PDF (Ebook) Cryptography and Cryptanalysis in Java: Creating and Programming Advanced Algorithms with Java SE 17 LTS and Jakarta EE 10 by Stefania Loredana Nita, Marius Iulian Mihailescu ISBN 9781484281048, 1484281047 download
PDF (Ebook) Cryptography and Cryptanalysis in Java: Creating and Programming Advanced Algorithms with Java SE 17 LTS and Jakarta EE 10 by Stefania Loredana Nita, Marius Iulian Mihailescu ISBN 9781484281048, 1484281047 download
com
OR CLICK HERE
DOWLOAD EBOOK
ebooknice.com
ebooknice.com
(Ebook) Pro Cryptography and Cryptanalysis with C++23:
Creating and Programming Advanced Algorithms by Marius
Iulian Mihailescu, Stefania Loredana Nita ISBN
9781484294499, 1484294491
https://ebooknice.com/product/pro-cryptography-and-cryptanalysis-
with-c-23-creating-and-programming-advanced-algorithms-50581682
ebooknice.com
ebooknice.com
ebooknice.com
ebooknice.com
Cryptography and
Cryptanalysis in Java
Creating and Programming Advanced
Algorithms with Java SE 17 LTS
and Jakarta EE 10
Chapter 1: Introduction�������������������������������������������������������������������������������������������� 1
Cryptography and Cryptanalysis��������������������������������������������������������������������������������������������������� 3
Book Structure������������������������������������������������������������������������������������������������������������������������������ 4
Conclusion������������������������������������������������������������������������������������������������������������������������������������ 6
References������������������������������������������������������������������������������������������������������������������������������������ 6
Chapter 3: R
oadmap and Vision for Jakarta EE 10������������������������������������������������� 21
Conclusion���������������������������������������������������������������������������������������������������������������������������������� 27
References���������������������������������������������������������������������������������������������������������������������������������� 28
v
Table of Contents
Chapter 5: C
lassical Cryptography������������������������������������������������������������������������� 47
Caesar Cipher������������������������������������������������������������������������������������������������������������������������������ 48
Implementation��������������������������������������������������������������������������������������������������������������������� 49
Cryptanalysis������������������������������������������������������������������������������������������������������������������������� 53
Vigenère Cipher��������������������������������������������������������������������������������������������������������������������������� 53
Implementation��������������������������������������������������������������������������������������������������������������������� 56
Cryptanalysis������������������������������������������������������������������������������������������������������������������������� 59
Hill Cipher����������������������������������������������������������������������������������������������������������������������������������� 60
Implementation��������������������������������������������������������������������������������������������������������������������� 61
Cryptanalysis������������������������������������������������������������������������������������������������������������������������� 67
Conclusion���������������������������������������������������������������������������������������������������������������������������������� 68
References���������������������������������������������������������������������������������������������������������������������������������� 68
Chapter 7: P
seudorandom Number Generators������������������������������������������������������ 87
Examples of PRNGs��������������������������������������������������������������������������������������������������������������������� 89
Linear Congruential PRNGs��������������������������������������������������������������������������������������������������� 89
Blum-Blum-Shub PRNG��������������������������������������������������������������������������������������������������������� 89
Linear Circuit PRNGs������������������������������������������������������������������������������������������������������������� 90
Other PRNGs�������������������������������������������������������������������������������������������������������������������������� 91
PRNGs Security���������������������������������������������������������������������������������������������������������������������� 91
Java.util.Random Class��������������������������������������������������������������������������������������������������������� 92
vi
Table of Contents
Conclusion���������������������������������������������������������������������������������������������������������������������������������� 97
References���������������������������������������������������������������������������������������������������������������������������������� 97
Chapter 8: H
ash Functions������������������������������������������������������������������������������������ 101
Conclusion�������������������������������������������������������������������������������������������������������������������������������� 109
References�������������������������������������������������������������������������������������������������������������������������������� 110
Chapter 9: S
ymmetric Encryption Algorithms������������������������������������������������������ 113
Data Encryption Standard��������������������������������������������������������������������������������������������������������� 113
The Generation of Keys������������������������������������������������������������������������������������������������������� 115
Encryption and Decryption Process������������������������������������������������������������������������������������ 116
Operation Modes for DES���������������������������������������������������������������������������������������������������� 117
Advanced Encryption Standard������������������������������������������������������������������������������������������������� 123
Encryption and Decryption Process������������������������������������������������������������������������������������ 123
Operation Modes for AES����������������������������������������������������������������������������������������������������� 124
Conclusion�������������������������������������������������������������������������������������������������������������������������������� 129
References�������������������������������������������������������������������������������������������������������������������������������� 130
Chapter 10: A
symmetric Encryption Schemes����������������������������������������������������� 131
RSA������������������������������������������������������������������������������������������������������������������������������������������� 133
ElGamal������������������������������������������������������������������������������������������������������������������������������������� 138
Merkle-Hellman������������������������������������������������������������������������������������������������������������������������ 143
The Knapsack Approach������������������������������������������������������������������������������������������������������ 143
Algorithms��������������������������������������������������������������������������������������������������������������������������� 144
Conclusion�������������������������������������������������������������������������������������������������������������������������������� 145
References�������������������������������������������������������������������������������������������������������������������������������� 145
Chapter 11: S
ignature Schemes��������������������������������������������������������������������������� 147
Conclusion�������������������������������������������������������������������������������������������������������������������������������� 156
References�������������������������������������������������������������������������������������������������������������������������������� 156
vii
Table of Contents
Chapter 14: A
dvanced Encryption Schemes��������������������������������������������������������� 195
Homomorphic Encryption��������������������������������������������������������������������������������������������������������� 195
Searchable Encryption�������������������������������������������������������������������������������������������������������������� 199
Conclusion�������������������������������������������������������������������������������������������������������������������������������� 201
References�������������������������������������������������������������������������������������������������������������������������������� 201
Chapter 15: C
ryptography Tools��������������������������������������������������������������������������� 205
CryptTool����������������������������������������������������������������������������������������������������������������������������������� 205
OpenSSL����������������������������������������������������������������������������������������������������������������������������������� 215
Conclusion�������������������������������������������������������������������������������������������������������������������������������� 221
References�������������������������������������������������������������������������������������������������������������������������������� 222
Index��������������������������������������������������������������������������������������������������������������������� 223
viii
About the Authors
Stefania Loredana Nita, PhD, is a lecturer at “Ferdinand I” Military Technical Academy
of Bucharest and a software developer and researcher at the Institute for Computers. Her
PhD thesis was on advanced cryptographic schemes using searchable encryption and
homomorphic encryption. At the Military Technical Academy, she teaches the Formal
Languages and Translators and Database Application Development courses. She worked
for more than two years as an assistant lecturer at the University of Bucharest where
she taught courses on subjects such as advanced programming techniques, simulation
methods, and operating systems. Her research activity is in the cryptography field, with
a focus on searchable encryption and homomorphic encryption. She is also interested
in blockchain, quantum cryptography, machine learning, and artificial intelligence.
At the Institute for Computers, she is working on research and development projects
that involve cloud computing security, the Internet of Things, and big data. She has
authored or co-authored more than 28 papers at conferences and for journals and has
co-authored five books. Also, she holds an MSc in software engineering and two BSc
degrees in computer science and mathematics.
Marius Iulian Mihailescu, PhD, has worked in the academic and industry sector
for more than 15 years. Currently, he is an associate professor (senior lecturer) of
engineering and computer science at “Spiru Haret” University, Romania, and as a side
job he is a project manager at the Institute for Computers where he is managing different
projects using different technologies, such as DevOps, Scrum, Agile, C#, Microsoft
SQL Server, Syncfusion, ASP.NET, and VUE. At the university, he has taught several
key computer science courses about information security, functional programming,
Interne of Things, blockchain, software development methods (Microsoft Azure,
Entity Framework, NHibernate, LINQ-to-SQL, UX with DevExpress controls, etc.), and
development web applications (HTML 5, CSS 3, Bootstrap, JavaScript, AJAX, NodeJS,
VUE, Laravel, mRabbit, ASP.NET, PHP). He has authored or co-authored more than
ix
About the Authors
30 articles in conference proceedings, 25 articles in journals, and six books. For three
years he worked as an IT officer at Royal Caribbean Cruises Ltd. where he dealt with IT
infrastructures, data security, and satellite communications systems. He received his
PhD in 2014, and his thesis was on applied cryptography over biometrics data. He holds
two MSc degrees in information security and software engineering, from “Ferdinand I”
Military Technical Academy and the University of Bucharest, Romania.
x
About the Technical Reviewer
Doug Holland is a software engineer and architect at Microsoft Corporation. He
holds a master’s degree in software engineering from the University of Oxford. Before
joining Microsoft, he was honored with the Microsoft MVP and Intel Black Belt
Developer awards.
xi
CHAPTER 1
Introduction
In the last decade, technology has rapidly evolved. Statistics show that 64.2 zettabytes of
data were generated in 2020 (1 zettabyte is equivalent to 1021 bytes or 1012 gigabytes), and
it is predicted that by 2025, the digital data generated will reach 181 zettabytes [1, 2].
Electronic communication has become an essential part of our lives, and due to its
rapid evolution, all manner of security issues have arisen. Because digital messages,
in all of their forms, are sent daily over public networks across the world, the need
for secure channels and security mechanisms has also increased. Digital devices and
communications should have digital signatures that make them easy to authenticate.
Modern cryptography provides solutions for all these requirements.
The era in which we are living is considered the “zettabytes era,” in which technology
allows humans and electronic devices to generate and send information instantly, at
any time and any place. Advanced technologies, such as the Internet of Things, fog
computing, edge computing, smart vehicles, drones, smart houses, and many other
complex software (desktop/web/mobile) solutions or architectures, are evolving so
quickly that it is difficult to keep up with security requirements. For example, at the time
of this book’s writing, there are 160,974 records of vulnerabilities registered on the CVE
platform [3]. However, lessons can be learned even from failures, so by analyzing such
vulnerabilities, security solutions can be improved.
One of the most important aspects considered when complex systems are
designed and implemented is knowledge. In antiquity, the Latins said Scientia
potentia est, meaning “Knowledge is power” [4]. In the 21s century, this is even more
true; information falling into the wrong hands can lead to huge business losses and
catastrophic outcomes. Cryptography and information security provide security
1
© Stefania Loredana Nita and Marius Iulian Mihailescu 2022
S. L. Nita and M. I. Mihailescu, Cryptography and Cryptanalysis in Java,
https://doi.org/10.1007/978-1-4842-8105-5_1
Chapter 1 Introduction
mechanisms that can protect information shared between senders and recipients over
insecure channels, so that unauthorized users cannot access or alter the transmitted
information. Over time, there were encryption systems that were broken by attackers by
exploiting vulnerabilities of the systems.
The word cryptography comes from the Greek words kryptos and graphein, meaning
“hidden” and “writing,” respectively. As its name suggests, the purpose of cryptography
is to hide messages from unauthorized individuals and to keep their integrity. Although
the study of cryptography has been around only about 100 years, it was used in different
forms from ancient times. However, over time there have been various primary methods
of hiding secret messages, starting with hieroglyphs, continuing with Caesar's famous
cipher, followed by the Vigenère cipher, Hebern’s rotor machine, and the famous
Enigma machine. Nevertheless, hiding messages was not the only occupation close
to cryptography or, rather, information security. Another example is authentication or
identity verification; this was often done through seals.
Cryptography is considered an art, especially in its primary phases. The history of
cryptography began in ancient Egypt, alongside the art of writing, during a time when
humans started organizing in different social groups. This organization led to a natural
need of transmitting information only to certain individuals, with the same group, tribe,
etc. Early forms of cryptography were hieroglyphs, which started to be used about 4,000
ago by Egyptians—only they recognized the symbols and their meaning. An inscription
carved circa 1900 BC contains the first known evidence of cryptography (in some kind).
It is located in Egypt nobleman Khnumhotep II’s tomb, in the main chamber [5]. In this
inscription, some symbols have a different form than usual, and the scribe’s intent was
not necessary to hide a message; rather, he wanted the symbols to look nobler than usual
according to the social status of the deceased. Although the inscription does not hide
a message, it contains an altered/transformed form of the original symbols, being the
oldest proof of such an approach. Then, cryptography in the ancient world moved to a
substitution approach, in which every symbol of an alphabet was replaced by another
symbol based on a secret rule. This was happening around 500–600 BC. The next notable
cipher was Caesar’s cipher. Caesar was a Roman emperor who was communicating
with his army generals with encoded messages, using a substitution within the Roman
alphabet. Each letter was shifted a certain number of positions in the alphabet, usually
three. For example, the correspondent of A was D, of B was E, and so on. This is an
important historical cipher that is mentioned often in cryptography literature. The next
important achievement in cryptography was in the Middle Ages by Leon Battista Alberti,
who implemented polyalphabetic substitution. Two rotating copper disks were used that
2
Chapter 1 Introduction
3
Chapter 1 Introduction
Book Structure
This book contains 15 chapters, in which the main aspects of classical and modern
cryptography are presented. Generally, the chapters will cover the foundation of the
presented concept/mechanism/technique from a mathematical perspective and then a
practical implementation or use cases in Java. The following chapters are detailed here:
• Chapter 2, “JDK 17: New Features”: This chapter will cover the new
features of Java 17 and will show some practical examples.
4
Chapter 1 Introduction
the purpose of cryptography and its basic rules. For each classic
algorithm, the mathematical description will be presented followed
by the implementation in Java.
5
Chapter 1 Introduction
Conclusion
This first chapter covered the objectives of the book and highlighted the need
for cryptography and information security. Then it explained what cryptology,
cryptography, and cryptanalysis mean. Finally, the chapter described each upcoming
chapter so you can find information of interest quickly.
References
[1]. Volume of data/information created, captured, copied, and
consumed worldwide from 2010 to 2025, https://www.statista.
com/statistics/871513/worldwide-data-created/
6
Chapter 1 Introduction
7
CHAPTER 2
9
© Stefania Loredana Nita and Marius Iulian Mihailescu 2022
S. L. Nita and M. I. Mihailescu, Cryptography and Cryptanalysis in Java,
https://doi.org/10.1007/978-1-4842-8105-5_2
Chapter 2 JDK 17: New Features
Removals:
Deprecations:
Note that in the following examples, the Eclipse environment should be configured
for use with Java 17. We’ll now elaborate on the JEPs of interest to the field of
cryptography.
JEP306, “Restore Always-Strict Floating-Point Semantics.” This new feature
brings back the semantics before introducing the strict and default floating-point
modes in Java SE 1.2. The purpose of this modification is to make it easy to work with
libraries for numeric usages, such as java.lang.Math or java.lang.StrictMath. The
variations of the types of calculations (strict, strict floating-point) were due to hardware
constraints in that some processors suffered from overheating issues while performing
strict computations. However, nowadays processors have overcome such constraints;
therefore, strict computations can be used safely without restrictions. You can learn
more about JEP306 at [8].
JEP356, “Enhanced Pseudorandom Number Generators.” This one is of
interest for cryptography use. This new feature includes new interface types and new
implementations for pseudorandom number generators (PRNGs), which are included
in the java.util.random package. The new implementations contain jumpable
PRNGs and a completely new class for splittable PRNGs, called LXM. The purpose of
this feature is to make it easier to use PRNGs and to eliminate two weaknesses in the
SplittableRandom class discovered in 2016.
10
Chapter 2 JDK 17: New Features
In Listing 2-1 are printed available PRNGs with some information about them:
their type (arbitrary jumpable, hardware, jumpable, leapable, splittable, statistical,
stochastic, or streamable) and the number of bits used to maintain the state of the seed.
After that, lines 28 and 29 show how PRNGs are instantiated in the new Java 17, while
line 31 shows the old instantiation of the Random class. Lines 33, 34, and 36 show the
default representation for the new implementations and the shortcut for the default
representation, respectively. Figure 2-1 shows the results.
1 import java.util.Random;
2 import java.util.random.RandomGenerator;
3 import java.util.random.RandomGeneratorFactory;
4 import java.util.stream.Stream;
5
6 public class JEP356Example {
7
8 public static void main(String[] args) {
9
10 Stream<RandomGeneratorFactory<RandomGenerator>> allPRNGs =
RandomGeneratorFactory.all();
11 allPRNGs.map(prng -> prng.name() + " [ Group: " + prng.
group() + "; "
12 + (prng.isArbitrarilyJumpable() ? " arbitrary-
jump" : "")
13 + (prng.isHardware()? " hardware" : "")
14 + (prng.isJumpable() ? " jump" : "")
15 + (prng.isLeapable()? " leap" : "")
16 + (prng.isSplittable() ? " split" : "")
17 + (prng.isStatistical()? " statistical" : "")
18 + (prng.isStochastic()? " stochastic" : "")
19 + (prng.isStreamable() ? " stream" : "")
20 + "; noOfBits: "+ prng.stateBits()
21 + "]"
22 ).sorted().forEach(System.out::println);
23
11
Chapter 2 JDK 17: New Features
24 System.out.println("\n*****\n");
25
26 RandomGenerator prng1 = RandomGeneratorFactory.
of("Random").create(45);
27 System.out.println("prng1 - " + prng1.getClass());
28 RandomGenerator prng2 = new Random(45);
29 System.out.println("prng2 - " + prng2.getClass());
30 RandomGenerator prng3 = RandomGeneratorFactory.
getDefault().create(45);
31 System.out.println("prng3 - " + prng3.getClass());
32 RandomGenerator prng4 = RandomGenerator.getDefault();
33 System.out.println("prng4 - " + prng4.getClass());
34 }
35 }
12
Chapter 2 JDK 17: New Features
In Figure 2-1, the Legacy category is for the old implementation of PRNGs, while LXM
and Xoroshiro are newly introduced. Note that the new implementations are not thread-
safe; namely, the same instance can be shared between more threads (although this is
not a common practice while developing applications). Instead, java.util.Random and
java.security.SecureRandom are thread-safe. You can learn more about JEP 356 at [9].
JEP403, “Strongly Encapsulate JDK Internals.” This is one of the features that
enhances the security of the JDK, as the internal APIs cannot be accessed with
the --illegal-access option at the command line anymore; this is because in JDK 17
all internal elements are now strongly encapsulated. The exceptions are crucial APIs,
such as sun.misc.Unsafe. The purpose of this feature is to encourage developers to
use standard APIs instead of internal APIs. This change increases the security and
the maintainability of the JDK. On the official page of this JEP, the developers give
some examples of pieces of code that will not work anymore in JDK 17 and provide
explanations for each example. You can learn more about JEP 403 at [10].
JEP406, “Pattern Matching for switch (Preview).” By far, using pattern matching
in switch expressions and statements will be easier and more elegant. In addition, this
will save a lot of lines of code. Listing 2-2 is an example of pattern matching for switch
that can be used in cryptography. Consider three classes that implement the RSA, AES,
and ElGamal algorithms (lines 1–11); the user should introduce only the secret key or the
pair of the secret key and public key corresponding to the chosen encryption system’s
type. Note that for the following example, the usage of preview language features should
be enabled in order to work properly.
1 class RSA {
2
3 }
4
5 class AES {
6
7 }
8
9 class ElGamal {
10
11 }
13
Chapter 2 JDK 17: New Features
12
13 public class JEP406Example {
14
15 static void TypeOfKeys(Object o) {
16 if (o instanceof RSA ) {
17 System.out.println("Two keys needed. Type the secret on
the first line. Type the public key on the second line.");
18 } else if (o instanceof AES) {
19 System.out.println("One key needed. Type the secret
key on the first line.");
20 } else if (o instanceof ElGamal) {
21 System.out.println("Two keys needed. Type the secret on
the first line. Type the public key on the second line.");
22 }
23 }
24
25 static void TypeOfKeysPatternSwitch(Object o) {
26 if(o == null)
27 throw new NullPointerException();
28 else
29 {
30 switch (o.getClass().toString()) {
31 case null -> throw new NullPointerException();
32 case "RSA2" -> System.out.println("Two keys
needed. Type the secret on the first line. Type
the public key on the second line.");
33 case "AES2" -> System.out.println("One key
needed. Type the secret key on the first line.");
34 case "ElGamal2" -> System.out.println("Two keys
needed. Type the secret on the first line. Type
the public key on the second line.");
35 default -> System.out.println("Pick an
encryption system");
36 }
37 }
38 }
14
Chapter 2 JDK 17: New Features
39
40 public static void main(String[] args) {
41 TypeOfKeys(new RSA());
42 TypeOfKeysPatternSwitch(new RSA());
43
44 System.out.println("\n***\n");
45
46 TypeOfKeys(new AES());
47 TypeOfKeysPatternSwitch(new AES());
48 }
49 }
In Listing 2-2, two approaches were used to print the message for the user: the
regular one, in the function TypeOfKeys (lines 16–27), and the version with pattern
matching for the switch statement (lines 29–45). Note that the result should be the same
for the same type of object that is passed to the two functions. You can check the result in
Figure 2-2, and you can learn more about JEP 406 at [11].
15
Chapter 2 JDK 17: New Features
However, superclasses should be widely accessible but not widely extensible. Sealed
classes were introduced to give more control over how extensibility and implementation
are used. The previous example can be modified by using sealed classes as shown in
Listing 2-5.
16
Chapter 2 JDK 17: New Features
9 else
10 throw new RuntimeException("Unknown instance
of Cryptosystem.");
11
12 }
13 public static void main(String[] args) {
14 AES_Cryptosystem aes = new AES_Cryptosystem();
15 RSA_Cryptosystem rsa = new RSA_Cryptosystem();
16
17 Test(aes);
18 Test(rsa);
19 }
20 }
In Listing 2-5, three classes are used: Cryptosystem, AES_Cryptosystemn, and RSA_
Cryptosystem. Note that to use them as sealed classes and classes that extend the sealed
class, each class must be defined in its own file. To prevent further extensions, the classes
that extend the sealed class should be declared as final. Here is the definition for the
three classes used in the example:
17
Chapter 2 JDK 17: New Features
For example, Matlab code can be used for mathematical functions or algorithms that
are already implemented, such as statistical functions. Using the foreign code is safe and
efficient. You can learn more about JEP412 at [13].
JEP414, “Vector API (Second Incubator).” Using this feature achieves better
performance and implementation for vector instructions compared to equivalent scalar
computations. The improved API provides features such as translating byte vectors to
Boolean arrays, or vice versa. You can learn more about JEP412 at [14].
JEP415, “Context-Specific Deserialization Filters.” This is another example of
a feature that is great for cryptographic purposes. The motivation behind this feature
lies in the fact that data that is received from different sources is untrusted because in
the world of the Internet, often the source is unknown, untrusted, or unauthenticated.
Therefore, when untrusted data is deserialized, it can be dangerous. For example, an
attacker can exploit the vulnerabilities behind serialized/deserialized data injecting
malicious behavior. With this feature, a filter factory for Java Virtual Machine (JVM)
was introduced that can be configured. When it is instantiated as an object of the
ObjectInputStream type, the JVM filter factory is invoked, and the result is used to
initialize each filter per stream. You can learn more about JEP415 at [15].
Conclusion
This chapter presented the main features added in Java 17. By far one of the most
exciting added features is the new pseudorandom generator implementations and
pattern matching for switch instructions. The chapter presented some use cases for
cryptography.
References
[1]. Java SE at a Glance, https://www.oracle.com/ro/java/
technologies/java-se-glance.html
[3]. https://dev.java/
18
Chapter 2 JDK 17: New Features
[6]. Java® Platform, Standard Edition & Java Development Kit Version
17 API Specification, https://docs.oracle.com/en/java/
javase/17/docs/api/index.html
[13]. JEP 412: Foreign Function & Memory API (Incubator), https://
openjdk.java.net/jeps/412
19
CHAPTER 3
Starting with Java EE 8, Jakarta Security is a new API with three authentication
procedures: Basic, Form, and an extension of Form that perfectly suits the process of
implementation within Java Server Faces (JSF).
With Jakarta EE 10, the goal is to add new authentication mechanisms. The first
mechanism on the list is represented by Client-Cert and Digest. In this way, Jakarta
Security will provide a total replacement of the authentication mechanisms that are
supported by Java Servlet. Another goal is to offer support for OpenID, OAuth, and JSON
Web Token (JWT). JWT is an interesting topic that is currently under discussion due to
the process of adding it to the MicroProfile project.
Jakarta Security supports different annotations, such as @RolesAllowed and @RunAs,
with support for further extensions. At the moment, @RolesAllowed is supported only
by EJB in Jakarta EE. The annotation will throw an exception if access is denied by a
bean method.
Related to the authentication mechanisms, @RolesAllows will trigger an
authentication mechanism when access is denied by a Jakarta REST resource method.
21
© Stefania Loredana Nita and Marius Iulian Mihailescu 2022
S. L. Nita and M. I. Mihailescu, Cryptography and Cryptanalysis in Java,
https://doi.org/10.1007/978-1-4842-8105-5_3
Chapter 3 Roadmap and Vision for Jakarta EE 10
The Jakarta EE 10 platform will include a serious set of components; Table 3-1 shows
their status.
22
Chapter 3 Roadmap and Vision for Jakarta EE 10
• Jakarta Debugging Support for Other Languages 2.0 (feature for Web Profile)
• Jakarta Dependency Injection 2.0 (feature for Web Profile)
23
Chapter 3 Roadmap and Vision for Jakarta EE 10
• Jakarta RESTful Web Services 3.1 (updated feature for Web Profile)
At the time of this book’s writing, the tool that contains portable modules for low-
level authorization had not yet been incorporated into Jakarta Security 1.0, as it had
not yet been fully evaluated. For example, to have a solution that identifies the scope
of an application, checking for the bridging role against an external service is the best
strategy, instead of taking all the roles and assigning them when the invocation call is
authenticated. Such an example is shown here:
1 import java.io.UnsupportedEncodingException;
2 import java.security.KeyPair;
3 import java.security.KeyPairGenerator;
4 import java.security.NoSuchAlgorithmException;
24
Chapter 3 Roadmap and Vision for Jakarta EE 10
5 import java.security.NoSuchProviderException;
6 import java.security.PrivateKey;
7 import java.security.PublicKey;
8 import java.security.SecureRandom;
9
10 @ApplicationScoped
11 public class ApressAuthorizationModule {
12
13 @Inject
14 SecurityConstraints apressSecurityConstraints
15
16 @Inject
17 ApressService apressService;
18
19 @PostAuthenticate
20 @PreAuthorize
21 @ByRole
22 public Boolean appressLogic(
23 Caller apressCaller, Permission apressReqPermission) {
24
25 return apressSecurityConstraints.getRequiredRoles(apressReq
Permission)
26 .stream()
27 .anyMatch(apressAccessRole -> apressService.
isInRole(apressCaller, apressAccessRole));
28 }
29
30 }
Jakarta CDI represents the main component model within the platform, and many
components are being aligned with it already. The important components include the
following:
25
Chapter 3 Roadmap and Vision for Jakarta EE 10
• Jakarta Security will have two annotations that will need to deal
with it: @RolesAllowed and @RunAs.
• Jakarta Batch
• Jakarta Concurrency
26
Chapter 3 Roadmap and Vision for Jakarta EE 10
Next, looking at the future of Jakarta EE 10, there are new challenges, but they will
not be covered. Most of the components provide experimentation together with analysis
and development. Those features are summarized as follows:
• Jakarta MVC
• Java Secure Socket Extension (JSSE): One of the most important data
protocols is represented by the Secure Sockets Layer (SSL), which
provides data integrity by providing encryption. JSSE has a standard
interface and proper implementation for the SSL protocol.
Good references specialized for Jakarta EE are [1-3] and generally for Java are [4-7].
Conclusion
In this chapter, we provided a short overview of the main components and challenges
covered by the new Jakarta EE 10 and how these components will impact the developing
process of the software applications and the implementation of security mechanisms.
27
Chapter 3 Roadmap and Vision for Jakarta EE 10
References
[1]. Juneau, Josh. Jakarta EE Recipes: A Problem-Solution Approach,
Apress, 2020.
[7]. Sierra, Kathy, and Bert Bates. Head First Java. 2nd ed,
O’Reilly, 2005.
28
CHAPTER 4
Java Cryptography
Architecture
The Java Cryptography Architecture (JCA) framework offers capabilities for working with
cryptography algorithms and offers methods for a variety of cryptography primitives.
The cryptography algorithms and methods are implemented and offered through the
java.security package.
The Java platform is designed in such a way that the most important aspects and
components that characterize security are included in an easy and modern approach for
developers. The following are the most important components:
• Secure communication
• Language safety
• Authentication
• Access control
JCA represents only a small part of the entire Java platform, which has a provider
and a set of APIs for different cryptography primitives, such as digital signatures, hash
functions, validation of certificates, encryption algorithms/primitives, cryptography key
generation functions, key management, and algorithms for generating random numbers.
The provider was designed as architecture with respect for the following principles:
29
© Stefania Loredana Nita and Marius Iulian Mihailescu 2022
S. L. Nita and M. I. Mihailescu, Cryptography and Cryptanalysis in Java,
https://doi.org/10.1007/978-1-4842-8105-5_4
Chapter 4 Java Cryptography Architecture
• java.security
• javax.crypto
• javax.crypto.spec
• javax.crypto.interfaces
• Sun
• SunRsaSign
• SunJCE
30
Chapter 4 Java Cryptography Architecture
• Cipher class
• KeyPairGenerator class
• KeyFactory class
• MessageDigest class
• Signature class
Another question that will come up is, how is independence implemented? The
Cryptographic Service Provider (CSP) represents a package or a set of packages that
provides implementations for a variety of cryptographic services, such as digital
signatures algorithms, hash algorithms, and key management algorithms. Simply stated,
interoperability in information security is the ability of different implementations to
achieve their goals by working with each other, exchanging cryptography keys between
them, or being able to check each other’s cryptography keys.
The final question is, what is the importance and meaning of algorithm extensibility?
The answer relies in the simplicity of how the engine classes are added in a very easy and
modern way.
31
Chapter 4 Java Cryptography Architecture
The base class java.security.Provider comprises all the security providers. For
each CSP we will have an instance of this class. The class will offer the following:
• A list with all the security algorithms and security services that are
implemented
To use JCA, you simply specify the request for a certain object and its type. With
every JDK that you install, one or more providers will be installed and set by default.
Let’s see an example of JCA in action. The first thing you need to do is to make a
simple request for a certain type of object, such as MessageDigest, and to invoke or call a
certain algorithm/service, such as the SHA-512 algorithm.
message_hash = MessageDigest.getInstance("SHA-512");
message_hash = MessageDigest.getInstance("SHA-384",
"ImplementedProvider1");
Note that the previous lines of code are just an example snippet. In real use,
ImplementedProvider1 should be replaced with a valid provider. For example, a provider
for SHA-384 is SUN. Java enables users to determine the providers available by using the
following code:
Figure 4-1 and Figure 4-2 show the requesting process for the SHA-512 algorithm
to hash a message. The ordering process shows three different ways of how a hash
algorithm is invoked and how a provider can be used as a source of the implementation.
Based on the architectures shown in Figure 4-1 and Figure 4-2, the developers can add
any other components (e.g., services, interfaces, third-party functions, etc.) and develop
new architectures based on them.
Returning to the independence of the algorithms, their definition will achieve the
proper goal of providing the implementation of providers that are compliant with the
defined interfaces. This is known as an application programming interface (API), and
it will guarantee that all applications will use it to access a specific type of service.
32
Chapter 4 Java Cryptography Architecture
33
Chapter 4 Java Cryptography Architecture
34
Chapter 4 Java Cryptography Architecture
• Objects: The objects contain the encrypted data and have the
capability to move them to certain and upper abstraction layers. Such
examples include certificates or cryptography key containers.
You can find a comprehensive list with examples and case studies at [1]. Table 4-1
lists the most important ones.
KeyPairGenerator This generates a pair of public and private keys for a certain algorithm.
KeyGenerator For an algorithm, the class will generate new secret keys.
KeyAgreement The instance of the class is used by one or two parties to establish a
cryptographic key to be used within a specific cryptographic operation.
Cipher The class will use the keys (generated for encryption and decryption
data). The class provides a set of various algorithms, such as
asymmetric encryption, symmetric encryption, and password-based
encryption.
MessageDigest This provides functionalities for computing the hash value for a certain
message.
SecureRandom This provides functionalities for generating random numbers.
35
Chapter 4 Java Cryptography Architecture
Provider This generates a pair of public and private keys for a certain algorithm.
Security For an algorithm, this class will generate new secret keys.
MessageDigest An instance of this class is used by one or two parties for establishing a
cryptographic key to be used within a specific cryptographic operation.
Cipher This class will use the keys (generated for encryption and decryption
data). The class provides a set of various algorithms, such as
asymmetric encryption, symmetric encryption, and password-based
encryption.
KeyAgreement This provides functionalities for computing the hash value for a certain
message.
CertificateFactory This provides functionalities for generating random numbers.
Key This provides functionalities for working with keys.
Data Encryption
To work with data encryption, the Cipher class offers the right tools (e.g., functions,
methods, etc.). The Cipher class is part of the javax.crypto package.
The workflow is straightforward to follow, as shown here and in Listing 4-1:
36
Another Random Document on
Scribd Without Any Related Topics
100—Dick Merriwell’s Intuition
191—Dick Merriwell’s Placer Find
SPORT STORIES
Stories of the Big Outdoors
There has been a big demand for outdoor stories, and a very
considerable portion of it has been for the Maxwell Stevens stories
about Jack Lightfoot, the athlete.
These stories are not, strictly speaking, stories for boys, but boys
everywhere will find a great deal in them to interest them.
ALL TITLES ALWAYS IN PRINT
The Dealer
who handles the STREET & SMITH NOVELS is a man worth
patronizing. The fact that he does handle our books proves that he
has considered the merits of paper-covered lines, and has decided
that the STREET & SMITH NOVELS are superior to all others.
He has looked into the question of the morality of the paper-
covered book, for instance, and feels that he is perfectly safe in
handing one of our novels to any one, because he has our assurance
that nothing except clean, wholesome literature finds its way into
our lines.
Therefore, the STREET & SMITH NOVEL dealer is a careful and
wise tradesman, and it is fair to assume selects the other articles he
has for sale with the same degree of intelligence as he does his
paper-covered books.
Deal with the STREET & SMITH NOVEL dealer.
STREET & SMITH CORPORATION
79 Seventh Avenue New York City
*** END OF THE PROJECT GUTENBERG EBOOK CAPTAIN SPARKLE,
PIRATE; OR, A HARD MAN TO CATCH ***
Updated editions will replace the previous one—the old editions will
be renamed.
1.D. The copyright laws of the place where you are located also
govern what you can do with this work. Copyright laws in most
countries are in a constant state of change. If you are outside the
United States, check the laws of your country in addition to the
terms of this agreement before downloading, copying, displaying,
performing, distributing or creating derivative works based on this
work or any other Project Gutenberg™ work. The Foundation makes
no representations concerning the copyright status of any work in
any country other than the United States.
1.E.6. You may convert to and distribute this work in any binary,
compressed, marked up, nonproprietary or proprietary form,
including any word processing or hypertext form. However, if you
provide access to or distribute copies of a Project Gutenberg™ work
in a format other than “Plain Vanilla ASCII” or other format used in
the official version posted on the official Project Gutenberg™ website
(www.gutenberg.org), you must, at no additional cost, fee or
expense to the user, provide a copy, a means of exporting a copy, or
a means of obtaining a copy upon request, of the work in its original
“Plain Vanilla ASCII” or other form. Any alternate format must
include the full Project Gutenberg™ License as specified in
paragraph 1.E.1.
• You comply with all other terms of this agreement for free
distribution of Project Gutenberg™ works.
1.F.
1.F.4. Except for the limited right of replacement or refund set forth
in paragraph 1.F.3, this work is provided to you ‘AS-IS’, WITH NO
OTHER WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR ANY PURPOSE.
Please check the Project Gutenberg web pages for current donation
methods and addresses. Donations are accepted in a number of
other ways including checks, online payments and credit card
donations. To donate, please visit: www.gutenberg.org/donate.
Most people start at our website which has the main PG search
facility: www.gutenberg.org.
Our website is not just a platform for buying books, but a bridge
connecting readers to the timeless values of culture and wisdom. With
an elegant, user-friendly interface and an intelligent search system,
we are committed to providing a quick and convenient shopping
experience. Additionally, our special promotions and home delivery
services ensure that you save time and fully enjoy the joy of reading.
ebooknice.com