News

February 2, 2000 - Applet Deployment Enhancement

JAR files containing support classes for applets can now be placed in the Java^TM Plug-In software's lib/applet/ directory. This reduces startup time for large applets by allowing applet classes to be pre-loaded from the local file system by the applet class-loader, providing the same protections as if they had been downloaded over the network.

Software

JDK^TM Java 2 Standard Edition, SDK v1.2.1

Java 2 Standard Edition, SDK v1.2.1 (formerly known as JDK 1.2.1) contains the new security model and security APIs. The new tools jarsigner, keytool and policytool replace the javakey tool from JDK 1.1.x. The security model supports fine-grain access control, governed by system-wide policy files and per-user policy files. Refer to the online JDK 1.2 Security Documentation for more information.

JAAS 1.0

The Java^TM Authentication and Authorization Service (JAAS) is a framework that supplements the Java 2 platform with user-based authentication and access control capabilities. It includes a Java implementation of the standard Pluggable Authentication Module (PAM) architecture, and provides support for user-based, group-based, or role-based access controls.

JCE 1.2

The Java^TM Cryptography Extension (JCE) 1.2 is a standard extension package for use with the Java Development Kit (JDK^TM) 1.2 software. It is not exportable outside the U.S. and Canada.

JSSE 1.0

The Java^TM Secure Socket Extension (JSSE) is a Java optional package that provides Secure Socket Layer (SSL) and Transport Layer Security (TLS) support for the Java^TM 2 Platform. Using JSSE, developers can provide for the secure passage of data between a client and a server running any application protocol, including HTTP, Telnet, NNTP, and FTP, over TCP/IP. This release of JSSE includes a global version that can be exported outside of the U.S. and Canada.

JDK^TM 1.1.8 Final Version

JDK 1.1.x release includes javakey and jar, which use the JDK 1.1 security APIs. Javakey is used to generate keys and certificates and sign JAR files. Jar is a file archiving utility. The security APIs support hashing, digital signatures, and parsing and generating X.509 certificates.

Java Web Server^TM

The Java Web Server^TM includes support for server-side SSL. Check out the servlet api - the servlet/applet combo is a powerful way to accomplish client-server computing entirely based on the Java platform. Servlets themselves are the Java programming language analogue of C-language server extension APIs, and also provide an efficient replacement for CGI scripts.

HotJava^TM Browser

The HotJava^TM Browser, written entirely in the Java programming language, is a highly customizable, extensible web browser. It offers configurable fine-grain control for signed applets, and built-in SSL support.

Documentation

APIs

JDK 1.2 APIs

JDK 1.2 software includes support for fine-grain access control and external policies.

JAAS 1.0 APIs

The JAAS framework augments the Java^TM 2 Platform with support for both user-based authentication and user-based access controls. 

JCE 1.2 APIs

A revised Java^TM Cryptography Extension (JCE) 1.2 API specification was published at the Workshop on Enterprise Security, June 17-19, 1998, Stanford University, California, U.S.A.

JSSE 1.0 APIs

JSSE implements a Java platform version of Secure Socket Layer (SSL) and Transport Layer Security (TLS) protocols. A revised JavaTM Secure Socket Extension (JSSE) 1.0 API specification was published at the 8th USENIX Security Symposium, August 23-26, 1999, JW Marriott Hotel, Washington D.C., U.S.A.

JDK 1.1 APIs

JDK 1.1 software includes support for digital signatures and message digests. JDK 1.1 release has an export license and is fully exportable world-wide; this is true of any packages built on top of JDK 1.1 software, as well.

User Guides

Security Code Guidelines

Some guidelines to follow when writing code that will allow you to take full advantage of the security provided by the Java platform.

Signed Applet Example (JDK 1.1.x)

A short description of how to use signed applets in JDK 1.1.x software, either with the Java Plug-In software and the popular browsers, or from the appletviewer.

Signed Applet Example (JDK 1.2)

A short description of how to use signed applets in JDK 1.2 software, either with the Java Plug-In software and the popular browsers, or from the appletviewer.

Using javakey

A short self-contained introductory tutorial for the code signing facilities in JDK 1.1 software.

Jar Guide

A short introduction to using the jar tool to create jar files. This describes the applet tag syntax for associating an applet with a .jar file, instead of a .class file.

Recommendations on using JDK 1.1 javakey

Straightforward recommendations for generating and storing keys and certificates in JDK 1.1 release. This will be enhanced in the next JDK release, with support for X.509v3 certificates and externally configurable policy.

Deploying signed applets in Java Plug-in

A description of the signed applet support in Java Plug-in, which allows users to grant (signed) applets all permissions based on their authenticated signers, without having to configure and deploy any policy or keystore configuration files.

Man Pages

javakey: Solaris^TM and Microsoft Windows

javakey is a utility for generating keys and certificates, and signing jar files.

jar: Solaris and Windows

jar is a utility for packaging files of any type into a single archive.

Specifications

JDK 1.2 Security Documentation (April 1998)

Extensive information on the new JDK 1.2 security model: Security Guides, API Specifications, and Security Tools.

Java Cryptographic Architecture

An overview of the abstract APIs that comprise the Java cryptographic architecture.

JDK 1.1 Security Documentation (1997)

A collection of useful links to JDK-specific documentation.

Manifest File Specification

Every jar file includes a manifest file, where meta-information about the archive is stored.

Security Reference Model for Java technology (1996)

This report provides the security reference model for the JDK version 1.0.2 software. It defines the fundamental security requirements for the Java application environment, serves as a basis for a security test plan, and is a first step toward further assurance documentation and analysis.

FAQs, Whitepapers, Articles

Going Beyond the Sandbox: An Overview of the New Security Architecture in the Java^TM Development Kit 1.2

A technical paper by Li Gong, Marianne Mueller, Hemma Prafullchandra and Roland Schemers, published at the USENIX Symposium on Internet Technologies and Systems, Monterey, California, December, 1997.

Secure Computing With Java: Now and the Future

This 28-page overview was prepared for the 1997 JavaOne^SM conference.

CompCon 97 Abstract

This extended abstract, presented at CompCon 97 by Li Gong, presents a high-level overview of new architectural directions for the Java Security API.

Applet Security FAQ

The FAQ explains what applets can and cannot do, under the security manager

Java Security API, postscript or text versions

A 7-page whitepaper that provides an overview of the JDK 1.x security model

Forum 1.1 on Security

A dialog with several network security experts, on what the security challenges are, and where Java should focus its attention

Presentations

JavaOne^SM Conference 1998 Sessions

Look for "Security on the Java Platform", Li Gong, and "Developer's Guide to New Security Features in the New Version of the JDK Software", Roland Schemers.

Java Security API: Present and Near Future

The HTML slides from the 1997 JavaOne conference are online. Li Gong, Java Security Architect, highlights the most important architectural foundations of the Java Security API, and talks about future directions.

Usenix Tutorial

Slides and supporting material for the November 1996 tutorial on Java security. Please do read the disclaimer.

For more info

Java Security Feedback Alias

Information about the java-security@sun.com alias, and an online archive of the questions, comments, and answers from the alias.

Note: the old hypermail archive files were replaced by this mechanism.