public final class SecureUtils
extends java.lang.Object
The utilities in this class clear all temporary data from memory ensuring that only one copy exists at any time. This class is useful for handling sensitive data.
| Modifier and Type | Method and Description |
|---|---|
static byte[] |
append(byte[] ba1,
byte[] ba2)
Securely appends one byte array to another.
|
static byte[] |
append(byte[] ba1,
byte[] ba2,
int off,
int len)
Securely appends a section of one byte array to another.
|
static char[] |
append(char[] ca1,
char[] ca2)
Securely appends one character array to another.
|
static char[] |
append(char[] ca1,
char[] ca2,
int off,
int len)
Securely appends a section of one character array to another.
|
static byte[] |
charToByte(char[] ca)
Securely converts a character array to a byte array using the default
encoding.
|
static byte[] |
charToByte(char[] ca,
int off,
int len)
Securely converts a section of a character array to a byte array using the
default encoding.
|
static byte[] |
charToByte(char[] ca,
java.lang.String enc)
Securely converts a section of a character array to a
byte
array using the specified encoding. |
static byte[] |
charToByte(char[] ca,
java.lang.String enc,
int off,
int len)
Securely converts part of a character array to a byte array using the
specified encoding.
|
static java.security.AlgorithmParameters |
getAlgorithmParameters(java.lang.String alg)
Gets an instance just as
AlgoriothmParameters.getInstance(String)
does, except that it tries the "Entrust" and "IAIK" providers first, and
falls through to any other provider only if those attempts fail. |
static javax.crypto.Cipher |
getCipher(java.lang.String transformation)
Gets an instance just as
Cipher.getInstance(String) does,
except that it tries the "Entrust" and "IAIK" providers first, and falls
through to any other provider only if those attempts fail. |
static java.security.MessageDigest |
getEntrustMessageDigest(java.lang.String alg)
Requests an instance of the specified message digest algorithm from the
Entrust JCA/JCE cryptographic service provider.
|
static java.security.Signature |
getEntrustSignature(java.lang.String alg)
Requests an instance of the specified digital signature algorithm from
the Entrust JCA/JCE cryptographic service provider.
|
static javax.crypto.KeyAgreement |
getKeyAgreement(java.lang.String alg)
Gets an instance just as
KeyAgreement.getInstance(String)
does, except that it tries the "Entrust" and "IAIK" providers first, and
falls through to any other provider only if those attempts fail. |
static java.security.KeyFactory |
getKeyFactory(java.lang.String alg)
Gets an instance just as
KeyFactory.getInstance(String)
does, except that it tries the "Entrust" and "IAIK" providers first, and
falls through to any other provider only if those attempts fail. |
static javax.crypto.KeyGenerator |
getKeyGenerator(java.lang.String alg)
Gets an instance just as
KeyGenerator.getInstance(String)
does, except that it tries the "Entrust" and "IAIK" providers first, and
falls through to any other provider only if those attempts fail. |
static java.security.KeyPairGenerator |
getKeyPairGenerator(java.lang.String alg)
Gets an instance just as
KeyPairGenerator.getInstance(String)
does, except that it tries the "Entrust" and "IAIK" providers first, and
falls through to any other provider only if those attempts fail. |
static javax.crypto.Mac |
getMac(java.lang.String alg)
Gets an instance just as
Mac.getInstance(String) does,
except that it tries the "Entrust" and "IAIK" providers first, and falls
through to any other provider only if those attempts fail. |
static java.security.MessageDigest |
getMessageDigest(java.lang.String alg)
Gets an instance just as
MessageDigest.getInstance(String)
does, except that it tries the "Entrust" and "IAIK" providers first, and
falls through to any other provider only if those attempts fail. |
static javax.crypto.SecretKeyFactory |
getSecretKeyFactory(java.lang.String alg)
Gets an instance just as
SecretKeyFactory.getInstance(String)
does, except that it tries the "Entrust" and "IAIK" providers first, and
falls through to any other provider only if those attempts fail. |
static java.security.SecureRandom |
getSecureRandom(java.lang.String alg)
Gets an instance just as
SecureRandom.getInstance(String)
does, except that it tries the "Entrust" and "IAIK" providers first, and
falls through to any other provider only if those attempts fail. |
static java.security.Signature |
getSignature(java.lang.String alg)
Gets an instance just as
Signature.getInstance(String)
does, except that it tries the "Entrust" and "IAIK" providers first, and
falls through to any other provider only if those attempts fail. |
static void |
wipe(byte[] ba)
Wipes a
byte array or clears the memory held by a
byte array. |
static void |
wipe(char[] ca)
Wipes a character array or clears the memory held by a character array.
|
static void |
wipe(java.lang.StringBuffer sb)
Wipes a
StringBuffer or clears the memory held by a
StringBuffer. |
static void |
wipe(java.lang.StringBuilder sb)
Wipes a
StringBuilder or clears the memory held by a
StringBuilder. |
public static byte[] append(byte[] ba1,
byte[] ba2)
The byte array specified by ba2 is securely appended to
ba1. This is done by creating a new byte array and copying
the contents of ba1 into the first part of the new byte array,
and the contents of ba2 into the remainder. Upon completion,
the method wipes ba1 and ba2 so that only the new
array exists in memory.
ba1 - the byte array to which ba2 will be appendedba2 - the byte array that will be appended to ba1byte array resulting from appending one byte array to
anotherpublic static byte[] append(byte[] ba1,
byte[] ba2,
int off,
int len)
A specified section of the byte array denoted by the argument
ba2, is securely appended to ba1. This is done
by creating a new byte array and copying the contents of ba1
into the first part of the new byte array, and the specified contents of
ba2 into the remainder.
The specified contents of ba2 are the bytes starting at
off and extending for len bytes. Upon completion,
the method wipes ba1 and ba2 so that only the new
array exists in memory.
ba1 - the byte array to which part of ba2 will be
appendedba2 - the byte array that will be appended to ba1off - the location of the start of the data in ba2 that will be
appended to ba1len - the number of bytes from ba2 to append to ba1byte array resulting from appending part of one byte
array to anotherpublic static char[] append(char[] ca1,
char[] ca2)
The character array specified by ca2 is securely appended to
ca1. This is done by creating a new character array and
copying the contents of ca1 into the first part of the new
character array and the contents of ca2 into the remainder.
Upon completion, the method wipes ca1 and* ca2 so
that only the new array exists in memory.
ca1 - the character array to which ca2 will be appendedca2 - the character array that will be appended to ca1public static char[] append(char[] ca1,
char[] ca2,
int off,
int len)
A specified section of the character array denoted by ca2 is
securely appended to ca1. This is done by creating a new
character array and copying the contents of ca1 into the first
part of the new character array, and the specified contents of
ca2 into the remainder.
The specified contents of ca2 are the bytes starting at
off and extending for len bytes. Upon completion,
the method wipes ca1 and ca2 so that only the new
array exists in memory.
ca1 - the character array to which part of ca2 will be appendedca2 - the character array that will be appended to ca1off - the location of the start of the data in ca2 that will be
appended to ca1len - the number of characters from ca2 to append to
ca1public static byte[] charToByte(char[] ca)
Following this operation all temporary data and the original character
array are wiped from memory, so that only the resulting byte
array remains.
Character conversion is done using a String to convert each
character individually. Although this creates copies of the data in memory,
the data from sequential conversions is placed non-sequentially in memory.
This technique provides no indication of order and makes it impossible to
determine the original character array by examining memory. The use of
String interning avoids the creation of duplicate
String objects, so there will be just one instance per
character in memory.
ca - the character array to convertpublic static byte[] charToByte(char[] ca,
int off,
int len)
The section of the character array that is converted by this method begins
at off and continues for len bytes. Following
this operation, all temporary data and the original character array are
wiped from memory, so that only the resulting byte array
remains.
Character conversion is done using a String to convert each
character individually. Although this creates copies of the data in memory,
the data from sequential conversions is placed non-sequentially in memory.
This technique provides no indication of order and makes it impossible to
determine the original character array by examining memory. The use of
String interning avoids the creation of duplicate
String objects, so there will be just one instance per
character in memory.
ca - the character array to convertoff - the location of the start of the data to be converted in
calen - the number of bytes to convert in capublic static byte[] charToByte(char[] ca,
java.lang.String enc)
throws java.io.UnsupportedEncodingException
byte
array using the specified encoding.
Following this operation all temporary data and the original character
array are wiped from memory, so that only the resulting byte
array remains.
Character conversion is done using a String to convert each
character individually. Although this creates copies of the data in memory,
the data from sequential conversions is placed non-sequentially in memory.
This technique provides no indication of order and makes it impossible to
determine the original character array by examining memory. The use of
String interning avoids the creation of duplicate
String objects, so there will be just one instance per
character in memory.
ca - the character array to convertenc - the character encoding to use for the conversionjava.io.UnsupportedEncodingException - thrown if the specified encoding is not supportedpublic static byte[] charToByte(char[] ca,
java.lang.String enc,
int off,
int len)
throws java.io.UnsupportedEncodingException
The section of the character array that is converted starts at
off and continues for len bytes. Following this
operation all temporary data and the original character array are wiped
from memory, so that only the resulting byte array remains.
Character conversion is done using a String to convert each
character individually. Although this creates copies of the data in memory,
the data from sequential conversions is placed non-sequentially in memory.
This technique provides no indication of order and makes it impossible to
determine the original character array by examining memory. The use of
String interning avoids the creation of duplicate
String objects, so there will be just one instance per
character in memory.
ca - the character array to convertoff - the location of the start of the data to be converted in
caenc - the character encoding to use for the conversionjava.io.UnsupportedEncodingException - thrown if the encoding is not supportedpublic static void wipe(byte[] ba)
byte array or clears the memory held by a
byte array.
This method overwrites the memory with bytes 0x00. The need for this arises from the fact that the Java garbage-collector does not guarantee that memory will be cleared immediately.
ba - the byte array to be wipedpublic static void wipe(char[] ca)
This method overwrites the memory held by the character array with character ' '. The need for this arises from the fact that the Java garbage-collector does not guarantee that memory will be cleared immediately.
ca - the character array to be wipedpublic static void wipe(java.lang.StringBuffer sb)
StringBuffer or clears the memory held by a
StringBuffer.
This method overwrites the memory held by a StringBuffer
with characters ' ', and sets the length to zero. The need for this
arises from the fact that the Java garbage-collector does not guarantee
that the memory will be cleared immediately.
sb - the StringBuffer to be wipedpublic static void wipe(java.lang.StringBuilder sb)
StringBuilder or clears the memory held by a
StringBuilder.
This method overwrites the memory held by a StringBuilder
with characters ' ', and sets the length to zero. The need for this
arises from the fact that the Java garbage-collector does not guarantee
that the memory will be cleared immediately.
sb - the StringBuilder to be wipedpublic static javax.crypto.Cipher getCipher(java.lang.String transformation)
throws java.security.NoSuchAlgorithmException,
javax.crypto.NoSuchPaddingException
Cipher.getInstance(String) does,
except that it tries the "Entrust" and "IAIK" providers first, and falls
through to any other provider only if those attempts fail.
transformation - the name of the transformation, e.g., DES/CBC/PKCS5PaddingCipher that implements the requested
transformationjava.security.NoSuchAlgorithmException - thrown if a Cipher instance for the
algorithm identifier is not recognized by any of the
installed cryptographic providersjavax.crypto.NoSuchPaddingExceptionpublic static java.security.MessageDigest getMessageDigest(java.lang.String alg)
throws java.security.NoSuchAlgorithmException
MessageDigest.getInstance(String)
does, except that it tries the "Entrust" and "IAIK" providers first, and
falls through to any other provider only if those attempts fail.
alg - the name of the algorithm requestedMessageDigest object implementing the specified
algorithmjava.security.NoSuchAlgorithmException - thrown if a MessageDigest instance for the
algorithm identifier is not recognized by any of the
installed cryptographic providerspublic static java.security.MessageDigest getEntrustMessageDigest(java.lang.String alg)
throws java.security.NoSuchAlgorithmException
This API is to be used by code that requires the Entrust provider to be installed; a runtime exception is thrown when the Entrust provider has not been installed.
alg - the name of the algorithm requestedMessageDigest object implementing the specified
algorithmjava.security.NoSuchAlgorithmException - if the Entrust provider does not support the message digest
algorithmjava.lang.SecurityException - if the Entrust provider is not installedpublic static java.security.KeyPairGenerator getKeyPairGenerator(java.lang.String alg)
throws java.security.NoSuchAlgorithmException
KeyPairGenerator.getInstance(String)
does, except that it tries the "Entrust" and "IAIK" providers first, and
falls through to any other provider only if those attempts fail.
alg - the standard string name of the algorithmKeyPairGenerator objectjava.security.NoSuchAlgorithmException - thrown if a KeyPairGenerator instance for
the algorithm identifier is not recognized by any of the
installed cryptographic providerspublic static javax.crypto.KeyGenerator getKeyGenerator(java.lang.String alg)
throws java.security.NoSuchAlgorithmException
KeyGenerator.getInstance(String)
does, except that it tries the "Entrust" and "IAIK" providers first, and
falls through to any other provider only if those attempts fail.
alg - the standard name of the requested key algorithmKeyGenerator objectjava.security.NoSuchAlgorithmException - thrown if a KeyGenerator instance for the
algorithm identifier is not recognized by any of the
installed cryptographic providerspublic static javax.crypto.SecretKeyFactory getSecretKeyFactory(java.lang.String alg)
throws java.security.NoSuchAlgorithmException
SecretKeyFactory.getInstance(String)
does, except that it tries the "Entrust" and "IAIK" providers first, and
falls through to any other provider only if those attempts fail.
alg - the standard name of the requested secret-key algorithmSecretKeyFactory object for the specified
secret-key algorithmjava.security.NoSuchAlgorithmException - thrown if a SecretKeyFactory instance for
the algorithm identifier is not recognized by any of the
installed cryptographic providerspublic static java.security.KeyFactory getKeyFactory(java.lang.String alg)
throws java.security.NoSuchAlgorithmException
KeyFactory.getInstance(String)
does, except that it tries the "Entrust" and "IAIK" providers first, and
falls through to any other provider only if those attempts fail.
alg - the name of the requested key algorithmKeyFactory object for the specified algorithmjava.security.NoSuchAlgorithmException - thrown if a KeyFactory instance for the
algorithm identifier is not recognized by any of the
installed cryptographic providerspublic static javax.crypto.KeyAgreement getKeyAgreement(java.lang.String alg)
throws java.security.NoSuchAlgorithmException
KeyAgreement.getInstance(String)
does, except that it tries the "Entrust" and "IAIK" providers first, and
falls through to any other provider only if those attempts fail.
alg - the standard name of the requested key agreement algorithmKeyAgreement objectjava.security.NoSuchAlgorithmException - thrown if a KeyAgreement instance for the
algorithm identifier is not recognized by any of the
installed cryptographic providerspublic static java.security.Signature getSignature(java.lang.String alg)
throws java.security.NoSuchAlgorithmException
Signature.getInstance(String)
does, except that it tries the "Entrust" and "IAIK" providers first, and
falls through to any other provider only if those attempts fail.
alg - the standard name of the algorithm requestedSignature objectjava.security.NoSuchAlgorithmException - thrown if a Signature instance for the
algorithm identifier is not recognized by any of the
installed cryptographic providerspublic static java.security.Signature getEntrustSignature(java.lang.String alg)
throws java.security.NoSuchAlgorithmException
This API is to be used by code that requires the Entrust provider to be installed; a runtime exception is thrown when the Entrust provider has not been installed.
alg - the name of the algorithm requestedSignature object implementing the specified
algorithmjava.security.NoSuchAlgorithmException - if the Entrust provider does not support the digital
signature algorithmjava.lang.SecurityException - if the Entrust provider is not installedpublic static java.security.AlgorithmParameters getAlgorithmParameters(java.lang.String alg)
throws java.security.NoSuchAlgorithmException
AlgoriothmParameters.getInstance(String)
does, except that it tries the "Entrust" and "IAIK" providers first, and
falls through to any other provider only if those attempts fail.alg - the name of the algorithm requestedAlgorithmParameters objectjava.security.NoSuchAlgorithmException - thrown if a AlgorithmParameters instance
for the algorithm identifier is not recognized by any of
the installed cryptographic providerspublic static java.security.SecureRandom getSecureRandom(java.lang.String alg)
throws java.security.NoSuchAlgorithmException
SecureRandom.getInstance(String)
does, except that it tries the "Entrust" and "IAIK" providers first, and
falls through to any other provider only if those attempts fail.alg - the name of the algorithm requestedSecureRandom objectjava.security.NoSuchAlgorithmException - thrown if a SecureRandom instance for the
algorithm identifier is not recognized by any of the
installed cryptographic providerspublic static javax.crypto.Mac getMac(java.lang.String alg)
throws java.security.NoSuchAlgorithmException
Mac.getInstance(String) does,
except that it tries the "Entrust" and "IAIK" providers first, and falls
through to any other provider only if those attempts fail.alg - the name of the algorithm requestedMac objectjava.security.NoSuchAlgorithmException - thrown if a Mac instance for the algorithm
identifier is not recognized by any of the installed
cryptographic providers