITSTRING on the key. Need to remove it.
-            setKey(new BitArray((rawKey.length - 5)*8, rawKey, 5));
+            setKey(new BitArray((rawKey.length - 5) * 8, rawKey, 5));
 
             this.pqcKey = pqcKey;
         } catch (Exception exception) {
-            throw provider.providerException("Failure in PublicKey + "+ exception.getMessage(), exception);
+            throw provider.providerException("Failure in PublicKey + " + exception.getMessage(), exception);
         }
     }
 

src/main/java/com/ibm/crypto/plus/provider/PrimitiveWrapper.java

@@ -1,5 +1,5 @@
 /*
- * Copyright IBM Corp. 2025
+ * Copyright IBM Corp. 2025. 2026
  *
  * This code is free software; you can redistribute it and/or modify it
  * under the terms provided by IBM in the LICENSE file that accompanied
@@ -29,7 +29,7 @@ public Long(long value) {
             this.value = value;
         }
 
-        public long getValue(){
+        public long getValue() {
             return this.value;
         }
 
@@ -45,7 +45,7 @@ public Bool(boolean value) {
             this.value = value;
         }
 
-        public boolean getValue(){
+        public boolean getValue() {
             return this.value;
         }
 
@@ -61,7 +61,7 @@ public ByteArray(byte[] value) {
             this.value = value;
         }
 
-        public byte[] getValue(){
+        public byte[] getValue() {
             return this.value;
         }
 

src/main/java/com/ibm/crypto/plus/provider/RSAKeyFactory.java

@@ -1,5 +1,5 @@
 /*
- * Copyright IBM Corp. 2023, 2024
+ * Copyright IBM Corp. 2023, 2026
  *
  * This code is free software; you can redistribute it and/or modify it
  * under the terms provided by IBM in the LICENSE file that accompanied
@@ -126,7 +126,7 @@ static void checkKeyLengths(int modulusLen, BigInteger exponent, int minModulusL
         if ((specificModulesLen != null) && (!specificModulesLen.contains(modulusLen))) {
             if (flag.equals("verify")) {
                 throw new InvalidKeyException("In FIPS mode, only 1024, 2048, 3072, or 4096 size of RSA key is accepted.");
-            } else if (flag.equals("sign")){
+            } else if (flag.equals("sign")) {
                 throw new InvalidKeyException("In FIPS mode, only 2048, 3072, or 4096 size of RSA key is accepted.");
             }
         }

src/main/java/com/ibm/crypto/plus/provider/base/AESKeyWrap.java

@@ -35,7 +35,7 @@ public byte[] wrap(byte[] data, int start, int length) throws OCKException {
 
         int type = 1; //wrap
         if (padding) {
-            type = type|4; // add padding
+            type = type | 4; // add padding
         }
 
         try {
@@ -64,7 +64,7 @@ public byte[] unwrap(byte[] data, int start, int length) throws OCKException {
         try {
             output = NativeInterface.CIPHER_KeyWraporUnwrap(this.ockContext.getId(), inData, this.key, type);
         } catch (Exception e) {
-            throw new OCKException("Failed to unwrap data"+ e.getMessage());
+            throw new OCKException("Failed to unwrap data" + e.getMessage());
         }  finally {
             //Clear inData
             Arrays.fill(inData, (byte) 0);

src/main/java/com/ibm/crypto/plus/provider/base/ECKey.java

@@ -131,7 +131,7 @@ public static ECKey generateKeyPair(OCKContext ockContext, int size, SecureRando
         long ecKeyId;
         try {
             ecKeyId = NativeInterface.ECKEY_generate(ockContext.getId(), size);
-        } catch (OCKException oe){
+        } catch (OCKException oe) {
             if (oe.getMessage().contains("Incorrect key size") && allowIncorrectKeysizes) {
                 // If the flag is set and an incorrect key size was provided, default to 256.
                 ecKeyId = NativeInterface.ECKEY_generate(ockContext.getId(), 256);
@@ -509,7 +509,7 @@ protected static boolean validId(long id) {
     }
 
     private Runnable cleanOCKResources(byte[] privateKeyBytes, long ecKeyId, PrimitiveWrapper.Long pkeyId, OCKContext ockContext) {
-        return() -> {
+        return () -> {
             try {
                 if ((privateKeyBytes != null) && (privateKeyBytes != unobtainedKeyBytes)) {
                     Arrays.fill(privateKeyBytes, (byte) 0x00);

src/main/java/com/ibm/crypto/plus/provider/base/ExtendedRandom.java

@@ -62,7 +62,7 @@ public synchronized void setSeed(byte[] seed) throws OCKException {
     }
 
     private Runnable cleanOCKResources(long ockPRNGContextId, OCKContext ockContext) {
-        return() -> {
+        return () -> {
             try {
                 if (ockPRNGContextId != 0) {
                     NativeInterface.EXTRAND_delete(ockContext.getId(), ockPRNGContextId);