Using JDK 1.1 Signed Applets with Java Plug-in

Print-friendly Version

Overview

Java Plug-in supports the use of standard JDK 1.1 signed applets.

If an applet is signed with a trusted DSA cryptographic key (see Deploying Signed Applets, below) the applet will be allowed to run fully trusted and will be able to access a user's local disk files, open arbitrary network connections, call native methods, and perform other actions.

Note: Java Plug-in 1.2.2 also provides support for RSA Signed Applets. Developers may find that RSA signed applets are more convenient to use and deploy.

Signing Applets

Signed applets are delivered as cryptographically signed JAR files.

The javakey utility that is included in JDK 1.1 can be used to manage cryptographic keys and to sign JAR files.

The basic steps include:

		Creating a signing identity
		Generating a DSA public/private key pair for that identity
		Generating a certificate for the public key
		Using the private key to sign the applet JAR file(s)

Deploying Signed Applets

A signed JAR file can be downloaded from a standard HTTP server, just like any other JAR file. However, for the signed applet to be trusted, the local system must trust the key that was used to sign the JAR file.

The Java programming language uses a special file called identitydb.obj to keep track of cryptographic information, including trusted keys.

Creating an End-user identitydb.obj File

You can use the JDK javakey utility to create and update a suitable identitydb.obj file.

Note that identitydb.obj files are managed on a per-user basis. You typically will want to have two user accounts; one for creating your cryptographics keys and signing your JAR files using the private key; and another account for creating a standard identitydb.obj file for use by your end users. Be careful to avoid accidentally handing out the identitydb.obj file that contains the private key!

As part of creating the signed JAR file you should create a suitable signing identity and a certificate. To add this information to a given user's identitydb.obj file, use the javakey -cs command to create a trusted identity and the javakey -ic command to import a certificate. For example, for an identity of "aardvark" you type:

	javakey -cs aardvark true
   	javakey -ic aardvark aadvark.cert

This creates a suitable identitydb.obj file that will cause files signed by aardvark to be trusted.

Configuring End-user Systems

A suitable identitydb.obj file must be set up for each end user who intends to run the signed applet(s).

You can do this either by having each user run the javakey utility (as described above) to create or update their own identitydb.obj file, or you could create a standard identitydb.obj file and then simply ask your users to copy that file onto their systems.

The identitydb.obj file is in the user's home directory as seen by java.

With Java Plug-in 1.2, the standard locations for the home directory of a user "fred" are:

		On Windows NT, in C:/winnt/profiles/fred
		On Windows 95 and Windows 98, in C:/windows
		On multi-user Windows 95 and Windows 98 systems, in C:/windows/profiles/fred
		On Unix systems, in $HOME

Changes in Signed Applets in Java 2 SDK, Standard Edition v 1.2.2

Java 2 SDK, Standard Edition v 1.2.2 contains a number of improvements to the Java security model, including improvements to JAR signing. In particular with Java 2 SDK, Standard Edition v 1.2.2 it will be possible for an enterprise to centrally manage its security policy and the key database(s).

The final release of Java 2 SDK, Standard Edition v 1.2.2 supports both JDK 1.1 and Java 2 SDK, Standard Edition v 1.2.2 signed applets. When a JDK 1.1 signed applet is encountered, the Java runtimes will follow the JDK 1.1 rules and will look for a local identitydb.obj file to validate the signing key. When a Java 2 SDK, Standard Edition v 1.2.2 signed applet is encountered, the Java runtimes will use the richer policy mechanisms provided in Java 2 SDK, Standard Edition v 1.2.2 to validate the signature and to assign the applet appropriate fine-grain permissions.

See Also
Java Plug-in Home Page
RSA Signed Applet Support
Java Plug-in Security
Other Java Plug-in Documentation
JAR--Java Archive
javakey--The Java Security Tool