OpenJDK 27 · javax.crypto.KeyGenerator · APIdia, the JavaDoc alternative

This class provides the functionality of a secret (symmetric) key generator.

Key generators are constructed using one of the getInstance class methods of this class.

KeyGenerator objects are reusable, i.e., after a key has been generated, the same KeyGenerator object can be re-used to generate further keys.

There are two ways to generate a key: in an algorithm-independent manner, and in an algorithm-specific manner. The only difference between the two is the initialization of the object:

Algorithm-Independent Initialization
All key generators share the concepts of a keysize and a source of randomness. There is an init method in this KeyGenerator class that takes these two universally shared types of arguments. There is also one that takes just a keysize argument, and uses the SecureRandom implementation of the highest-priority installed provider as the source of randomness (or a system-provided source of randomness if none of the installed providers supply a SecureRandom implementation), and one that takes just a source of randomness.
Since no other parameters are specified when you call the above algorithm-independent init methods, it is up to the provider what to do about the algorithm-specific parameters (if any) to be associated with each of the keys.
Algorithm-Specific Initialization
For situations where a set of algorithm-specific parameters already exists, there are two init methods that have an AlgorithmParameterSpec argument. One also has a SecureRandom argument, while the other uses the SecureRandom implementation of the highest-priority installed provider as the source of randomness (or a system-provided source of randomness if none of the installed providers supply a SecureRandom implementation).

In case the client does not explicitly initialize the KeyGenerator (via a call to an init method), each provider must supply (and document) a default initialization. See the Keysize Restriction sections of the JDK Providers document for information on the KeyGenerator defaults used by JDK providers. However, note that defaults may vary across different providers. Additionally, the default value for a provider may change in a future version. Therefore, it is recommended to explicitly initialize the KeyGenerator instead of relying on provider-specific defaults.

Every implementation of the Java platform is required to support the following standard KeyGenerator algorithms with the keysizes in parentheses:

AES (128, 256)
ChaCha20
HmacSHA1
HmacSHA256

These algorithms are described in the KeyGenerator section of the Java Security Standard Algorithm Names Specification. Consult the release documentation for your implementation to see if any other algorithms are supported.

Field Summary

Modifier and Type	Field and Description
private final String	algorithm
private static final int	I_NONE
private static final int	I_PARAMS
private static final int	I_RANDOM
private static final int	I_SIZE
private int	initKeySize
private AlgorithmParameterSpec	initParams
private SecureRandom	initRandom
private int	initType
private final Object	lock
private static final Debug	pdebug
private Provider	provider
private Iterator<Provider.Service>	serviceIterator
private static final boolean	skipDebug
private volatile KeyGeneratorSpi	spi

Constructor Summary

Access	Constructor and Description
protected	KeyGenerator(KeyGeneratorSpi the delegate keyGenSpi, Provider the provider provider, String the algorithm algorithm) Creates a `KeyGenerator` object.
private	KeyGenerator(String algorithm)

Method Summary

Modifier and Type	Method and Description
pack-priv void	disableFailover()
public final SecretKey	Returns: the new key generateKey() Generates a secret key.
public final String	Returns: the algorithm name of this `KeyGenerator` object. getAlgorithm() Returns the algorithm name of this `KeyGenerator` object.
public static final KeyGenerator	Returns: the new `KeyGenerator` object getInstance(String the standard name of the requested key algorithm. See the KeyGenerator section in the Java Security Standard Algorithm Names Specification for information about standard algorithm names. algorithm) Returns a `KeyGenerator` object that generates secret keys for the specified algorithm.
public static final KeyGenerator	Returns: the new `KeyGenerator` object getInstance(String the standard name of the requested key algorithm. See the KeyGenerator section in the Java Security Standard Algorithm Names Specification for information about standard algorithm names. algorithm, String the name of the provider. provider) Returns a `KeyGenerator` object that generates secret keys for the specified algorithm.
public static final KeyGenerator	Returns: the new `KeyGenerator` object getInstance(String the standard name of the requested key algorithm. See the KeyGenerator section in the Java Security Standard Algorithm Names Specification for information about standard algorithm names. algorithm, Provider the provider. provider) Returns a `KeyGenerator` object that generates secret keys for the specified algorithm.
public final Provider	Returns: the provider of this `KeyGenerator` object getProvider() Returns the provider of this `KeyGenerator` object.
private String	getProviderName()
public final void	init(SecureRandom the source of randomness for this generator random) Initializes this key generator.
public final void	init(AlgorithmParameterSpec the key generation parameters params) Initializes this key generator with the specified parameter set.
public final void	init(AlgorithmParameterSpec the key generation parameters params, SecureRandom the source of randomness for this key generator random) Initializes this key generator with the specified parameter set and a user-provided source of randomness.
public final void	init(int the keysize. This is an algorithm-specific metric, specified in number of bits. keysize) Initializes this key generator for a certain keysize.
public final void	init(int the keysize. This is an algorithm-specific metric, specified in number of bits. keysize, SecureRandom the source of randomness for this key generator random) Initializes this key generator for a certain keysize, using a user-provided source of randomness.
private KeyGeneratorSpi	nextSpi(KeyGeneratorSpi oldSpi, boolean reinit) Update the active spi of this class and return the next implementation for failover.

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Field Detail

algorithm	back to summary
private final String algorithm

I_NONE	back to summary
private static final int I_NONE

I_PARAMS	back to summary
private static final int I_PARAMS

I_RANDOM	back to summary
private static final int I_RANDOM

I_SIZE	back to summary
private static final int I_SIZE

initKeySize	back to summary
private int initKeySize

initParams	back to summary
private AlgorithmParameterSpec initParams

initRandom	back to summary
private SecureRandom initRandom

initType	back to summary
private int initType

lock	back to summary
private final Object lock

pdebug	back to summary
private static final Debug pdebug

provider	back to summary
private Provider provider

serviceIterator	back to summary
private Iterator<Provider.Service> serviceIterator

skipDebug	back to summary
private static final boolean skipDebug

spi	back to summary
private volatile KeyGeneratorSpi spi

Constructor Detail

KeyGenerator back to summary

KeyGenerator	back to summary
protected KeyGenerator(KeyGeneratorSpi keyGenSpi, Provider provider, String algorithm) Creates a `KeyGenerator` object. Parameters keyGenSpi:KeyGeneratorSpi the delegate provider:Provider the provider algorithm:String the algorithm

protected KeyGenerator(KeyGeneratorSpi keyGenSpi, Provider provider, String algorithm)

Creates a KeyGenerator object.

Parameters

keyGenSpi:KeyGeneratorSpi: the delegate
provider:Provider: the provider
algorithm:String: the algorithm

KeyGenerator	back to summary
private KeyGenerator(String algorithm) throws NoSuchAlgorithmException

Method Detail

disableFailover	back to summary
pack-priv void disableFailover()

generateKey	back to summary
public final SecretKey generateKey() Generates a secret key. Returns:SecretKey the new key

generateKey

back to summary

public final SecretKey generateKey()

Generates a secret key.

Returns:SecretKey: the new key

getAlgorithm back to summary

getAlgorithm	back to summary
public final String getAlgorithm() Returns the algorithm name of this `KeyGenerator` object. This is the same name that was specified in one of the `getInstance` calls that created this `KeyGenerator` object. Returns:String the algorithm name of this `KeyGenerator` object.

public final String getAlgorithm()

Returns the algorithm name of this KeyGenerator object.

This is the same name that was specified in one of the getInstance calls that created this KeyGenerator object.

Returns:String: the algorithm name of this KeyGenerator object.

getInstance back to summary

getInstance	back to summary
public static final KeyGenerator getInstance(String algorithm) throws NoSuchAlgorithmException Returns a `KeyGenerator` object that generates secret keys for the specified algorithm. This method traverses the list of registered security providers, starting with the most preferred provider. A new `KeyGenerator` object encapsulating the `KeyGeneratorSpi` implementation from the first provider that supports the specified algorithm is returned. Note that the list of registered providers may be retrieved via the `Security.getProviders()` method. Implementation Note The JDK Reference Implementation additionally uses the `jdk.security.provider.preferred` `Security` property to determine the preferred provider order for the specified algorithm. This may be different from the order of providers returned by `Security.getProviders()`. Parameters algorithm:String the standard name of the requested key algorithm. See the KeyGenerator section in the Java Security Standard Algorithm Names Specification for information about standard algorithm names. Returns:KeyGenerator the new `KeyGenerator` object Exceptions NoSuchAlgorithmException: if no `Provider` supports a `KeyGeneratorSpi` implementation for the specified algorithm NullPointerException: if `algorithm` is `null` External Specification Java Security Standard Algorithm Names See Also `java.security.Provider`

public static final KeyGenerator getInstance(String algorithm) throws NoSuchAlgorithmException

Returns a KeyGenerator object that generates secret keys for the specified algorithm.

This method traverses the list of registered security providers, starting with the most preferred provider. A new KeyGenerator object encapsulating the KeyGeneratorSpi implementation from the first provider that supports the specified algorithm is returned.

Note that the list of registered providers may be retrieved via the Security.getProviders() method.

Implementation Note

The JDK Reference Implementation additionally uses the jdk.security.provider.preferred Security property to determine the preferred provider order for the specified algorithm. This may be different from the order of providers returned by Security.getProviders().

Parameters

algorithm:String: the standard name of the requested key algorithm. See the KeyGenerator section in the Java Security Standard Algorithm Names Specification for information about standard algorithm names.

Returns:KeyGenerator

the new KeyGenerator object

Exceptions

NoSuchAlgorithmException:: if no Provider supports a KeyGeneratorSpi implementation for the specified algorithm
NullPointerException:: if algorithm is null

External Specification

Java Security Standard Algorithm Names

See Also

java.security.Provider

getInstance back to summary

getInstance	back to summary
public static final KeyGenerator getInstance(String algorithm, String provider) throws NoSuchAlgorithmException, NoSuchProviderException Returns a `KeyGenerator` object that generates secret keys for the specified algorithm. A new `KeyGenerator` object encapsulating the `KeyGeneratorSpi` implementation from the specified provider is returned. The specified provider must be registered in the security provider list. Note that the list of registered providers may be retrieved via the `Security.getProviders()` method. Parameters algorithm:String the standard name of the requested key algorithm. See the KeyGenerator section in the Java Security Standard Algorithm Names Specification for information about standard algorithm names. provider:String the name of the provider. Returns:KeyGenerator the new `KeyGenerator` object Exceptions NoSuchAlgorithmException: if a `KeyGeneratorSpi` implementation for the specified algorithm is not available from the specified provider NoSuchProviderException: if the specified provider is not registered in the security provider list IllegalArgumentException: if the `provider` is `null` or empty NullPointerException: if `algorithm` is `null` External Specification Java Security Standard Algorithm Names See Also `java.security.Provider`

public static final KeyGenerator getInstance(String algorithm, String provider) throws NoSuchAlgorithmException, NoSuchProviderException

Returns a KeyGenerator object that generates secret keys for the specified algorithm.

A new KeyGenerator object encapsulating the KeyGeneratorSpi implementation from the specified provider is returned. The specified provider must be registered in the security provider list.

Note that the list of registered providers may be retrieved via the Security.getProviders() method.

Parameters

algorithm:String: the standard name of the requested key algorithm. See the KeyGenerator section in the Java Security Standard Algorithm Names Specification for information about standard algorithm names.
provider:String: the name of the provider.

Returns:KeyGenerator

the new KeyGenerator object

Exceptions

NoSuchAlgorithmException:: if a KeyGeneratorSpi implementation for the specified algorithm is not available from the specified provider
NoSuchProviderException:: if the specified provider is not registered in the security provider list
IllegalArgumentException:: if the provider is null or empty
NullPointerException:: if algorithm is null

External Specification

Java Security Standard Algorithm Names

See Also

java.security.Provider

getInstance back to summary

getInstance	back to summary
public static final KeyGenerator getInstance(String algorithm, Provider provider) throws NoSuchAlgorithmException Returns a `KeyGenerator` object that generates secret keys for the specified algorithm. A new `KeyGenerator` object encapsulating the `KeyGeneratorSpi` implementation from the specified provider object is returned. Note that the specified provider object does not have to be registered in the provider list. Parameters algorithm:String the standard name of the requested key algorithm. See the KeyGenerator section in the Java Security Standard Algorithm Names Specification for information about standard algorithm names. provider:Provider the provider. Returns:KeyGenerator the new `KeyGenerator` object Exceptions NoSuchAlgorithmException: if a `KeyGeneratorSpi` implementation for the specified algorithm is not available from the specified `Provider` object IllegalArgumentException: if the `provider` is `null` NullPointerException: if `algorithm` is `null` External Specification Java Security Standard Algorithm Names See Also `java.security.Provider`

public static final KeyGenerator getInstance(String algorithm, Provider provider) throws NoSuchAlgorithmException

Returns a KeyGenerator object that generates secret keys for the specified algorithm.

A new KeyGenerator object encapsulating the KeyGeneratorSpi implementation from the specified provider object is returned. Note that the specified provider object does not have to be registered in the provider list.

Parameters

algorithm:String: the standard name of the requested key algorithm. See the KeyGenerator section in the Java Security Standard Algorithm Names Specification for information about standard algorithm names.
provider:Provider: the provider.

Returns:KeyGenerator

the new KeyGenerator object

Exceptions

NoSuchAlgorithmException:: if a KeyGeneratorSpi implementation for the specified algorithm is not available from the specified Provider object
IllegalArgumentException:: if the provider is null
NullPointerException:: if algorithm is null

External Specification

Java Security Standard Algorithm Names

See Also

java.security.Provider

getProvider back to summary

getProvider	back to summary
public final Provider getProvider() Returns the provider of this `KeyGenerator` object. Returns:Provider the provider of this `KeyGenerator` object

public final Provider getProvider()

Returns the provider of this KeyGenerator object.

Returns:Provider: the provider of this KeyGenerator object

getProviderName	back to summary
private String getProviderName()

init	back to summary
public final void init(SecureRandom random) Initializes this key generator. Parameters random:SecureRandom the source of randomness for this generator

init

back to summary

public final void init(SecureRandom random)

Initializes this key generator.

Parameters

random:SecureRandom: the source of randomness for this generator

init back to summary

init	back to summary
public final void init(AlgorithmParameterSpec params) throws InvalidAlgorithmParameterException Initializes this key generator with the specified parameter set. If this key generator requires any random bytes, it will get them using the `java.security.SecureRandom` implementation of the highest-priority installed provider as the source of randomness. (If none of the installed providers supply an implementation of SecureRandom, a system-provided source of randomness will be used.) Parameters params:AlgorithmParameterSpec the key generation parameters Exceptions InvalidAlgorithmParameterException: if the given parameters are inappropriate for this key generator

public final void init(AlgorithmParameterSpec params) throws InvalidAlgorithmParameterException

Initializes this key generator with the specified parameter set.

If this key generator requires any random bytes, it will get them using the java.security.SecureRandom implementation of the highest-priority installed provider as the source of randomness. (If none of the installed providers supply an implementation of SecureRandom, a system-provided source of randomness will be used.)

Parameters

params:AlgorithmParameterSpec: the key generation parameters

Exceptions

InvalidAlgorithmParameterException:: if the given parameters are inappropriate for this key generator

init back to summary

init	back to summary
public final void init(AlgorithmParameterSpec params, SecureRandom random) throws InvalidAlgorithmParameterException Initializes this key generator with the specified parameter set and a user-provided source of randomness. Parameters params:AlgorithmParameterSpec the key generation parameters random:SecureRandom the source of randomness for this key generator Exceptions InvalidAlgorithmParameterException: if `params` is inappropriate for this key generator

public final void init(AlgorithmParameterSpec params, SecureRandom random) throws InvalidAlgorithmParameterException

Initializes this key generator with the specified parameter set and a user-provided source of randomness.

Parameters

params:AlgorithmParameterSpec: the key generation parameters
random:SecureRandom: the source of randomness for this key generator

Exceptions

InvalidAlgorithmParameterException:: if params is inappropriate for this key generator

init back to summary

init	back to summary
public final void init(int keysize) Initializes this key generator for a certain keysize. If this key generator requires any random bytes, it will get them using the `java.security.SecureRandom` implementation of the highest-priority installed provider as the source of randomness. (If none of the installed providers supply an implementation of SecureRandom, a system-provided source of randomness will be used.) Parameters keysize:int the keysize. This is an algorithm-specific metric, specified in number of bits. Exceptions InvalidParameterException: if the keysize is wrong or not supported.

public final void init(int keysize)

Initializes this key generator for a certain keysize.

Parameters

keysize:int: the keysize. This is an algorithm-specific metric, specified in number of bits.

Exceptions

InvalidParameterException:: if the keysize is wrong or not supported.

init	back to summary
public final void init(int keysize, SecureRandom random) Initializes this key generator for a certain keysize, using a user-provided source of randomness. Parameters keysize:int the keysize. This is an algorithm-specific metric, specified in number of bits. random:SecureRandom the source of randomness for this key generator Exceptions InvalidParameterException: if the keysize is wrong or not supported.

init

back to summary

public final void init(int keysize, SecureRandom random)

Initializes this key generator for a certain keysize, using a user-provided source of randomness.

Parameters

keysize:int: the keysize. This is an algorithm-specific metric, specified in number of bits.
random:SecureRandom: the source of randomness for this key generator

Exceptions

InvalidParameterException:: if the keysize is wrong or not supported.

nextSpi	back to summary
private KeyGeneratorSpi nextSpi(KeyGeneratorSpi oldSpi, boolean reinit) Update the active spi of this class and return the next implementation for failover. If no more implementations are available, this method returns `null`. However, the active spi of this class is never set to `null`.

public Class KeyGenerator

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail