public class PBEKeySpec extends Object implements KeySpec
The password can be viewed as some kind of raw key material, from which the encryption mechanism that uses it derives a cryptographic key.
Different PBE mechanisms may consume different bits of each password character. For example, the PBE mechanism defined in PKCS #5 looks at only the low order 8 bits of each character, whereas PKCS #12 looks at all 16 bits of each character.
You convert the password characters to a PBE key by creating an instance of the appropriate secret-key factory. For example, a secret-key factory for PKCS #5 will construct a PBE key from only the low order 8 bits of each password character, whereas a secret-key factory for PKCS #12 will take all 16 bits of each character.
Also note that this class stores passwords as char arrays instead of
String objects (which would seem more logical), because the
String class is immutable and there is no way to overwrite its
internal value when the password stored in it is no longer needed. Hence,
this class requests the password as a char array, so it can be overwritten
when done.
SecretKeyFactory,
PBEParameterSpec| Constructor and Description |
|---|
PBEKeySpec(char[] password)
Constructor that takes a password.
|
PBEKeySpec(char[] password,
byte[] salt,
int iterationCount)
Constructor that takes a password, salt, iteration count for
generating PBEKey of fixed-key-size PBE ciphers.
|
PBEKeySpec(char[] password,
byte[] salt,
int iterationCount,
int keyLength)
Constructor that takes a password, salt, iteration count, and
to-be-derived key length for generating PBEKey of variable-key-size
PBE ciphers.
|
| Modifier and Type | Method and Description |
|---|---|
void |
clearPassword()
Clears the internal copy of the password.
|
int |
getIterationCount()
Returns the iteration count or 0 if not specified.
|
int |
getKeyLength()
Returns the to-be-derived key length or 0 if not specified.
|
char[] |
getPassword()
Returns a copy of the password.
|
byte[] |
getSalt()
Returns a copy of the salt or null if not specified.
|
public PBEKeySpec(char[] password)
Note: password is cloned before it is stored in
the new PBEKeySpec object.
password - the password.public PBEKeySpec(char[] password,
byte[] salt,
int iterationCount,
int keyLength)
password.
Note: the password and salt
are cloned before they are stored in
the new PBEKeySpec object.
password - the password.salt - the salt.iterationCount - the iteration count.keyLength - the to-be-derived key length.NullPointerException - if salt is null.IllegalArgumentException - if salt is empty,
i.e. 0-length, iterationCount or
keyLength is not positive.public PBEKeySpec(char[] password,
byte[] salt,
int iterationCount)
password.
Note: the password and salt
are cloned before they are stored in the new
PBEKeySpec object.
password - the password.salt - the salt.iterationCount - the iteration count.NullPointerException - if salt is null.IllegalArgumentException - if salt is empty,
i.e. 0-length, or iterationCount is not positive.public final void clearPassword()
public final char[] getPassword()
Note: this method returns a copy of the password. It is the caller's responsibility to zero out the password information after it is no longer needed.
IllegalStateException - if password has been cleared by
calling clearPassword method.public final byte[] getSalt()
Note: this method should return a copy of the salt. It is the caller's responsibility to zero out the salt information after it is no longer needed.
public final int getIterationCount()
public final int getKeyLength()
Note: this is used to indicate the preference on key length for variable-key-size ciphers. The actual key size depends on each provider's implementation.
Submit a bug or feature
For further API reference and developer documentation, see Java SE Documentation. That documentation contains more detailed, developer-targeted descriptions, with conceptual overviews, definitions of terms, workarounds, and working code examples.
Copyright © 1993, 2011, Oracle and/or its affiliates. All rights reserved.
DRAFT ea-b138