APIdia Launch Partner
Top Description Inners Fields Constructors Methods
com.sun.crypto.provider

public final Class JceKeyStore

extends KeyStoreSpi
Class Inheritance
Imports
sun.security.util.Debug, .IOUtils, java.io.*, java.time.Instant, java.time.temporal.ChronoUnit, java.util.*, java.security.DigestInputStream, .DigestOutputStream, .MessageDigest, .NoSuchAlgorithmException, .Key, .PrivateKey, .KeyStoreSpi, .KeyStoreException, .UnrecoverableKeyException, java.security.cert.Certificate, .CertificateFactory, .CertificateException, javax.crypto.SealedObject
This class provides the keystore implementation referred to as "jceks". This implementation strongly protects the keystore private keys using triple-DES, where the triple-DES encryption/decryption key is derived from the user's password. The encrypted private keys are stored in the keystore in a standard format, namely the EncryptedPrivateKeyInfo format defined in PKCS #8.
Author
Jan Luehe
See Also
java.security.KeyStoreSpi

Nested and Inner Type Summary

Modifier and TypeClass and Description
private static class
JceKeyStore.DeserializationChecker

private static class
JceKeyStore.PrivateKeyEntry

private static class
JceKeyStore.SecretKeyEntry

private static class
JceKeyStore.TrustedCertEntry

Field Summary

Modifier and TypeField and Description
private static final Debug
debug

private final Hashtable<String, Object>
entries

Private keys and certificates are stored in a hashtable.

private static final int
JCEKS_MAGIC

private static final int
JKS_MAGIC

private static final int
VERSION_1

private static final int
VERSION_2

Constructor Summary

AccessConstructor and Description
public
JceKeyStore()

Method Summary

Modifier and TypeMethod and Description
private void
emitWeakKeyStoreWarning()

public Enumeration<String>

Returns:

enumeration of the alias names
engineAliases()

Implements abstract java.security.KeyStoreSpi.engineAliases.

Lists all the alias names of this keystore.

public boolean

Returns:

true if the alias exists, false otherwise
engineContainsAlias(String
the alias name
alias)

Implements abstract java.security.KeyStoreSpi.engineContainsAlias.

Checks if the given alias exists in this keystore.

public void
engineDeleteEntry(String
the alias name
alias)

Implements abstract java.security.KeyStoreSpi.engineDeleteEntry.

Deletes the entry identified by the given alias from this keystore.

public Certificate

Returns:

the certificate, or null if the given alias does not exist or does not contain a certificate.
engineGetCertificate(String
the alias name
alias)

Implements abstract java.security.KeyStoreSpi.engineGetCertificate.

Returns the certificate associated with the given alias.

public String

Returns:

the (alias) name of the first entry with matching certificate, or null if no such entry exists in this keystore.
engineGetCertificateAlias(Certificate
the certificate to match with.
cert)

Implements abstract java.security.KeyStoreSpi.engineGetCertificateAlias.

Returns the (alias) name of the first keystore entry whose certificate matches the given certificate.

public Certificate[]

Returns:

the certificate chain (ordered with the user's certificate first and the root certificate authority last), or null if the given alias does not exist or does not contain a certificate chain (i.e., the given alias identifies either a trusted certificate entry or a key entry without a certificate chain).
engineGetCertificateChain(String
the alias name
alias)

Implements abstract java.security.KeyStoreSpi.engineGetCertificateChain.

Returns the certificate chain associated with the given alias.

public Date

Returns:

the creation date of this entry, or null if the given alias does not exist
engineGetCreationDate(String
the alias name
alias)

Implements abstract java.security.KeyStoreSpi.engineGetCreationDate.

Returns the creation date of the entry identified by the given alias.

public Instant

Returns:

the instant that the entry identified by the given alias was created, or null if the given alias does not exist
engineGetCreationInstant(String
the alias name
alias)

Overrides java.security.KeyStoreSpi.engineGetCreationInstant.

Returns the instant that the entry identified by the given alias was created.

public Key

Returns:

the requested key, or null if the given alias does not exist or does not identify a key entry.
engineGetKey(String
the alias name
alias, char[]
the password for recovering the key
password)

Implements abstract java.security.KeyStoreSpi.engineGetKey.

Returns the key associated with the given alias, using the given password to recover it.

public boolean

Returns:

true if the entry identified by the given alias is a trusted certificate entry, false otherwise.
engineIsCertificateEntry(String alias)

Implements abstract java.security.KeyStoreSpi.engineIsCertificateEntry.

Returns true if the entry identified by the given alias is a trusted certificate entry, and false otherwise.

public boolean

Returns:

true if the entry identified by the given alias is a key entry, false otherwise.
engineIsKeyEntry(String alias)

Implements abstract java.security.KeyStoreSpi.engineIsKeyEntry.

Returns true if the entry identified by the given alias is a key entry, and false otherwise.

public void
engineLoad(InputStream
the input stream from which the keystore is loaded
stream, char[]
the (optional) password used to check the integrity of the keystore.
password)

Implements abstract java.security.KeyStoreSpi.engineLoad.

Loads the keystore from the given input stream.

public boolean
engineProbe(InputStream stream)

Overrides java.security.KeyStoreSpi.engineProbe.

Probe the first few bytes of the keystore data stream for a valid JCEKS keystore encoding.

public void
engineSetCertificateEntry(String
the alias name
alias, Certificate
the certificate
cert)

Implements abstract java.security.KeyStoreSpi.engineSetCertificateEntry.

Assigns the given certificate to the given alias.

public void
engineSetKeyEntry(String
the alias name
alias, Key
the key to be associated with the alias
key, char[]
the password to protect the key
password, Certificate[]
the certificate chain for the corresponding public key (only required if the given key is of type java.security.PrivateKey).
chain)

Implements abstract java.security.KeyStoreSpi.engineSetKeyEntry.

Assigns the given key to the given alias, protecting it with the given password.

public void
engineSetKeyEntry(String
the alias name
alias, byte[]
the key (in protected format) to be associated with the alias
key, Certificate[]
the certificate chain for the corresponding public key (only useful if the protected key is of type java.security.PrivateKey).
chain)

Implements abstract java.security.KeyStoreSpi.engineSetKeyEntry.

Assigns the given key (that has already been protected) to the given alias.

public int

Returns:

the number of entries in this keystore
engineSize()

Implements abstract java.security.KeyStoreSpi.engineSize.

Retrieves the number of entries in this keystore.

public void
engineStore(OutputStream
the output stream to which this keystore is written.
stream, char[]
the password to generate the keystore integrity check
password)

Implements abstract java.security.KeyStoreSpi.engineStore.

Stores this keystore to the given output stream, and protects its integrity with the given password.

private MessageDigest
getPreKeyedHash(char[] password)

To guard against tampering with the keystore, we append a keyed hash with a bit of extra data.

Inherited from java.security.KeyStoreSpi:
engineEntryInstanceOfengineGetAttributesengineGetEntryengineLoadengineSetEntryengineStore

Field Detail

debugback to summary
private static final Debug debug
entriesback to summary
private final Hashtable<String, Object> entries

Private keys and certificates are stored in a hashtable. Hash entries are keyed by alias names.

JCEKS_MAGICback to summary
private static final int JCEKS_MAGIC
JKS_MAGICback to summary
private static final int JKS_MAGIC
VERSION_1back to summary
private static final int VERSION_1
VERSION_2back to summary
private static final int VERSION_2

Constructor Detail

JceKeyStoreback to summary
public JceKeyStore()

Method Detail

emitWeakKeyStoreWarningback to summary
private void emitWeakKeyStoreWarning()
engineAliasesback to summary
public Enumeration<String> engineAliases()

Implements abstract java.security.KeyStoreSpi.engineAliases.

Lists all the alias names of this keystore.

Returns:Enumeration<String>

enumeration of the alias names

engineContainsAliasback to summary
public boolean engineContainsAlias(String alias)

Implements abstract java.security.KeyStoreSpi.engineContainsAlias.

Checks if the given alias exists in this keystore.

Parameters
alias:String

the alias name

Returns:boolean

true if the alias exists, false otherwise

engineDeleteEntryback to summary
public void engineDeleteEntry(String alias) throws KeyStoreException

Implements abstract java.security.KeyStoreSpi.engineDeleteEntry.

Deletes the entry identified by the given alias from this keystore.

Parameters
alias:String

the alias name

Exceptions
KeyStoreException:
if the entry cannot be removed.
engineGetCertificateback to summary
public Certificate engineGetCertificate(String alias)

Implements abstract java.security.KeyStoreSpi.engineGetCertificate.

Returns the certificate associated with the given alias.

If the given alias name identifies a trusted certificate entry, the certificate associated with that entry is returned. If the given alias name identifies a key entry, the first element of the certificate chain of that entry is returned, or null if that entry does not have a certificate chain.

Parameters
alias:String

the alias name

Returns:Certificate

the certificate, or null if the given alias does not exist or does not contain a certificate.

engineGetCertificateAliasback to summary
public String engineGetCertificateAlias(Certificate cert)

Implements abstract java.security.KeyStoreSpi.engineGetCertificateAlias.

Returns the (alias) name of the first keystore entry whose certificate matches the given certificate.

This method attempts to match the given certificate with each keystore entry. If the entry being considered is a trusted certificate entry, the given certificate is compared to that entry's certificate. If the entry being considered is a key entry, the given certificate is compared to the first element of that entry's certificate chain (if a chain exists).

Parameters
cert:Certificate

the certificate to match with.

Returns:String

the (alias) name of the first entry with matching certificate, or null if no such entry exists in this keystore.

engineGetCertificateChainback to summary
public Certificate[] engineGetCertificateChain(String alias)

Implements abstract java.security.KeyStoreSpi.engineGetCertificateChain.

Returns the certificate chain associated with the given alias.

Parameters
alias:String

the alias name

Returns:Certificate[]

the certificate chain (ordered with the user's certificate first and the root certificate authority last), or null if the given alias does not exist or does not contain a certificate chain (i.e., the given alias identifies either a trusted certificate entry or a key entry without a certificate chain).

engineGetCreationDateback to summary
public Date engineGetCreationDate(String alias)

Implements abstract java.security.KeyStoreSpi.engineGetCreationDate.

Returns the creation date of the entry identified by the given alias.

Parameters
alias:String

the alias name

Returns:Date

the creation date of this entry, or null if the given alias does not exist

engineGetCreationInstantback to summary
public Instant engineGetCreationInstant(String alias)

Overrides java.security.KeyStoreSpi.engineGetCreationInstant.

Returns the instant that the entry identified by the given alias was created.

Parameters
alias:String

the alias name

Returns:Instant

the instant that the entry identified by the given alias was created, or null if the given alias does not exist

Since
27
engineGetKeyback to summary
public Key engineGetKey(String alias, char[] password) throws NoSuchAlgorithmException, UnrecoverableKeyException

Implements abstract java.security.KeyStoreSpi.engineGetKey.

Returns the key associated with the given alias, using the given password to recover it.

Parameters
alias:String

the alias name

password:char[]

the password for recovering the key

Returns:Key

the requested key, or null if the given alias does not exist or does not identify a key entry.

Exceptions
NoSuchAlgorithmException:
if the algorithm for recovering the key cannot be found
UnrecoverableKeyException:
if the key cannot be recovered (e.g., the given password is wrong).
engineIsCertificateEntryback to summary
public boolean engineIsCertificateEntry(String alias)

Implements abstract java.security.KeyStoreSpi.engineIsCertificateEntry.

Returns true if the entry identified by the given alias is a trusted certificate entry, and false otherwise.

Returns:boolean

true if the entry identified by the given alias is a trusted certificate entry, false otherwise.

engineIsKeyEntryback to summary
public boolean engineIsKeyEntry(String alias)

Implements abstract java.security.KeyStoreSpi.engineIsKeyEntry.

Returns true if the entry identified by the given alias is a key entry, and false otherwise.

Returns:boolean

true if the entry identified by the given alias is a key entry, false otherwise.

engineLoadback to summary
public void engineLoad(InputStream stream, char[] password) throws IOException, NoSuchAlgorithmException, CertificateException

Implements abstract java.security.KeyStoreSpi.engineLoad.

Loads the keystore from the given input stream.

If a password is given, it is used to check the integrity of the keystore data. Otherwise, the integrity of the keystore is not checked.

Parameters
stream:InputStream

the input stream from which the keystore is loaded

password:char[]

the (optional) password used to check the integrity of the keystore.

Exceptions
IOException:
if there is an I/O or format problem with the keystore data
NoSuchAlgorithmException:
if the algorithm used to check the integrity of the keystore cannot be found
CertificateException:
if any of the certificates in the keystore could not be loaded
engineProbeback to summary
public boolean engineProbe(InputStream stream) throws IOException

Overrides java.security.KeyStoreSpi.engineProbe.

Probe the first few bytes of the keystore data stream for a valid JCEKS keystore encoding.

Annotations
@Override
Exceptions
IOException:

Doc from java.security.KeyStoreSpi.engineProbe.

if there is an I/O problem with the keystore data.

engineSetCertificateEntryback to summary
public void engineSetCertificateEntry(String alias, Certificate cert) throws KeyStoreException

Implements abstract java.security.KeyStoreSpi.engineSetCertificateEntry.

Assigns the given certificate to the given alias.

If the given alias already exists in this keystore and identifies a trusted certificate entry, the certificate associated with it is overridden by the given certificate.

Parameters
alias:String

the alias name

cert:Certificate

the certificate

Exceptions
KeyStoreException:
if the given alias already exists and does not identify a trusted certificate entry, or this operation fails for some other reason.
engineSetKeyEntryback to summary
public void engineSetKeyEntry(String alias, Key key, char[] password, Certificate[] chain) throws KeyStoreException

Implements abstract java.security.KeyStoreSpi.engineSetKeyEntry.

Assigns the given key to the given alias, protecting it with the given password.

If the given key is of type java.security.PrivateKey, it must be accompanied by a certificate chain certifying the corresponding public key.

If the given alias already exists, the keystore information associated with it is overridden by the given key (and possibly certificate chain).

Parameters
alias:String

the alias name

key:Key

the key to be associated with the alias

password:char[]

the password to protect the key

chain:Certificate[]

the certificate chain for the corresponding public key (only required if the given key is of type java.security.PrivateKey).

Exceptions
KeyStoreException:
if the given key cannot be protected, or this operation fails for some other reason
engineSetKeyEntryback to summary
public void engineSetKeyEntry(String alias, byte[] key, Certificate[] chain) throws KeyStoreException

Implements abstract java.security.KeyStoreSpi.engineSetKeyEntry.

Assigns the given key (that has already been protected) to the given alias.

If the protected key is of type java.security.PrivateKey, it must be accompanied by a certificate chain certifying the corresponding public key.

If the given alias already exists, the keystore information associated with it is overridden by the given key (and possibly certificate chain).

Parameters
alias:String

the alias name

key:byte[]

the key (in protected format) to be associated with the alias

chain:Certificate[]

the certificate chain for the corresponding public key (only useful if the protected key is of type java.security.PrivateKey).

Exceptions
KeyStoreException:
if this operation fails.
engineSizeback to summary
public int engineSize()

Implements abstract java.security.KeyStoreSpi.engineSize.

Retrieves the number of entries in this keystore.

Returns:int

the number of entries in this keystore

engineStoreback to summary
public void engineStore(OutputStream stream, char[] password) throws IOException, NoSuchAlgorithmException, CertificateException

Implements abstract java.security.KeyStoreSpi.engineStore.

Stores this keystore to the given output stream, and protects its integrity with the given password.

Parameters
stream:OutputStream

the output stream to which this keystore is written.

password:char[]

the password to generate the keystore integrity check

Exceptions
IOException:
if there was an I/O problem with data
NoSuchAlgorithmException:
if the appropriate data integrity algorithm could not be found
CertificateException:
if any of the certificates included in the keystore data could not be stored
getPreKeyedHashback to summary
private MessageDigest getPreKeyedHash(char[] password) throws NoSuchAlgorithmException

To guard against tampering with the keystore, we append a keyed hash with a bit of extra data.

com.sun.crypto.provider back to summary

private Class JceKeyStore.DeserializationChecker

extends Object
implements ObjectInputFilter
Class Inheritance
All Implemented Interfaces
java.io.ObjectInputFilter

Field Summary

Modifier and TypeField and Description
private final int
fullLength

Constructor Summary

AccessConstructor and Description
public
DeserializationChecker(int fullLength)

Method Summary

Modifier and TypeMethod and Description
public ObjectInputFilter.Status
checkInput(ObjectInputFilter.FilterInfo info)

Implements java.io.ObjectInputFilter.checkInput.

Check the class, array length, number of object references, depth, stream size, and other available filtering information.

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

fullLengthback to summary
private final int fullLength

Constructor Detail

DeserializationCheckerback to summary
public DeserializationChecker(int fullLength)

Method Detail

checkInputback to summary
public ObjectInputFilter.Status checkInput(ObjectInputFilter.FilterInfo info)

Implements java.io.ObjectInputFilter.checkInput.

Doc from java.io.ObjectInputFilter.checkInput.

Check the class, array length, number of object references, depth, stream size, and other available filtering information. Implementations of this method check the contents of the object graph being created during deserialization. The filter returns Status.ALLOWED, Status.REJECTED, or Status.UNDECIDED.

If filterInfo.serialClass() is non-null, there is a class to be checked. If serialClass() is null, there is no class and the info contains only metrics related to the depth of the graph being deserialized, the number of references, and the size of the stream read.

Annotations
@Override
com.sun.crypto.provider back to summary

private final Class JceKeyStore.PrivateKeyEntry

extends Object
Class Inheritance

Field Summary

Modifier and TypeField and Description
pack-priv Certificate[]
chain

pack-priv Instant
date

pack-priv byte[]
protectedKey

Constructor Summary

AccessConstructor and Description
private
PrivateKeyEntry()

Method Summary

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

chainback to summary
pack-priv Certificate[] chain
dateback to summary
pack-priv Instant date
protectedKeyback to summary
pack-priv byte[] protectedKey

Constructor Detail

PrivateKeyEntryback to summary
private PrivateKeyEntry()
com.sun.crypto.provider back to summary

private final Class JceKeyStore.SecretKeyEntry

extends Object
Class Inheritance

Field Summary

Modifier and TypeField and Description
pack-priv Instant
date

pack-priv int
maxLength

pack-priv SealedObject
sealedKey

Constructor Summary

AccessConstructor and Description
private
SecretKeyEntry()

Method Summary

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

dateback to summary
pack-priv Instant date
maxLengthback to summary
pack-priv int maxLength
sealedKeyback to summary
pack-priv SealedObject sealedKey

Constructor Detail

SecretKeyEntryback to summary
private SecretKeyEntry()
com.sun.crypto.provider back to summary

private final Class JceKeyStore.TrustedCertEntry

extends Object
Class Inheritance

Field Summary

Modifier and TypeField and Description
pack-priv Certificate
cert

pack-priv Instant
date

Constructor Summary

AccessConstructor and Description
private
TrustedCertEntry()

Method Summary

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

certback to summary
pack-priv Certificate cert
dateback to summary
pack-priv Instant date

Constructor Detail

TrustedCertEntryback to summary
private TrustedCertEntry()