public abstract class JniKeychain
extends java.lang.Object
| Modifier and Type | Method and Description |
|---|---|
static void |
addCertificate(X509Certificate certificate,
boolean isRoot) |
static void |
addKeyPair(X509Certificate certificate,
java.lang.String certificateLabel,
byte[] privateKeyData,
java.lang.String privateKeyLabel,
boolean privateKeyExportable,
java.lang.String keychainName,
SecureStringBuffer securedPassword) |
static X509Certificate[] |
buildCertificateChain(X509Certificate certificate) |
static X509Certificate[] |
buildCertificateChainWithRoots(X509Certificate certificate,
X509Certificate[] rootCertificates)
Build a certificate chain with provided a list of root certificates which are
to be considered trusted anchors by Apple API.
|
static byte[] |
createDecryptedData(KeychainPrivateKey key,
byte[] cipherText)
Decrypt the given CipherText using an RSA private key.
|
static byte[] |
createEncryptedData(KeychainPrivateKey key,
byte[] plainText)
Encrypt the given data using an RSA Private key.
|
static long |
createEntrustKeychainRefUserPrompt(java.lang.String keychainName)
Create a new named keychain or get the copy of the default keychain.
|
static boolean |
createKeychain(java.lang.String keychainName,
SecureStringBuffer securedPassword) |
static byte[] |
createRSASignaturePKCS1v15Raw(KeychainPrivateKey key,
byte[] encodedDigestInfoToSign)
Create the RSA PKCS1 v1.5 signature given the KeychainPrivateKey, the encoded
digest info data.
|
static byte[] |
createSignature(KeychainPrivateKey key,
byte[] dataToSign)
Create the signature given the KeychainPrivateKey, the data to Sign and the
algorithm to use for the Signature.
|
static boolean |
deleteEntrustKeychain(java.lang.String keychainName)
delete Entrust Keychain folder from keychain
|
static void |
deleteKeychainKey(KeychainPrivateKey privateKeyChainKey)
delete the private key by given the KeychainPrivateKey
|
static void |
deleteOmittedCertificates() |
static void |
deleteUserKeyPairs(java.lang.String userDN)
delete the key pairs with specified certificate's subject DN
|
static byte[] |
encryptData(long publicKeyRef,
java.lang.String keychainAlgID,
byte[] plainText)
Encrypt the given data using an RSA public key.
|
static byte[] |
encryptForSmartCardDriver(byte[] publicKeyHash,
byte[] serialNumber,
SecureByteArray securedPlainText) |
static X509Certificate[] |
enumerateCertificates() |
static X509Certificate[] |
enumerateRootCertificates()
Enumerate all of the root certificates (both local and system) from the
keychain.
|
static byte[] |
exportRSAPrivateKeyInfo(long rsaPrivatekeyRef)
Export the private key info out of the given private key.
|
static byte[] |
exportRSAPublicKeyInfo(long rsaPrivatekeyRef)
Export the public key info out of the given private key.
|
static long |
generateRSAPrivateKeychainKeyRef(long keychainRef,
int keySize,
boolean backup,
boolean exportable)
Generate a random RSA key pair in the specified keychain.
|
static java.lang.String |
getApplicationName()
retrieve .app bundle name.
|
static java.lang.String |
getApplicationSupportFolder()
On the Mac, retrieve application support directory which store persistent
user-related files for your application
|
static java.lang.String |
getEPFLoginIDWithCertificate(X509Certificate certificate) |
static X509Certificate[] |
getMyCertificates() |
static X509Certificate[] |
getMyEncryptionCertificates() |
static X509Certificate[] |
getMySigningCertificates() |
static X509Certificate[] |
getMySmartCardCertificates(java.lang.String tokenID)
Retrieve the smart card certificates from the keychain based on the token ID.
|
static KeychainKey |
getPrivateKeyChainKey(X509Certificate certificate)
Return the a new KeychainKey that wraps the handled to the private key stored
in the Keychain.
|
static long |
getPublicKeyChainKey(X509Certificate certificate) |
static byte[] |
hashPublicKey(X509Certificate certificate) |
static long |
importPublicKeyInfo(byte[] publicKeyInfoData)
Import the public key info and return public key reference.
|
static void |
initializeKeychain()
Load the default Keychain native library.
|
static void |
initializeKeychain(java.lang.String libraryPath)
Loads the Keychain native library from the given path.
|
static boolean |
isCertMarkedAsTrusted(X509Certificate certificate)
Check to see if the certificate is marked as trusted in the keychain.
|
static boolean |
isImportToDefaultKeychain() |
static boolean |
isKeychainInitialized()
Returns
true if the native Keychain library has been
successfully loaded and initialized, false otherwise. |
static boolean |
isKeychainSynchronizationEnabled() |
static byte[] |
keyAgree(long privateKeyChainKey,
long publicKeyChainKey,
byte[] encodedSharedInfo,
int secretSize,
java.lang.String kdfAlgorithmOID) |
static void |
lockEntrustKeychain(java.lang.String keychainName) |
static long |
openEntrustKeychainRefUserPrompt(java.lang.String keychainName)
Open a named keychain or get the copy of the default keychain.
|
static void |
releaseEntrustKeychainRef(long keychainRef)
Release the keychaiRef which is acquired through
createEntrustKeychainRefUserPrompt() call.
|
static void |
releaseKeyChainKey(long keyChainKey)
Release the handle to the Keychainkey
|
static void |
setDeleteOmittedCertificates(boolean deleteOmittedCertificates)
Determines whether any certificates in the omitCertificatePath will also
be explicitly deleted if present during each synchronization.
|
static void |
setImportToDefaultKeychain(boolean importToDefaultKeychain) |
static void |
setKeychainSynchronizationEnabled(boolean keychainSynchronizationEnabled)
Determines whether perform the keychain synchronization without checking the
policy.
|
static void |
setOmitCertificatePath(java.lang.String omitCertificatesPath)
Sets the path to the certificates that will not be added to the keychain
during synchronization.
|
static boolean |
verifySignature(long publicKeyChainKey,
byte[] signature,
byte[] dataToSign,
java.lang.String algorithmOID)
Verify the Signature using the Keychain
|
static void |
viewCertificate(X509Certificate certificate) |
public static void initializeKeychain()
throws java.lang.UnsatisfiedLinkError
Multiple initialization is not allowed, this method has no effect if the library has already been initialized successfully.
java.lang.UnsatisfiedLinkError - If the library cannot be loaded.public static void initializeKeychain(java.lang.String libraryPath)
throws java.lang.UnsatisfiedLinkError
Multiple initialization is not allowed, this method has no effect if the library has already been initialized successfully.
The default library method is not supported. A name must be specified. Though on Mac OS X the name can be provided without a path.
libraryPath - Full path to the Keychain native library to load.java.lang.UnsatisfiedLinkError - If the specified library cannot be loaded.public static void setOmitCertificatePath(java.lang.String omitCertificatesPath)
omitCertificatesPath - public static void setDeleteOmittedCertificates(boolean deleteOmittedCertificates)
deleteOmittedCertificates - public static boolean isKeychainInitialized()
true if the native Keychain library has been
successfully loaded and initialized, false otherwise.true if the native Keychain library has been
successfully loaded and initialized, false
otherwise.public static byte[] hashPublicKey(X509Certificate certificate) throws java.security.NoSuchAlgorithmException, java.security.NoSuchProviderException, CodingException
java.security.NoSuchAlgorithmExceptionjava.security.NoSuchProviderExceptionCodingExceptionpublic static void deleteOmittedCertificates()
public static void setKeychainSynchronizationEnabled(boolean keychainSynchronizationEnabled)
keychainSynchronizationEnabled - public static boolean isKeychainSynchronizationEnabled()
public static void setImportToDefaultKeychain(boolean importToDefaultKeychain)
public static boolean isImportToDefaultKeychain()
public static void addCertificate(X509Certificate certificate, boolean isRoot) throws java.security.NoSuchAlgorithmException, java.security.NoSuchProviderException, CodingException
java.security.NoSuchAlgorithmExceptionjava.security.NoSuchProviderExceptionCodingExceptionpublic static void addKeyPair(X509Certificate certificate, java.lang.String certificateLabel, byte[] privateKeyData, java.lang.String privateKeyLabel, boolean privateKeyExportable, java.lang.String keychainName, SecureStringBuffer securedPassword) throws java.security.NoSuchAlgorithmException, java.security.NoSuchProviderException, CodingException
java.security.NoSuchAlgorithmExceptionjava.security.NoSuchProviderExceptionCodingExceptionpublic static boolean createKeychain(java.lang.String keychainName,
SecureStringBuffer securedPassword)
public static long createEntrustKeychainRefUserPrompt(java.lang.String keychainName)
keychainName - The name of the keychain for which a keychain is created or copied
of the default keychain if no name is provided.0 if failed to
create the named keychain or copy the default keychain.
Call releaseEntrustKeychainRef() to release the SecKeychainRef after
it is no longer needed.public static long openEntrustKeychainRefUserPrompt(java.lang.String keychainName)
keychainName - The name of the keychain for which the keychain is opened or
copied of the default keychain if no name is provided.0 if failed to
open the named keychain or copy the default keychain.
Call releaseEntrustKeychainRef() to release the SecKeychainRef after
it is no longer needed.public static void releaseEntrustKeychainRef(long keychainRef)
keychainRef - public static void lockEntrustKeychain(java.lang.String keychainName)
public static X509Certificate[] getMyEncryptionCertificates()
public static X509Certificate[] getMySigningCertificates()
public static X509Certificate[] getMyCertificates()
public static X509Certificate[] enumerateCertificates()
public static X509Certificate[] enumerateRootCertificates()
public static void viewCertificate(X509Certificate certificate)
public static X509Certificate[] buildCertificateChain(X509Certificate certificate)
public static X509Certificate[] buildCertificateChainWithRoots(X509Certificate certificate, X509Certificate[] rootCertificates)
certificate - - to be built the chainrootCertificates - - a list of root certificatespublic static KeychainKey getPrivateKeyChainKey(X509Certificate certificate)
certificate - the X509Certificate of the public key for the private KeychainKey
being retrieved from the Keychainpublic static long getPublicKeyChainKey(X509Certificate certificate)
public static void releaseKeyChainKey(long keyChainKey)
keyChainKey - public static long generateRSAPrivateKeychainKeyRef(long keychainRef,
int keySize,
boolean backup,
boolean exportable)
keychainRef - - the keychain to store the generated keykeySize - - RSA key size in bitsbackup - - whether the key needs backupexportable - - whether the key is exportablepublic static byte[] exportRSAPublicKeyInfo(long rsaPrivatekeyRef)
rsaPrivatekeyRef - public static long importPublicKeyInfo(byte[] publicKeyInfoData)
public - key info bytespublic static byte[] exportRSAPrivateKeyInfo(long rsaPrivatekeyRef)
rsaPrivatekeyRef - public static byte[] createSignature(KeychainPrivateKey key, byte[] dataToSign) throws KeychainException
key - The KeychainPrivate Key to use for signingdataToSign - The data to sign for the keyalgorithmOID - The string AlgorithmIDKeychainExceptionpublic static byte[] createRSASignaturePKCS1v15Raw(KeychainPrivateKey key, byte[] encodedDigestInfoToSign) throws KeychainException
key - The KeychainPrivate Key to use for signingencodedDigestInfoToSign - The data to sign. This data should be an
encoded digest info if caller wants to
generate a signature for CMS based on
PKCS1v1.5.
Note 1: There is no checking of the
encodedDigestInfoToSign length or algorithm
OID within it.
Note 2: API createSignature() will take a
digest data and SHA1 or SHA2 algorithmID OID
to create a RSA PKCS1V1.5 signature. The
keychain will encode digest info first and
then do the signing against the encoded digest
info.KeychainExceptionpublic static boolean verifySignature(long publicKeyChainKey,
byte[] signature,
byte[] dataToSign,
java.lang.String algorithmOID)
publicKeyChainKey - signature - dataToSign - algorithmOID - public static byte[] createEncryptedData(KeychainPrivateKey key, byte[] plainText) throws KeychainException
key - the KeychainPrivate KeyplainText - the plainText to be encryptedKeychainExceptionpublic static byte[] encryptData(long publicKeyRef,
java.lang.String keychainAlgID,
byte[] plainText)
throws KeychainException
key: - The public key reference.plainText: - The plainText to be encryptedKeychainExceptionpublic static byte[] createDecryptedData(KeychainPrivateKey key, byte[] cipherText) throws KeychainException
key - the KeychainPrivate KeycipherText - the plainText to be encryptedKeychainExceptionpublic static byte[] keyAgree(long privateKeyChainKey,
long publicKeyChainKey,
byte[] encodedSharedInfo,
int secretSize,
java.lang.String kdfAlgorithmOID)
public static void deleteKeychainKey(KeychainPrivateKey privateKeyChainKey)
key - - The KeychainPrivate Key to be deletedpublic static void deleteUserKeyPairs(java.lang.String userDN)
userDN - - user's certificate's subject DNpublic static boolean deleteEntrustKeychain(java.lang.String keychainName)
keychainName - - name of Entrust keychainpublic static java.lang.String getApplicationSupportFolder()
public static java.lang.String getApplicationName()
public static java.lang.String getEPFLoginIDWithCertificate(X509Certificate certificate) throws java.security.NoSuchAlgorithmException, java.security.NoSuchProviderException, CodingException
java.security.NoSuchAlgorithmExceptionjava.security.NoSuchProviderExceptionCodingExceptionpublic static byte[] encryptForSmartCardDriver(byte[] publicKeyHash,
byte[] serialNumber,
SecureByteArray securedPlainText)
public static X509Certificate[] getMySmartCardCertificates(java.lang.String tokenID)
tokenID - - the identifier of the tokenpublic static boolean isCertMarkedAsTrusted(X509Certificate certificate)
certificate - - to be checked if it is marked as trusted in the keychain