Which is the standard Java crypto API?

Question

Hi,

I want to implement a tool in Java to learn more about cryptography. I know that there is a security package with some crypto stuff inside. Now I saw there is a dedicated javax.crypto package inside the SDK.

Where is the difference? Are they both up to date?

I wanted to start my tool with some historical ciphers. But it should not be limited to them. So I need a nice abstraction through interfaces or something like that.

Whats the better choice of the two APIs? Is there another API I should have a look at?

Thanks in advance.

Answer 1

It's a mix of the two packages.

Here are the relevant docs

Answer 2

You could take a look at The Legion of the Bouncy Castle

Answer 3

Check out keyczar.

Answer 4

The updated docs.

Answer 5

http://www.jasypt.org is also a good option.

Answer 6

To answer the question asked:

javax.crypto deals with low level crypto: encryption, decryption, and hashing. It's where the Cipher class is defined.

java.security deals with everything else: key management, certtificate management, and signatures.

Those interfaces abstract JCE providers, which implement specific algorithms. Sun provides some, and BouncyCastle is another good one.

If you are planning some custom ciphers for which there is not already an implementation, you'll be implementing your own JCE provider, and specifically extending javax.crypto.CipherSpi.

It's not difficult, but you have to read through the documentation on how to do that. In order for the JCE to allow your provider, you will have to apply to Sun for a certificate, basically faxing them a signed statement that you are aware of the US export restrictions on crypto libraries.

Answer 7

I have add another vote for Bouncy Castle. I recently needed an encryption algorithm that worked across multiple platforms (Java & C#). We tried to use the standard Java and C# encryption packages but we found too many issues with the encrypt/decrypt.

Looking around, Bouncy Castle had a .NET implementation in addition to a Java. Although, .NET implementation of Bouncy Castle is not well documented, it is essentially the same as Java.

Answer 8

Java Cryptography Extensions (The Practical Guide Series) by Jason Weiss.

I spent a lot on books, I have a lot of books, all of them very good. ( if you have a masters in math )

This book gets to the point, I had a cipher working in 5-6 hours. I had been working 5-6 years to get one running. Much practical advice from decades of doing actual infosec.