Top Description Inners Fields Constructors Methods
org.bouncycastle.jcajce.provider

pack-priv Class ProvJKS

extends AlgorithmProvider
Class Inheritance
Imports
java.io.ByteArrayInputStream, .DataInputStream, .IOException, .InputStream, .OutputStream, java.security.Key, .KeyStore, .KeyStoreException, .KeyStoreSpi, .NoSuchAlgorithmException, .UnrecoverableKeyException, java.security.cert.Certificate, .CertificateException, .CertificateFactory, java.util.Date, .Enumeration, .Hashtable, .Iterator, .Map, org.bouncycastle.crypto.CryptoServicesRegistrar, org.bouncycastle.crypto.fips.FipsOutputDigestCalculator, .FipsSHS, org.bouncycastle.jcajce.BCLoadStoreParameter, org.bouncycastle.util.Arrays, .Strings, org.bouncycastle.util.io.Streams
Reads a certificate only key store.

Nested and Inner Type Summary

Modifier and TypeClass and Description
private static class
ProvJKS.BCJKSTrustedCertEntry

BCJKSTrustedCertEntry is a internal container for the certificate entry.

private static class
ProvJKS.ErasableByteStream

pack-priv static class
ProvJKS.JKSKeyStoreSpi

Field Summary

Modifier and TypeField and Description
private static final String
PREFIX

Constructor Summary

AccessConstructor and Description
pack-priv
ProvJKS()

Method Summary

Modifier and TypeMethod and Description
pack-priv void
configure(final BouncyCastleFipsProvider provider)

Implements abstract org.bouncycastle.jcajce.provider.AlgorithmProvider.configure.

Field Detail

PREFIXback to summary
private static final String PREFIX

Constructor Detail

ProvJKSback to summary
pack-priv ProvJKS()

Method Detail

configureback to summary
pack-priv void configure(final BouncyCastleFipsProvider provider)

Implements abstract org.bouncycastle.jcajce.provider.AlgorithmProvider.configure.

org.bouncycastle.jcajce.provider back to summary

private final Class ProvJKS.BCJKSTrustedCertEntry

extends Object
Class Inheritance
  • java.lang.Object
  • org.bouncycastle.jcajce.provider.ProvJKS.BCJKSTrustedCertEntry
BCJKSTrustedCertEntry is a internal container for the certificate entry.

Field Summary

Modifier and TypeField and Description
pack-priv final Certificate
cert

pack-priv final Date
date

Constructor Summary

AccessConstructor and Description
public
BCJKSTrustedCertEntry(Date date, Certificate cert)

Method Summary

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

certback to summary
pack-priv final Certificate cert
dateback to summary
pack-priv final Date date

Constructor Detail

BCJKSTrustedCertEntryback to summary
public BCJKSTrustedCertEntry(Date date, Certificate cert)
org.bouncycastle.jcajce.provider back to summary

private final Class ProvJKS.ErasableByteStream

extends ByteArrayInputStream
Class Inheritance

Field Summary

Inherited from java.io.ByteArrayInputStream:
bufcountmarkpos

Constructor Summary

AccessConstructor and Description
public
ErasableByteStream(byte[] buf, int offSet, int length)

Method Summary

Modifier and TypeMethod and Description
public void
erase()

Inherited from java.io.ByteArrayInputStream:
availableclosemarkmarkSupportedreadreadreadAllBytesreadNBytesresetskiptransferTo

Constructor Detail

ErasableByteStreamback to summary
public ErasableByteStream(byte[] buf, int offSet, int length)

Method Detail

eraseback to summary
public void erase()
org.bouncycastle.jcajce.provider back to summary

pack-priv Class ProvJKS.JKSKeyStoreSpi

extends KeyStoreSpi
Class Inheritance

Field Summary

Modifier and TypeField and Description
private final Hashtable<String, ProvJKS.BCJKSTrustedCertEntry>
certificateEntries

private final BouncyCastleFipsProvider
fipsProvider

private final boolean
matchOnProbe

private static final String
NOT_IMPLEMENTED_MESSAGE

Constructor Summary

AccessConstructor and Description
public
JKSKeyStoreSpi(boolean matchOnProbe, BouncyCastleFipsProvider provider)

Method Summary

Modifier and TypeMethod and Description
private void
addPassword(OutputStream
The digest instance.
digestStream, char[]
The password.
password)

Process password updates the digest with the password.

private CertificateFactory
createCertFactory(String certFormat)

public Enumeration<String>
engineAliases()

Implements abstract java.security.KeyStoreSpi.engineAliases.

Lists all the alias names of this keystore.
public boolean
engineContainsAlias(String
the alias name
alias)

Implements abstract java.security.KeyStoreSpi.engineContainsAlias.

Checks if the given alias exists in this keystore.
public void
engineDeleteEntry(String
the alias name
alias)

Implements abstract java.security.KeyStoreSpi.engineDeleteEntry.

Deletes the entry identified by the given alias from this keystore.
public Certificate
engineGetCertificate(String
the alias name
alias)

Implements abstract java.security.KeyStoreSpi.engineGetCertificate.

Returns the certificate associated with the given alias.
public String
engineGetCertificateAlias(Certificate
the certificate to match with.
cert)

Implements abstract java.security.KeyStoreSpi.engineGetCertificateAlias.

Returns the (alias) name of the first keystore entry whose certificate matches the given certificate.
public Certificate[]
engineGetCertificateChain(String
the alias name
alias)

Implements abstract java.security.KeyStoreSpi.engineGetCertificateChain.

Returns the certificate chain associated with the given alias.
public Date
engineGetCreationDate(String
the alias name
alias)

Implements abstract java.security.KeyStoreSpi.engineGetCreationDate.

Returns the creation date of the entry identified by the given alias.
public Key
engineGetKey(String
the alias name
alias, char[]
the password for recovering the key
password)

Implements abstract java.security.KeyStoreSpi.engineGetKey.

Returns the key associated with the given alias, using the given password to recover it.
public boolean
engineIsCertificateEntry(String
the alias for the keystore entry to be checked
alias)

Implements abstract java.security.KeyStoreSpi.engineIsCertificateEntry.

Returns true if the entry identified by the given alias was created by a call to setCertificateEntry, or created by a call to setEntry with a TrustedCertificateEntry.
public boolean
engineIsKeyEntry(String
the alias for the keystore entry to be checked
alias)

Implements abstract java.security.KeyStoreSpi.engineIsKeyEntry.

Returns true if the entry identified by the given alias was created by a call to setKeyEntry, or created by a call to setEntry with a PrivateKeyEntry or a SecretKeyEntry.
public void
engineLoad(KeyStore.LoadStoreParameter
the KeyStore.LoadStoreParameter that specifies how to load the keystore, which may be null
loadStoreParameter)

Overrides java.security.KeyStoreSpi.engineLoad.

Loads the keystore using the given KeyStore.LoadStoreParameter.
public void
engineLoad(InputStream
the input stream from which the keystore is loaded, or null
stream, char[]
the password used to check the integrity of the keystore, the password used to unlock the keystore, or null
password)

Implements abstract java.security.KeyStoreSpi.engineLoad.

Loads the keystore from the given input stream.
public boolean
engineProbe(InputStream
the keystore data to be probed
stream)

Overrides java.security.KeyStoreSpi.engineProbe.

Probes the specified input stream to determine whether it contains a keystore that is supported by this implementation, or not.
public void
engineSetCertificateEntry(String
the alias name
alias, Certificate
the certificate
cert)

Implements abstract java.security.KeyStoreSpi.engineSetCertificateEntry.

Assigns the given certificate to the given alias.
public void
engineSetKeyEntry(String
the alias name
alias, Key
the key to be associated with the alias
key, char[]
the password to protect the key
password, Certificate[]
the certificate chain for the corresponding public key (only required if the given key is of type java.security.PrivateKey).
chain)

Implements abstract java.security.KeyStoreSpi.engineSetKeyEntry.

Assigns the given key to the given alias, protecting it with the given password.
public void
engineSetKeyEntry(String
the alias name
alias, byte[]
the key (in protected format) to be associated with the alias
key, Certificate[]
the certificate chain for the corresponding public key (only useful if the protected key is of type java.security.PrivateKey).
chain)

Implements abstract java.security.KeyStoreSpi.engineSetKeyEntry.

Assigns the given key (that has already been protected) to the given alias.
public int
engineSize()

Implements abstract java.security.KeyStoreSpi.engineSize.

Retrieves the number of entries in this keystore.
public void
engineStore(OutputStream
the output stream to which this keystore is written.
stream, char[]
the password to generate the keystore integrity check. May be null if the keystore does not support or require an integrity check.
password)

Implements abstract java.security.KeyStoreSpi.engineStore.

Stores this keystore to the given output stream, and protects its integrity with the given password.
private ProvJKS.ErasableByteStream

Returns:

Either the passed in input stream or a new input stream.
validateStream(InputStream
The input stream.
inputStream, char[]
the password.
password)

Validate password takes the checksum of the store and will either.

Inherited from java.security.KeyStoreSpi:
engineEntryInstanceOfengineGetAttributesengineGetEntryengineSetEntryengineStore

Field Detail

certificateEntriesback to summary
private final Hashtable<String, ProvJKS.BCJKSTrustedCertEntry> certificateEntries
fipsProviderback to summary
private final BouncyCastleFipsProvider fipsProvider
matchOnProbeback to summary
private final boolean matchOnProbe
NOT_IMPLEMENTED_MESSAGEback to summary
private static final String NOT_IMPLEMENTED_MESSAGE

Constructor Detail

JKSKeyStoreSpiback to summary
public JKSKeyStoreSpi(boolean matchOnProbe, BouncyCastleFipsProvider provider)

Method Detail

addPasswordback to summary
private void addPassword(OutputStream digestStream, char[] password) throws IOException

Process password updates the digest with the password.

Parameters
digestStream:OutputStream

The digest instance.

password:char[]

The password.

createCertFactoryback to summary
private CertificateFactory createCertFactory(String certFormat) throws CertificateException
engineAliasesback to summary
public Enumeration<String> engineAliases()

Implements abstract java.security.KeyStoreSpi.engineAliases.

Doc from java.security.KeyStoreSpi.engineAliases.

Lists all the alias names of this keystore.

Returns:Enumeration<String>

enumeration of the alias names

engineContainsAliasback to summary
public boolean engineContainsAlias(String alias)

Implements abstract java.security.KeyStoreSpi.engineContainsAlias.

Doc from java.security.KeyStoreSpi.engineContainsAlias.

Checks if the given alias exists in this keystore.

Parameters
alias:String

the alias name

Returns:boolean

true if the alias exists, false otherwise

engineDeleteEntryback to summary
public void engineDeleteEntry(String alias) throws KeyStoreException

Implements abstract java.security.KeyStoreSpi.engineDeleteEntry.

Doc from java.security.KeyStoreSpi.engineDeleteEntry.

Deletes the entry identified by the given alias from this keystore.

Parameters
alias:String

the alias name

Exceptions
KeyStoreException:
if the entry cannot be removed.
engineGetCertificateback to summary
public Certificate engineGetCertificate(String alias)

Implements abstract java.security.KeyStoreSpi.engineGetCertificate.

Doc from java.security.KeyStoreSpi.engineGetCertificate.

Returns the certificate associated with the given alias.

If the given alias name identifies an entry created by a call to setCertificateEntry, or created by a call to setEntry with a TrustedCertificateEntry, then the trusted certificate contained in that entry is returned.

If the given alias name identifies an entry created by a call to setKeyEntry, or created by a call to setEntry with a PrivateKeyEntry, then the first element of the certificate chain in that entry (if a chain exists) is returned.

Parameters
alias:String

the alias name

Returns:Certificate

the certificate, or null if the given alias does not exist or does not contain a certificate.

engineGetCertificateAliasback to summary
public String engineGetCertificateAlias(Certificate cert)

Implements abstract java.security.KeyStoreSpi.engineGetCertificateAlias.

Doc from java.security.KeyStoreSpi.engineGetCertificateAlias.

Returns the (alias) name of the first keystore entry whose certificate matches the given certificate.

This method attempts to match the given certificate with each keystore entry. If the entry being considered was created by a call to setCertificateEntry, or created by a call to setEntry with a TrustedCertificateEntry, then the given certificate is compared to that entry's certificate.

If the entry being considered was created by a call to setKeyEntry, or created by a call to setEntry with a PrivateKeyEntry, then the given certificate is compared to the first element of that entry's certificate chain.

Parameters
cert:Certificate

the certificate to match with.

Returns:String

the alias name of the first entry with matching certificate, or null if no such entry exists in this keystore.

engineGetCertificateChainback to summary
public Certificate[] engineGetCertificateChain(String alias)

Implements abstract java.security.KeyStoreSpi.engineGetCertificateChain.

Doc from java.security.KeyStoreSpi.engineGetCertificateChain.

Returns the certificate chain associated with the given alias. The certificate chain must have been associated with the alias by a call to setKeyEntry, or by a call to setEntry with a PrivateKeyEntry.

Parameters
alias:String

the alias name

Returns:Certificate[]

the certificate chain (ordered with the user's certificate first and the root certificate authority last), or null if the given alias * does not exist or does not contain a certificate chain

engineGetCreationDateback to summary
public Date engineGetCreationDate(String alias)

Implements abstract java.security.KeyStoreSpi.engineGetCreationDate.

Doc from java.security.KeyStoreSpi.engineGetCreationDate.

Returns the creation date of the entry identified by the given alias.

Parameters
alias:String

the alias name

Returns:Date

the creation date of this entry, or null if the given alias does not exist

engineGetKeyback to summary
public Key engineGetKey(String alias, char[] password) throws NoSuchAlgorithmException, UnrecoverableKeyException

Implements abstract java.security.KeyStoreSpi.engineGetKey.

Doc from java.security.KeyStoreSpi.engineGetKey.

Returns the key associated with the given alias, using the given password to recover it. The key must have been associated with the alias by a call to setKeyEntry, or by a call to setEntry with a PrivateKeyEntry or SecretKeyEntry.

Parameters
alias:String

the alias name

password:char[]

the password for recovering the key

Returns:Key

the requested key, or null if the given alias does not exist or does not identify a key-related entry.

Exceptions
NoSuchAlgorithmException:
if the algorithm for recovering the key cannot be found
UnrecoverableKeyException:
if the key cannot be recovered (e.g., the given password is wrong).
engineIsCertificateEntryback to summary
public boolean engineIsCertificateEntry(String alias)

Implements abstract java.security.KeyStoreSpi.engineIsCertificateEntry.

Doc from java.security.KeyStoreSpi.engineIsCertificateEntry.

Returns true if the entry identified by the given alias was created by a call to setCertificateEntry, or created by a call to setEntry with a TrustedCertificateEntry.

Parameters
alias:String

the alias for the keystore entry to be checked

Returns:boolean

true if the entry identified by the given alias contains a trusted certificate, false otherwise.

engineIsKeyEntryback to summary
public boolean engineIsKeyEntry(String alias)

Implements abstract java.security.KeyStoreSpi.engineIsKeyEntry.

Doc from java.security.KeyStoreSpi.engineIsKeyEntry.

Returns true if the entry identified by the given alias was created by a call to setKeyEntry, or created by a call to setEntry with a PrivateKeyEntry or a SecretKeyEntry.

Parameters
alias:String

the alias for the keystore entry to be checked

Returns:boolean

true if the entry identified by the given alias is a key-related, false otherwise.

engineLoadback to summary
public void engineLoad(KeyStore.LoadStoreParameter loadStoreParameter) throws IOException, NoSuchAlgorithmException, CertificateException

Overrides java.security.KeyStoreSpi.engineLoad.

Doc from java.security.KeyStoreSpi.engineLoad.

Loads the keystore using the given KeyStore.LoadStoreParameter.

Note that if this KeyStore has already been loaded, it is reinitialized and loaded again from the given parameter.

Parameters
loadStoreParameter:KeyStore.LoadStoreParameter

the KeyStore.LoadStoreParameter that specifies how to load the keystore, which may be null

Exceptions
IOException:
if there is an I/O or format problem with the keystore data. If the error is due to an incorrect ProtectionParameter (e.g. wrong password) the cause of the IOException should be an UnrecoverableKeyException
NoSuchAlgorithmException:
if the algorithm used to check the integrity of the keystore cannot be found
CertificateException:
if any of the certificates in the keystore could not be loaded
engineLoadback to summary
public void engineLoad(InputStream stream, char[] password) throws IOException, NoSuchAlgorithmException, CertificateException

Implements abstract java.security.KeyStoreSpi.engineLoad.

Doc from java.security.KeyStoreSpi.engineLoad.

Loads the keystore from the given input stream.

A password may be given to unlock the keystore (e.g. the keystore resides on a hardware token device), or to check the integrity of the keystore data. If a password is not given for integrity checking, then integrity checking is not performed.

Parameters
stream:InputStream

the input stream from which the keystore is loaded, or null

password:char[]

the password used to check the integrity of the keystore, the password used to unlock the keystore, or null

Exceptions
IOException:
if there is an I/O or format problem with the keystore data, if a password is required but not given, or if the given password was incorrect. If the error is due to a wrong password, the cause of the IOException should be an UnrecoverableKeyException
NoSuchAlgorithmException:
if the algorithm used to check the integrity of the keystore cannot be found
CertificateException:
if any of the certificates in the keystore could not be loaded
engineProbeback to summary
public boolean engineProbe(InputStream stream) throws IOException

Overrides java.security.KeyStoreSpi.engineProbe.

Doc from java.security.KeyStoreSpi.engineProbe.

Probes the specified input stream to determine whether it contains a keystore that is supported by this implementation, or not.

Parameters
stream:InputStream

the keystore data to be probed

Returns:boolean

true if the keystore data is supported, otherwise false

Exceptions
IOException:
if there is an I/O problem with the keystore data.
engineSetCertificateEntryback to summary
public void engineSetCertificateEntry(String alias, Certificate cert) throws KeyStoreException

Implements abstract java.security.KeyStoreSpi.engineSetCertificateEntry.

Doc from java.security.KeyStoreSpi.engineSetCertificateEntry.

Assigns the given certificate to the given alias.

If the given alias identifies an existing entry created by a call to setCertificateEntry, or created by a call to setEntry with a TrustedCertificateEntry, the trusted certificate in the existing entry is overridden by the given certificate.

Parameters
alias:String

the alias name

cert:Certificate

the certificate

Exceptions
KeyStoreException:
if the given alias already exists and does not identify an entry containing a trusted certificate, or this operation fails for some other reason.
engineSetKeyEntryback to summary
public void engineSetKeyEntry(String alias, Key key, char[] password, Certificate[] chain) throws KeyStoreException

Implements abstract java.security.KeyStoreSpi.engineSetKeyEntry.

Doc from java.security.KeyStoreSpi.engineSetKeyEntry.

Assigns the given key to the given alias, protecting it with the given password.

If the given key is of type java.security.PrivateKey, it must be accompanied by a certificate chain certifying the corresponding public key.

If the given alias already exists, the keystore information associated with it is overridden by the given key (and possibly certificate chain).

Parameters
alias:String

the alias name

key:Key

the key to be associated with the alias

password:char[]

the password to protect the key

chain:Certificate[]

the certificate chain for the corresponding public key (only required if the given key is of type java.security.PrivateKey).

Exceptions
KeyStoreException:
if the given key cannot be protected, or this operation fails for some other reason
engineSetKeyEntryback to summary
public void engineSetKeyEntry(String alias, byte[] key, Certificate[] chain) throws KeyStoreException

Implements abstract java.security.KeyStoreSpi.engineSetKeyEntry.

Doc from java.security.KeyStoreSpi.engineSetKeyEntry.

Assigns the given key (that has already been protected) to the given alias.

If the protected key is of type java.security.PrivateKey, it must be accompanied by a certificate chain certifying the corresponding public key.

If the given alias already exists, the keystore information associated with it is overridden by the given key (and possibly certificate chain).

Parameters
alias:String

the alias name

key:byte[]

the key (in protected format) to be associated with the alias

chain:Certificate[]

the certificate chain for the corresponding public key (only useful if the protected key is of type java.security.PrivateKey).

Exceptions
KeyStoreException:
if this operation fails.
engineSizeback to summary
public int engineSize()

Implements abstract java.security.KeyStoreSpi.engineSize.

Doc from java.security.KeyStoreSpi.engineSize.

Retrieves the number of entries in this keystore.

Returns:int

the number of entries in this keystore

engineStoreback to summary
public void engineStore(OutputStream stream, char[] password) throws IOException, NoSuchAlgorithmException, CertificateException

Implements abstract java.security.KeyStoreSpi.engineStore.

Doc from java.security.KeyStoreSpi.engineStore.

Stores this keystore to the given output stream, and protects its integrity with the given password.

Parameters
stream:OutputStream

the output stream to which this keystore is written.

password:char[]

the password to generate the keystore integrity check. May be null if the keystore does not support or require an integrity check.

Exceptions
IOException:
if there was an I/O problem with data
NoSuchAlgorithmException:
if the appropriate data integrity algorithm could not be found
CertificateException:
if any of the certificates included in the keystore data could not be stored
validateStreamback to summary
private ProvJKS.ErasableByteStream validateStream(InputStream inputStream, char[] password) throws IOException

Validate password takes the checksum of the store and will either. 1. If password is null, load the store into memory, return the result. 2. If password is not null, load the store into memory, test the checksum, and if successful return a new input stream instance of the store. 3. Fail if there is a password and an invalid checksum.

Parameters
inputStream:InputStream

The input stream.

password:char[]

the password.

Returns:ProvJKS.ErasableByteStream

Either the passed in input stream or a new input stream.