@SuppressWarnings("UnusedException")
  private static RsaSsaPssPrivateKey parsePrivateKey(
      ProtoKeySerialization serialization, @Nullable SecretKeyAccess access)
      throws GeneralSecurityException {
    if (!serialization.getTypeUrl().equals(PRIVATE_TYPE_URL)) {
      throw new IllegalArgumentException(
          "Wrong type URL in call to RsaSsaPssProtoSerialization.parsePrivateKey: "
              + serialization.getTypeUrl());
    }
    try {
      com.google.crypto.tink.proto.RsaSsaPssPrivateKey protoKey =
          com.google.crypto.tink.proto.RsaSsaPssPrivateKey.parseFrom(
              serialization.getValue(), ExtensionRegistryLite.getEmptyRegistry());
      if (protoKey.getVersion() != 0) {
        throw new GeneralSecurityException("Only version 0 keys are accepted");
      }
      com.google.crypto.tink.proto.RsaSsaPssPublicKey protoPublicKey = protoKey.getPublicKey();

      BigInteger modulus = decodeBigInteger(protoPublicKey.getN());
      int modulusSizeInBits = modulus.bitLength();
      BigInteger publicExponent = decodeBigInteger(protoPublicKey.getE());
      RsaSsaPssParameters parameters =
          RsaSsaPssParameters.builder()
              .setSigHashType(
                  HASH_TYPE_CONVERTER.fromProtoEnum(protoPublicKey.getParams().getSigHash()))
              .setMgf1HashType(
                  HASH_TYPE_CONVERTER.fromProtoEnum(protoPublicKey.getParams().getMgf1Hash()))
              .setPublicExponent(publicExponent)
              .setModulusSizeBits(modulusSizeInBits)
              .setSaltLengthBytes(protoPublicKey.getParams().getSaltLength())
              .setVariant(VARIANT_CONVERTER.fromProtoEnum(serialization.getOutputPrefixType()))
              .build();
      RsaSsaPssPublicKey publicKey =
          RsaSsaPssPublicKey.builder()
              .setParameters(parameters)
              .setModulus(modulus)
              .setIdRequirement(serialization.getIdRequirementOrNull())
              .build();

      SecretKeyAccess a = SecretKeyAccess.requireAccess(access);
      return RsaSsaPssPrivateKey.builder()
          .setPublicKey(publicKey)
          .setPrimes(
              decodeSecretBigInteger(protoKey.getP(), a),
              decodeSecretBigInteger(protoKey.getQ(), a))
          .setPrivateExponent(decodeSecretBigInteger(protoKey.getD(), a))
          .setPrimeExponents(
              decodeSecretBigInteger(protoKey.getDp(), a),
              decodeSecretBigInteger(protoKey.getDq(), a))
          .setCrtCoefficient(decodeSecretBigInteger(protoKey.getCrt(), a))
          .build();
    } catch (InvalidProtocolBufferException | IllegalArgumentException e) {
      throw new GeneralSecurityException("Parsing RsaSsaPssPrivateKey failed");
    }
  }
Encodes a BigInteger using a big-endian encoding.
java_src/src/main/java/com/google/crypto/tink/signature/internal/RsaSsaPssProtoSerialization.java