Using the KeyFactory class

specific encoded key specification object. public abstract String getFormat Return the string that represents the format of the encoded data e.g., PKCS8.

9.3.3.2 The AlgorithmParameterSpec interface

In addition to their encoded format, keys are typically able to be specified by providing the parameters to the algorithm that produced the key. Specifying keys in this manner is a function of the AlgorithmParameterSpec interface java.security.spec.AlgorithmParameterSpec : public interface AlgorithmParameterSpec Provide an infrastructure for specifying keys based on the parameters used to generate them. Implementations of this interface have specific methods that are used to retrieve or set the parameters within the object.

9.3.4 A Key Factory Example

As we mentioned at the beginning of this section, the prime reason for key factories is that they give us the ability to import and export keys. Exporting a key specification is typically done by transmitting the individual data elements of the key specification those individual elements vary by the type of key. Importing a key specification typically involves constructing the specification with the transmitted elements as parameters to the constructor. Heres an example using a DSA algorithmic parameter specification. Well look first at exporting a key: package javasec.samples.ch09; import java.security.; import java.security.spec.; import java.io.; public class Export { public static void mainString args[] { try { KeyPairGenerator kpg = KeyPairGenerator.getInstanceDSA; kpg.initialize512, new SecureRandom ; KeyPair kp = kpg.generateKeyPair ; Class spec = Class.forName java.security.spec.DSAPrivateKeySpec; KeyFactory kf = KeyFactory.getInstanceDSA; DSAPrivateKeySpec ks = DSAPrivateKeySpec kf.getKeySpeckp.getPrivate , spec; FileOutputStream fos = new FileOutputStreamexportedKey; ObjectOutputStream oos = new ObjectOutputStreamfos; oos.writeObjectks.getX ; oos.writeObjectks.getP ; oos.writeObjectks.getQ ; oos.writeObjectks.getG ; } catch Exception e { e.printStackTrace ; } } } Two items are interesting in this code. First, one argument to the getKeySpec method is a class object, requiring us to construct the class object using the forName method a somewhat unusual usage. Then, once we have the key specification itself, we have to figure out how to transmit the specification. Since in this case the specification is an algorithmic specification, we chose to write out the individual parameters from the specification. [2] If we had used an encoded key specification, we simply would have written out the byte array returned from the getEncoded method. [2] The DSAPrivateKeySpec class −− like all key specification classes −− is not serializable itself. But for reasons that well discuss later, its better not to serialize key classes that are to be imported into another Java virtual machine anyway. We can import this key as follows: package javasec.samples.ch09; import java.security.; import java.security.spec.; import java.io.; import java.math.; public class Import { public static void mainString args[] { try { FileInputStream fis = new FileInputStreamexportedKey; ObjectInputStream ois = new ObjectInputStreamfis; DSAPrivateKeySpec ks = new DSAPrivateKeySpec BigInteger ois.readObject , BigInteger ois.readObject , BigInteger ois.readObject , BigInteger ois.readObject ; KeyFactory kf = KeyFactory.getInstanceDSA; PrivateKey pk = kf.generatePrivateks; System.out.printlnGot private key; } catch Exception e { e.printStackTrace ; } } } This example is predictably symmetric to exporting a key.

9.3.4.1 Existing key specification classes

Table 9−1 lists all the classes that can be used to import and export or translate keys. To use this table, find an appropriate key specification that youd like to use. Thats simply a matter of finding the specification that matches the type of key that you have e.g., the specifications beginning with DH are for Diffie−Hellman keys. Next use the methods shown to export data from the key spec or to create a new key spec. Then you can use the key factory to create a key from the specification. Note that the SecretKeySpec class is an exception to this last step: that class implements the SecretKey interface already. Once youve instantiated a SecretKeySpec object, youve created a secret key. Chapter 9. Keys and Certificates