|
|
Featured White Papers
- Why choose an Open Source BPM?
- 10 FAQs on Business Process Management
- Best Practices for Getting Started with BPM
- Free Your Devs From The Pain Of Java Redeploys
- Increase Velocity 40% by Using JRebel
- What Developers Want: The End of Application Redeploys
- Developer Productivity Report: Java Tools, Tech, Devs, and Data
- Coding with JRebel: Java Forever Changed
- Utilizing Fast Testing to Transform Java Development
- Do You Really Get Classloaders?
- Pragmatic Continuous Delivery with Jenkins, Nexus, and LiveRebel
- Your Next Java Web App: Less XML, No Long Restarts, Fewer Hassles
- Coding with JRebel, Java Forever Changed
- 2012 Developer Productivity Report: Java Tools, Tech, Devs, and Data
Sponsored Links
Sponsored Links
Optimize with a SATA RAID Storage Solution
Range of capacities as low as $1250 per TB. Ideal if you currently rely on servers/disks/JBODs
Java security evolution and concepts, Part 4
Learn how optional packages extend and enhance Java security
Page 4 of 6
Figure 3. Java Cryptography Extension. (Source: Sun Microsystems)
The reference implementation, SunJCE provider, supports the following ciphers and MACs:
- DES
- DESede
- Blowfish
- PBEWithMD5AndDES
- PBEWithMD5AndTripleDES
- Diffie-Hellman key agreement among multiple parties
- HMACMD5
- HMACSHA1
With JCE 1.2.1, the framework is exportable outside the US and Canada, enabled by mechanisms JCE implements to ensure that only qualified providers can be plugged in. The cryptographic strength can be controlled in the jurisdiction policy files. Several clean-room JCE 1.2 implementations exist as well (see Resources).
JCE classes
JCE's classes and interfaces exist in the following packages:
javax.cryptojavax.crypto.interfacesjavax.crypto.spec
The classes and interfaces in javax.crypto.spec provide key and parameter specifications for the different algorithms like DES, Diffie-Hellman, and so on.
- Feedback
More from JavaWorld
Resources
- To run this article's example applet, go to
http://www.javaworld.com/jw-05-2001/security/writeFileSSL.html - For all of the files, including the
writeFileSSL.javasource file, associated with this article, go to
http://www.javaworld.com/javaworld/jw-05-2001/security/jw-0525-security.zip - "Java Security Evolution and Concepts," Raghavan N. Srinivas (JavaWorld):
- Part 1Learn computer security concepts and terms in this introductory overview (April 2000)
- Part 2Discover the ins and outs of Java security (July 2000)
- Part 3Tackle Java applet security with confidence (December 2000)
- Part 4Learn how optional packages extend and enhance Java security (May 2001)
- Part 5J2SE 1.4 offers numerous improvements to Java security (December 2001)
- "Construct Secure Networked Applications with Certificates," Todd Sundsted (JavaWorld):
- Part 1Certificates add value to public-key cryptography (January 12, 2001)
- Part 2Learn to use the X.509 certificates (February 16, 2001)
- Part 3Use the Java CRL and X509CRL classes (March 16, 2001)
- Part 4Authenticate clients and servers, and verify certificate chains (April 13, 2001)
- For more articles covering Java security, visit the Security section of JavaWorld's Topical Index
http://www.javaworld.com/javaworld/topicalindex/jw-ti-security.html - JavaWorld's Java Bookstore Security page can point you to numerous security-related books
http://www.javaworld.com/javaworld/books/jw-books-security.html - Sign up for the JavaWorld This Week free weekly email newsletter and keep up with what's new at JavaWorld
http://www.idg.net/jw-subscribe
- Java Security Resources from java.sun.com
- For comprehensive Java security information, read the Java Security API page
http://java.sun.com/security - For the latest documentation on Java security, read java.sun.com's documentation from Java 2 1.3
http://java.sun.com/j2se/1.3/docs/guide/security/index.html - "Low Level Security in Java," Frank Yellin (java.sun.com)
http://java.sun.com/sfaq/verifier.html - For Java security Q&A archives, see
http://archives.java.sun.com/archives/java-security.html - "Frequently Asked Questions -- Java Security" (java.sun.com)
http://java.sun.com/sfaq/ - "TrailSecurity in Java 2 SDK 1.2," Mary Dageforde (java.sun.com)
http://web2.java.sun.com/docs/books/tutorial/security1.2/index.html - Java 2, SDK platform security tools
http://java.sun.com/j2se/1.3/docs/tooldocs/tools.html#security - Default Policy Implementation and Policy File Syntax
http://java.sun.com/j2se/1.3/docs/guide/security/PolicyFiles.html - Java 2, v1.2 code signing example
http://java.sun.com/security/signExample12/ - Java Plug-in documentation and download
http://java.sun.com/products/plugin/index.html - Support for extensions and applications in Java 2
http://java.sun.com/products/jdk/1.2/docs/guide/extensions/spec.html - Plugin Authentication Modules (PAM)
http://java.sun.com/security/jaas/doc/pam.html - "How to Implement a Provider for the Java Cryptography Extension 1.2.1" (java.sun.com)
http://java.sun.com/products/jce/doc/guide/HowToImplAProvider.html - JCE 1.2 implementation providers
http://java.sun.com/products/jce/jce12_providers.html
- Other Important Java Security Resources
- Netscape's security tools, including signtool
http://developer.netscape.com/docs/manuals/index.html?content=security.html - For a list of CAs for obtaining code-signing certificates, see
https://certs.netscape.com/client.html - A comprehensive list of security-related problems with suggested remedial action, known as CERT advisories
http://www.cert.org/ - Applied CryptographyProtocols, Algorithms, and Source Code in C, 2nd Ed., Bruce Schneier (John Wiley and Sons, 1996; ISBN0471117099) -- a fascinating book on the science and politics of cryptography
http://www.amazon.com/exec/obidos/ASIN/0471117099/javaworld - RSA Labs' FAQ about today's cryptographyftp://ftp.rsasecurity.com/pub/labsfaq/labsfaq4.pdf
- The X.509 standard for certificates
http://www.ietf.org/rfc/rfc2459.txt