public final Class SecurityUtils

Bouncy Castle SecurityProviderRegistrar name.

System property used to control whether Elliptic Curves are supported or not. If not set then the support is auto-detected

EDDSA support - should match EdDSAKey.KEY_ALGORITHM

System property used to decide whether EDDSA curves are supported or not (in addition or even in spite of isEDDSACurveSupported()). If not set or set to true, then the existence of the optional support classes determines the support.

A boolean system property that can be set to "true" to enable FIPS mode. In FIPS mode, crypto-algorithms not approved in FIPS-140 will not be available.

System property used to configure the value for the maximum supported Diffie-Hellman Group Exchange key size. If not set, then an internal auto-discovery mechanism is employed. If set to negative value then Diffie-Hellman Group Exchange is disabled. If set to a negative value then Diffie-Hellman Group Exchange is disabled

The min. key size value used for testing whether Diffie-Hellman Group Exchange is supported or not. According to RFC 4419 section 3: "Servers and clients SHOULD support groups with a modulus length of k bits, where 1024 <= k <= 8192". Note: this has been amended by RFC 8270

System property used to configure the value for the minimum supported Diffie-Hellman Group Exchange key size. If not set, then an internal auto-discovery mechanism is employed. If set to negative value then Diffie-Hellman Group Exchange is disabled. If set to a negative value then Diffie-Hellman Group Exchange is disabled

System property used to control whether to automatically register the Bouncyastle JCE provider

Comma separated list of fully qualified SecurityProviderRegistrars to automatically register

Returns:Set<String>

A copy if the current a-priori disabled providers names

Returns:int

The maximum supported Diffie-Hellman Group Exchange key size, or non-positive if not supported

Returns:int

The minimum supported Diffie-Hellman Group Exchange key size, or non-positive if not supported

Returns:RandomFactory

If isBouncyCastleRegistered() then a BouncyCastleRandomFactory instance, otherwise a JceRandomFactory one

Returns:Set<String>

A copy of the currently registered security providers

Parameters

name:String

The provider's name - never null/empty

Returns:boolean

true if the provider is marked as disabled a-priori

See Also

setAPrioriDisabledProvider(String, boolean)

Returns:boolean

true if Diffie-Hellman Group Exchange is supported

See Also

getMinDHGroupExchangeKeySize(), getMaxDHGroupExchangeKeySize()

Parameters

keySize:int

The expected key size

Returns:boolean

true if Oakely Diffie-Hellman Group Exchange is supported for the specified key size

See Also

isDHGroupExchangeSupported(), getMaxDHGroupExchangeKeySize()

Returns:boolean

true if Elliptic Curve Cryptography is supported

See Also

ECC_SUPPORTED_PROP

Returns:boolean

true if EDDSA curves (e.g., ed25519) are supported

Tells whether FIPS mode is enabled, either through the system property FIPS_ENABLED or via setFipsMode().

Returns:boolean

true if FIPS mode is enabled, false otherwise.

Parameters

session:SessionContext

The SessionContext for invoking this load command - may be null if not invoked within a session context (e.g., offline tool).

resourceKey:NamedResource

An identifier of the key being loaded - used as argument to the FilePasswordProvider#getPassword invocation

inputStream:InputStream

The InputStream for the private key

provider:FilePasswordProvider

A FilePasswordProvider - may be null if the loaded key is guaranteed not to be encrypted

Returns:Iterable<KeyPair>

The loaded KeyPair-s - or null if none loaded

Exceptions

IOException:

If failed to read/parse the input stream

GeneralSecurityException:

If failed to generate the keys

Parameters

registrar:SecurityProviderRegistrar

The registrar instance to register

Returns:SecurityProviderRegistrar

The registered instance - may be different than required if already registered. Returns null if not already registered and not enabled or not supported registrar.

Annotations

@SuppressWarnings:unchecked

Marks a provider's registrar as "a-priori" programatically so that when its SecurityProviderRegistrar#isEnabled() is eventually consulted it will return false regardless of the configured value for the specific provider registrar instance

Parameters

name:String

The provider's name - never null/empty

disabled:boolean

true whether to disable it a-priori

See Also

isAPrioriDisabledProvider(String)

Unconditionally set FIPS mode, overriding the FIPS_ENABLED system property.

Exceptions

IllegalStateException:

if a call to isFipsMode() had already occurred and returned false.

Parameters

parser:KeyPairResourceParser

The system-wide KeyPairResourceParser to use. If set to null, then the default parser will be re-constructed on next call to getKeyPairResourceParser()

Set programmatically the reported value for getMaxDHGroupExchangeKeySize()

Parameters

keySize:int

The reported key size - if zero, then it will be auto-detected, if negative then DH group exchange will be disabled

Set programmatically the reported value for getMinDHGroupExchangeKeySize()

Parameters

keySize:int

The reported key size - if zero, then it will be auto-detected, if negative then DH group exchange will be disabled