Java Security

Implementing a MessageDigest Class

If you want to write your own security provider, you have the option of creating your own message digest engine. Typically, you’d do this because you want to ensure that a particular algorithm like SHA is available regardless of who the default security provider is; if you have a mathematics background, it’s conceivable that you might want to implement your own algorithm.

In order to implement a message digest algorithm, you must provide a concrete subclass of the MessageDigest class. This essentially entails providing an implementation of most of the public methods we’ve just looked at. Although the public methods are not declared abstract, they typically do nothing more than call an internal (protected) method to accomplish their task.

The MessageDigest class exists in both Java 1.1 and 1.2,^[30] which is why it extends its SPI (see Chapter 8). For our example, we’ll directly subclass the MessageDigest class so that the resulting example will work under both releases, but remember that in 1.2 you have the option of extending the MessageDigestSpi class directly.

There is a single constructor in the MessageDigest class that is available to implementors:

protected MessageDigest(String name)

Construct a message digest object. Classes that extend the MessageDigest class must call this constructor, as this is the only constructor in the class. As we’ll see, however, the constructor of the subclass must take no arguments.

In order to write a message digest ...