Home

Java

JCA (Java Cryptography Architecture)

JSSE (Java Secure Socket Extensions)

Standard algorithm names

The Java Tutorials -- Security Features in Java SE

Keys

Interfaces

Key
 |
 |__ SecretKey: Group all secret key interfaces and provide type safety
 |      |
 |      |__ PBEKey: Password-based encryption key
 |
 |__ PrivateKey
 |       |
 |       |__ RSAPrivateKey
 |       |
 |       |__ ECPrivateKey
 |       |
 |       |__ DHPrivateKey
 |
 |__ PublicKey
         |
         |__ RSAPublicKey
         |
         |__ ECPublicKey
         |
         |__ DHPublicKey
 
 Destroyable

Key

• getAlgorithm(): String -- the name of the algorithm that uses this key
• getEncoded(): byte[] -- for transmitting the key outside the JVM
• getFormat(): String -- the encoding format, e.g. "X.509" for RSA public key

Destroyable

All the secret keys and private keys implement this interface. Call destroy() after the use of the key.

• destroy(): void
• isDestroyed(): boolean

PBEKey

• getIterationCount(): int
• getPassword(): char[] -- wipe out the char array after use
• getSalt(): byte[]

Generating keys

(To be written)

Writing and reading keys

To save the key, use Key.getEncoded(): byte[]. If needed, base64 encode the bytes.

To load the key, use the KeySpec types. Depending on the type of the key,

• SecretKeySpec(key: byte[], algorithm: String) where algorithm can be looked up in Standard Names. SecretKeySpec implements Key thus can be used directly as a key.

Key specs

SecretKeySpec

Certificates

Java certificate authority (or root certificate): jre/lib/security/cacerts

Applications

• ID generation
• S3 HMAC request signing; you can similarly sign the response using HMAC.
• Encryption at rest (one key per item)
• Data upload with a special example of code publishing
• SSL, TLS
• JWT, JWS, JWE
• OAuth
• Data upload using JWE

Basics

• Random number generation
• Hashing
• Symmetric encryption
• Asymmetric encryption

Tools

openssl

keytool

Bouncy Castle

Bouncy Castle Specifications

Bouncy Castle GitHub mirror

Bouncy Castle tests

Bouncy Castle API

Bouncy Castle PKIX API

Bouncy Castle OpenPGP API

Algorithm Names

TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256

• TLS: Or SSL, protocol
• ECDHE: EC, elliptical curve, algorithm; DHE, E is ephemeral, for forward secrecy
• ECDSA_WITH_AES_128: Symmetrical encryption after key exchange
• GCM: Cipher mode
• SHA256: Hashing