Java SE Security

• Java SE Security overview
• Security documentation
• White papers
• Books

• Chronology of security issues
• Forums
• Archived JAAS, JCE, and JSSE Optional packages

References

Platform Security

Built-in language security features enforced by the Java compiler and virtual machine:

• Strong data typing

• Automatic memory management

• Bytecode verification

• Secure class loading

Provides a safe and secure platform for developing and running applications. Compile-time data type checking and automatic memory management leads to more robust code and reduces memory corruption and vulnerabilities. Bytecode verification ensures code conforms to the JVM specification and prevents hostile code from corrupting the runtime environment. Class loaders ensure that untrusted code cannot interfere with the running of other Java programs.

• The Java Language Specification

• The Java Virtual Machine Specification

Cryptography

• Comprehensive API with support for a wide range of cryptographic services including digital signatures, message digests, ciphers (symmetric, asymmetric, stream & block), message authentication codes, key generators and key factories

• Support for a wide range of standard algorithms including RSA, DSA, AES, Triple DES, SHA, PKCS#5, RC2, and RC4.

• PKCS#11 cryptographic token support

Provides an extensible, full featured API for building secure applications:

• Algorithm and implementation independent

• Provider-based (pluggable) architecture

• Java Cryptography Architecture(JCA) (includes the Java Cryptographic Extension (JCE))

Authentication and Access Control

• Abstract authentication APIs that can incorporate a wide range of login mechanisms through a pluggable architecture.

• A comprehensive policy and permissions API that allows the developer to create and administer applications requiring fine-grained access to security-sensitive resources.

Enables single sign-on of multiple authentication mechanisms and fine-grained access to resources based on the identity of the user or code signer.  Recent support (in JDK 5) for timestamped signatures makes it easier to deploy signed code by avoiding the need to re-sign code when the signer's certificate expires. 

• Java Security Architecture

• Java Authentication and Authorization Service (JAAS)

• Policy Implementation and Syntax

• Signature Timestamp Support

Secure Communications

APIs and implementations for the following standards-based secure communications protocols: Transport Layer Security (TLS), Secure Sockets Layer (SSL), Kerberos (accessible through GSS-API), and the Simple Authentication and Security Layer (SASL). Full support for HTTPS over SSL/TLS is also included.

Authenticates peers over an untrusted network and protects the integrity and privacy of data transmitted between them.

• Java Secure Socket Extension (JSSE)

• Java GSS-API (JGSS)

• Java SASL API

Public Key Infrastructure (PKI)

Tools for managing keys and certificates and comprehensive, abstract APIs with support for the following features and algorithms:

• Certificates and Certificate Revocation Lists (CRLs): X.509

• Certification Path Validators and Builders: PKIX (RFC 3280), On-line Certificate Status Protocol (OCSP)

• KeyStores: PKCS#11, PKCS#12

• Certificate Stores (Repositories): LDAP, java.util.Collection

Eases the development and deployment of complex PKI applications. Recent support (in JDK 5) for OCSP provides a more scalable and timely method for applications to check certificate revocation status.

• X.509 Certificate and Certificate Revocations Lists (CRLs)

• Java CertPath API

• On-Line Certificate Status Protocol (OCSP)

• Java PKCS#11 Reference Guide