Java Security, 2nd Edition

Appendix E. Implementing a JCE Security Provider

When we developed engines in the examples throughout the book, we mentioned that the JCE engines must be deployed in a special way. In this appendix, we’ll give the outline of those deployment rules and fill in the missing code required for JCE registration.

The steps we’re outlining (along with parts of the code) can be found at http://java.sun.com/products/jce/doc/guide/HowToImplAProvider.html. We’ll give a summary of that information here; for complete information, consult that URL.

Remember that the steps we list in this appendix are required only if you are implementing one of the following engines: KeyGenerator, Mac, SecretKeyFactory, Cipher, or KeyAgreement. If you want to develop other engines, you deploy the code for those engines just like any other Java code.

Here are the steps necessary to develop a JCE security provider.

1. Obtain a test JCE signing certificate.

   JCE security providers must be signed with a certificate issued by a special certificate authority. Both Sun and IBM are set up to provide these certificates. The application for such a certificate must be done both online and by mailing hardcopy documents; the resulting test certificate will be valid for 30 days.

   Part of what you must send includes a certificate signing request for a self-generated 1024-bit DSA public key. The keytool examples from Chapter 10, can be modified to produce such a request. What you’ll eventually get back are two certificates: the root ...