java.security

Package Specification

• Cryptography Architecture
• PKCS8: Private-Key Information Standard, Version 1.2, November 1993

Related Documentation

• Security Architecture
• How to Implement a Provider for the Java Cryptography Architecture
• Default Policy Implementation and Policy File Syntax
• Policy Permissions
• Security Tools Summary
• keytool ( for Solaris/Linux) ( for Windows)
• jarsigner ( for Solaris/Linux) ( for Windows)

More specifically, it encapsulates a context and has a single method, checkPermission, that is equivalent to the checkPermission method in the AccessController class, with one difference: The AccessControlContext checkPermission method makes access decisions based on the context it encapsulates, rather than that of the current execution thread.

Thus, the purpose of AccessControlContext is for those situations where a security check that should be made within a given context actually needs to be done from within a different context (for example, from within a worker thread).

An AccessControlContext is created by calling the AccessController.getContext method.

This exception is thrown by the AccessController to indicate that a requested access (to a critical system resource such as the file system or the network) is denied.

The reason to deny access can vary.

Note: Granting AllPermission should be done with extreme care, as it implies all other permissions.

The name for a BasicPermission is the name of the given permission (for example, "exit", "setFactory", "print.queueJob", etc).

This is an interface of abstract methods for managing a variety of identity certificates. An identity certificate is a guarantee by a principal that a public key is that of another principal.

This class extends the concept of a codebase to encapsulate not only the location (URL) but also the certificate chains that were used to verify signed code originating from that location.

To complete the message digest computation, call one of the digest methods on the associated message digest after your calls to one of this digest input stream's DigestInputStream.read() read methods.

It is possible to turn this stream on or off (see DigestInputStream.on(boolean) on ).

To complete the message digest computation, call one of the digest methods on the associated message digest after your calls to one of this digest ouput stream's DigestOutputStream.write(int) write methods.

It is possible to turn this stream on or off (see DigestOutputStream.on(boolean) on ).

A DomainCombiner is passed as a parameter to the appropriate constructor for AccessControlContext. The newly constructed context is then passed to the AccessController.doPrivileged(..., context) method to bind the provided context (and associated DomainCombiner) with the current execution Thread.

This interface represents a guard, which is an object that is used to protect access to another object.

This interface contains a single method, checkGuard, with a single object argument.

A GuardedObject encapsulates a target object and a Guard object, such that access to the target object is possible only if the Guard object allows it. Once an object is encapsulated by a GuardedObject, access to that object is controlled by the getObject method, which invokes the checkGuard method on the Guard object that is guarding access.

This class represents identities: real-world objects such as people, companies or organizations whose identities can be authenticated using their public keys.

This class represents a scope for identities.

Key factories are bi-directional.

Key factories are used to convert keys (opaque cryptographic keys of type Key) into key specifications (transparent representations of the underlying key material), and vice versa.

Key factories are bi-directional.

This class defines the Service Provider Interface (SPI) for the KeyPairGenerator class, which is used to generate pairs of public and private keys.

Note that a serialized Key may contain sensitive information which should not be exposed in untrusted environments.

A KeyStore manages different types of entries. Each type of entry implements the KeyStore.Entry interface. Three basic KeyStore.Entry implementations are provided:

• KeyStore.PrivateKeyEntry

  This type of entry holds a cryptographic PrivateKey, which is optionally stored in a protected format to prevent unauthorized access.

A MessageDigest object starts out initialized.

With a PermissionCollection, you can:

• add a permission to the collection using the add method.
• check to see if a particular permission is implied in the collection, using the implies method.
• enumerate all the permissions, using the elements method.

When it is desirable to group together a number of Permission objects of the same type, the newPermissionCollection method on that particular type of Permission object should first be called.

There is only one Policy object installed in the runtime at any given time.

Subclass implementations of this abstract class must provide a public constructor that takes a Policy.Parameters object as an input parameter.

A private key.

This ProtectionDomain class encapsulates the characteristics of a domain, which encloses a set of classes whose instances are granted a set of permissions when being executed on behalf of a given set of Principals.

A static set of permissions can be bound to a ProtectionDomain when it is constructed; such permissions are granted to the domain regardless of the Policy in force.

A public key.

This class centralizes all security properties and common security methods.

The target name is the name of a security configuration parameter (see below). Currently the SecurityPermission object is used to guard access to the Policy, Security, Provider, Signer, and Identity objects.

The following table lists all the possible SecurityPermission target names, and for each provides a description of what the permission allows and a discussion of the risks of granting code the permission.

Permission Target Name	What the Permission Allows	Risks of Allowing this Permission
createAccessControlContext	Creation of an AccessControlContext	This allows someone to instantiate an AccessControlContext with a DomainCombiner.
Signature.java	Class	This Signature class is used to provide applications the functionality of a digital signature algorithm.
SignatureException.java	Class	This is the generic Signature exception.
SignatureSpi.java	Class	This class defines the Service Provider Interface (SPI) for the Signature class, which is used to provide the functionality of a digital signature algorithm.
SignedObject.java	Class	SignedObject is a class for the purpose of creating authentic runtime objects whose integrity cannot be compromised without being detected. More specifically, a SignedObject contains another Serializable object, the (to-be-)signed object and its signature. The signed object is a "deep copy" (in serialized form) of an original object.
Signer.java	Class	This class is used to represent an Identity that can also digitally sign data.
Timestamp.java	Class	This class encapsulates information about a signed timestamp.
UnrecoverableEntryException.java	Class	This exception is thrown if an entry in the keystore cannot be recovered.
UnrecoverableKeyException.java	Class	This exception is thrown if a key in the keystore cannot be recovered.
UnresolvedPermission.java	Class	The UnresolvedPermission class is used to hold Permissions that were "unresolved" when the Policy was initialized.
UnresolvedPermissionCollection.java	Class	A UnresolvedPermissionCollection stores a collection of UnresolvedPermission permissions.
URIParameter.java	Class	A parameter that contains a URI pointing to data intended for a PolicySpi or ConfigurationSpi implementation.