Using the KeyGenerator class

9.3 Key Factories

There is another way to generate keys, and that is through the use of key factories. Key factories are most often used to import and export keys; the factory translates between an external format of the key that is easily transportable and the internal implementation of the key. There are certain types of keys, however, that can only be obtained via a key factory since there is no key generator to produce them e.g., a password−based encryption key. There are two external representations by which a key may be transmitted −− by its encoded format or by the parameters that were used to generate the key. Either of these representations may be encapsulated in a key specification, which is used to interact with the KeyFactory class java.security.KeyFactory and the SecretKeyFactory class javax.crypto.SecretKeyFactory .

9.3.1 The KeyFactory Class

Converting asymmetric keys is done with this class: public class KeyFactory Provide an infrastructure for importing and exporting keys according to the specific encoding format or parameters of the key.

9.3.1.1 Using the KeyFactory class

The KeyFactory class is an engine class, which provides the typical method of instantiating itself: public static final KeyFactory getInstanceString alg public static final KeyFactory getInstanceString alg, String provider Create a key factory capable of importing and exporting keys that were generated with the given algorithm. The class that implements the key factory comes from the named provider or is located according to the standard rules for provider engines. If a key factory that implements the given algorithm is not found, a NoSuchAlgorithmException is generated. If the named provider is not found, a NoSuchProviderException is generated. A key factory presents the following public methods: public final Provider getProvider Return the provider that implemented this particular key factory. public final PublicKey generatePublicKeySpec ks public final PrivateKey generatePrivateKeySpec ks These methods are used to import a key: they create the key based on the imported data that is held in the key specification object. If the key cannot be created, an InvalidKeySpecException is thrown. public final KeySpec getKeySpecKey key, Class keySpec This method is used to export a key: it creates a key specification based on the actual key. If the key specification cannot be created, an InvalidKeySpecException is thrown. public final Key translateKeyKey key Translate a key from an unknown source into a key that was generated from this object. This method can be used to convert the type of a key that was loaded from a different security provider e.g., a DSA key generated from the XYZ provider −− type com.xyz.DSAPrivateKey −− could be converted to a DSA key generated from the Sun provider −− type sun.security.provider.DSAPrivateKey . If the key cannot be translated, an InvalidKeyException is generated. public final String getAlgorithm Return the algorithm this key factory supports. Well defer examples of these methods until we discuss the KeySpec class later.

9.3.1.2 Implementing a key factory

Like all engines, the key factory depends on a service provider interface class: the KeyFactorySpi class java.security.KeyFactorySpi : public abstract class KeyFactorySpi Provide the set of methods necessary to implement a key factory that is capable of importing and exporting keys in a particular format. The KeyFactorySpi class contains the following methods; since each of these methods is abstract, our class must provide an implementation of all of them: protected abstract PublicKey engineGeneratePublicKeySpec ks protected abstract PrivateKey engineGeneratePrivateKeySpec ks Generate of the public or private key. Depending on the key specification, this means either decoding the data of the key or regenerating the key based on specific parameters to the key algorithm. If the key cannot be generated, an InvalidKeyException should be thrown. protected abstract KeySpec engineGetKeySpecKey key, Class keySpec Export the key. Depending on the key class specification, this means either encoding the data e.g., by calling the getEncoded method or saving the parameters that were used to generate the key. If the specification cannot be created, an InvalidKeySpecException should be thrown. protected Key engineTranslateKeyKey key Perform the actual translation of the key. This is typically performed by translating the key to its specification and back. If the key cannot be translated, an InvalidKeyException should be thrown. Although we show how to use a key factory later, we wont show how to implement one; the amount of code involved is large and relatively uninteresting. However, the online examples do contain a sample key factory implementation if youre interested in seeing one.

9.3.2 The SecretKeyFactory Class

The second engine that well look at is the SecretKeyFactory class 152