Java Security

Chapter 13. Encryption

In this chapter, we’ll examine the Java Cryptography Extension, which provides (among other things) an engine to perform encryption of arbitrary data. This engine allows developers to send and receive encrypted streams of data over the network or through a filesystem (subject to some export restrictions we’ll also discuss).

The encryption engine we’ll discuss in this chapter does not come with the JDK. Information in this chapter is based on the early access 2 release for JDK 1.2^[39] of the Java Cryptography Extension (JCE); because it is an early access release, the information is subject to change when JCE is officialy released (tentatively scheduled for mid-1998). The JCE introduces four new engine classes to the Java security architecture—one to perform encryption, and three that handle keys for encryption—and it comes with a new security provider to implement those classes. We’ll discuss all of these features in this chapter.

Export Restrictions

Use of the JCE is strictly limited by the export restrictions of the U.S. government. Sun Microsystems is headquartered in the United States, so the export of the JCE is controlled by the U.S. government. Because this implementation is capable of strong encryption, the only countries where it may be used are the United States and Canada.

There are ongoing legal challenges to this position as well as increasing negotiations with the U.S. government to change this policy; at the same time, there are increasing ...