Documentation Contents

Java™ Cryptography Architecture
Standard Algorithm Name Documentation

for Java Platform Standard Edition 7

• Standard Names
  • AlgorithmParameterGenerator Algorithms
  • AlgorithmParameters Algorithms
  • CertificateFactory Types
  • CertPathBuilder Algorithms
  • CertPath Encodings
  • CertPathValidator Algorithms
  • CertStore Types
  • Cipher (Encryption) Algorithms
  • Configuration Types
  • Exemption Mechanisms
  • GSSAPI Mechanisms
  • KeyAgreement Algorithms
  • KeyFactory Algorithms
  • KeyGenerator Algorithms
  • KeyManagerFactory Algorithms
  • KeyPairGenerator Algorithms
  • KeyStore Types
  • Mac Algorithms
  • MessageDigest Algorithms
  • Policy Types
  • SaslClient Mechanisms
  • SaslServer Mechanisms
  • SecretKeyFactory Algorithms
  • SecureRandom Number Generation (RNG) Algorithms
  • Service Attributes
  • Signature Algorithms
  • SSLContext Algorithms
  • TrustManagerFactory Algorithms
  • XML Signature (XMLSignatureFactory/KeyInfoFactory/TransformService) Mechanisms
  • XML Signature Transform (TransformService) Algorithms
  • JSSE Cipher Suite Names
  • Additional JSSE Standard Names
• Algorithms
  • Specification Template
  • Algorithm Specifications
• Implementation Requirements

Note: The Sun Provider Documentation contains specific provider and algorithm information.

Standard Names

The JDK Security API requires and uses a set of standard names for algorithms, certificate and keystore types. This specification establishes the following names as standard names.

In some cases naming conventions are given for forming names that are not explicitly listed, to facilitate name consistency across provider implementations. Items in angle brackets (such as <digest> and <encryption>) are placeholders to be replaced by a specific message digest, encryption algorithm, or other name.

Note: Standard names are not case-sensitive.

This document includes corresponding lists of standard names relevant to the following security subareas:

• Java PKI Programmer's Guide
• JSSE Reference Guide
• For standard name specifications, See Algorithms.
• Cryptography Architecture
• Single Sign-on Using Kerberos in Java
• The Java SASL API Programming and Deployment Guide
• The XML Digital Signature API Specification

AlgorithmParameterGenerator Algorithms

The algorithm names in this section can be specified when generating an instance of AlgorithmParameterGenerator.

AlgorithmParameters Algorithms

The algorithm names in this section can be specified when generating an instance of AlgorithmParameters.

CertificateFactory Types

The type in this section can be specified when generating an instance of CertificateFactory.

CertPathBuilder Algorithms

The algorithm in this section can be specified when generating an instance of CertPathBuilder.

CertPath Encodings

The following encodings may be passed to the getEncoded method of CertPath or the generateCertPath(InputStream inStream, String encoding) method of CertificateFactory.

    PkiPath ::= SEQUENCE OF Certificate

CertPathValidator Algorithms

The algorithm in this section can be specified when generating an instance of CertPathValidator.

CertStore Types

The type in this section can be specified when generating an instance of CertStore.

Cipher (Encryption) Algorithms

Cipher Algorithm Names

The following names can be specified as the algorithm component in a transformation when requesting an instance of Cipher.

Cipher Algorithm Modes

The following names can be specified as the mode component in a transformation when requesting an instance of Cipher.

Cipher Algorithm Padding

The following names can be specified as the padding component in a transformation when requesting an instance of Cipher.

    block-ciphered struct {
        opaque content[SSLCompressed.length];
        opaque MAC[CipherSpec.hash_size];
        uint8 padding[
            GenericBlockCipher.padding_length];
        uint8 padding_length;
    } GenericBlockCipher;

    sizeof(content) + sizeof(MAC) % block_length = 0, 

Configuration Types

The type in this section can be specified when generating an instance of javax.security.auth.login.Configuration.

Exemption Mechanisms

The following exemption mechanism names can be specified in the permission policy file that accompanies an application considered "exempt" from cryptographic restrictions.

GSSAPI Mechanisms

The following mechanisms can be specified when using GSSAPI. Note that Object Identifiers (OIDs) are specified instead of names to be consistent with the GSSAPI standard.

KeyAgreement Algorithms

The following algorithm names can be specified when requesting an instance of KeyAgreement.

KeyFactory Algorithms

(Except as noted, these classes create keys for which Key.getAlgorithm() returns the standard algorithm name.)

The algorithm names in this section can be specified when generating an instance of KeyFactory.

KeyGenerator Algorithms

The following algorithm names can be specified when requesting an instance of KeyGenerator.

KeyManagerFactory Algorithms

The algorithm name in this section can be specified when generating an instance of KeyManagerFactory.

KeyPairGenerator Algorithms

(Except as noted, these classes create keys for which Key.getAlgorithm() returns the standard algorithm name.)

The algorithm names in this section can be specified when generating an instance of KeyPairGenerator.

KeyStore Types

The types in this section can be specified when generating an instance of KeyStore.

Mac Algorithms

The following algorithm names can be specified when requesting an instance of Mac.

MessageDigest Algorithms

The algorithm names in this section can be specified when generating an instance of MessageDigest.

Policy Types

The type in this section can be specified when generating an instance of Policy.

SaslClient Mechanisms

The mechanisms in this section can be specified when generating an instance of SaslClient.

SaslServer Mechanisms

The mechanisms in this section can be specified when generating an instance of SaslServer.

SecretKeyFactory Algorithms

The following algorithm names can be specified when requesting an instance of SecretKeyFactory.

SecureRandom Number Generation (RNG) Algorithms

The algorithm name in this section can be specified when generating an instance of SecureRandom.

Service Attributes

A cryptographic service is always associated with a particular algorithm or type. For example, a digital signature service is always associated with a particular algorithm (for example, DSA), and a CertificateFactory service is always associated with a particular certificate type (for example, X.509).

The attributes in this section are for cryptographic services. The service attributes can be used as filters for selecting providers.

Both the attribute name and value are case-insensitive.

For example:

   map.put("KeyPairGenerator.DSA",
            "sun.security.provider.DSAKeyPairGenerator");
        map.put("KeyPairGenerator.DSA KeySize", "1024");
        map.put("KeyPairGenerator.DSA ImplementedIn", "Software");

Signature Algorithms

The algorithm names in this section can be specified when generating an instance of Signature.

SSLContext Algorithms

The algorithm names in this section can be specified when generating an instance of SSLContext.

TrustManagerFactory Algorithms

The algorithm name in this section can be specified when generating an instance of TrustManagerFactory.

XML Signature (XMLSignatureFactory/KeyInfoFactory/TransformService) Mechanisms

The mechanism in this section can be specified when generating an instance of XMLSignatureFactory, KeyInfoFactory, or TransformService. The mechanism identifies the XML processing mechanism that an implementation uses internally to parse and generate XML signature and KeyInfo structures. Also, note that each TransformService instance supports a specific transform algorithm in addition to a mechanism. The standard names for the transform algorithms are defined in the next section.

XML Signature Transform (TransformService) Algorithms

The algorithms in this section can be specified when generating an instance of TransformService. Note that URIs are specified instead of names to be consistent with the XML Signature standard. API constants have been defined for each of these URIs, and these are listed in parentheses after each URI in the table that follows.

JSSE Cipher Suite Names

The following list contains the standard JSSE cipher suite names. Over time, various groups have added additional cipher suites to the SSL/TLS namespace. Some JSSE cipher suite names were defined before TLSv1.0 was finalized, and were therefore given the SSL_ prefix. The names mentioned in the TLS RFCs prefixed with TLS_ are functionally equivalent to the JSSE cipher suites prefixed with SSL_.

* TLS_EMPTY_RENEGOTIATION_INFO_SCSV is a new pseudo-cipher suite to support RFC 5746. Read the Transport Layer Security (TLS) Renegotiation Issue section of the JSEE Reference Guide for more information.

Additional JSSE Standard Names

The keyType parameter passed to the chooseClientAlias, chooseServerAlias, getClientAliases, and getServerAliases methods of X509KeyManager specifies the public key types. Each row of the table that follows lists the standard name that should be used for keyType, given the specified certificate type.

The protocols parameter passed to the setEnabledProtocols method of SSLSocket specifies the protocol versions to be enabled for use on the connection. The table that follows lists the standard names that can be passed to setEnabledProtocols or that may be returned by the SSLSocket getSupportedProtocols and getEnabledProtocols methods.

The authType parameter passed to the checkClientTrusted and checkServerTrusted methods of X509TrustManager indicates the authentication type. The table that follows specifies what standard names should be used for the client or server certificate chains.

The Java SE 7 release supports endpoint identification algorithms for TLS 1.2. The algorithm name can be passed to the setEndpointIdentificationAlgorithm() method of javax.net.ssl.SSLParameters. The following table shows the currently recognized names.

Algorithms

This section specifies details concerning some of the algorithms defined in this document. Any provider supplying an implementation of the listed algorithms must comply with the specifications in this section.

To add a new algorithm not specified here, you should first survey other people or companies supplying provider packages to see if they have already added that algorithm, and, if so, use the definitions they published, if available. Otherwise, you should create and make available a template, similar to those found in this section, with the specifications for the algorithm you provide.

Specification Template

The following table shows the fields of the algorithm specifications.

Algorithm Specifications

SHA-1 Message Digest Algorithm

MD2 Message Digest Algorithm

MD5 Message Digest Algorithm

The Digital Signature Algorithm

RSA-based Signature Algorithms, with MD2, MD5 or SHA-1

DSA KeyPair Generation Algorithm

SEED = b869c82b 35d70e1b 1ff91b28 e37a62ec dc34409b
counter = 123
p = fca682ce 8e12caba 26efccf7 110e526d b078b05e decbcd1e b4a208f3
    ae1617ae 01f35b91 a47e6df6 3413c5e1 2ed0899b cd132acd 50d99151
    bdc43ee7 37592e17
q = 962eddcc 369cba8e bb260ee6 b6a126d9 346e38c5

g = 678471b2 7a9cf44e e91a49c5 147db1a9 aaf244f0 5a434d64 86931d2d
    14271b9e 35030b71 fd73da17 9069b32e 2935630e 1c206235 4d0da20a
    6c416e50 be794ca4

SEED = 77d0f8c4 dad15eb8 c4f2f8d6 726cefd9 6d5bb399
counter = 263
p = e9e64259 9d355f37 c97ffd35 67120b8e 25c9cd43 e927b3a9 670fbec5
    d8901419 22d2c3b3 ad248009 3799869d 1e846aab 49fab0ad 26d2ce6a
    22219d47 0bce7d77 7d4a21fb e9c270b5 7f607002 f3cef839 3694cf45
    ee3688c1 1a8c56ab 127a3daf
q = 9cdbd84c 9f1ac2f3 8d0f80f4 2ab952e7 338bf511
g = 30470ad5 a005fb14 ce2d9dcd 87e38bc7 d1b1c5fa cbaecbe9 5f190aa7
    a31d23c4 dbbcbe06 17454440 1a5b2c02 0965d8c2 bd2171d3 66844577
    1f74ba08 4d2029d8 3c1c1585 47f3a9f1 a2715be2 3d51ae4d 3e5a1f6a
    7064f316 933a346d 3f529252

SEED = 8d515589 4229d5e6 89ee01e6 018a237e 2cae64cd
counter = 92
p = fd7f5381 1d751229 52df4a9c 2eece4e7 f611b752 3cef4400 c31e3f80
    b6512669 455d4022 51fb593d 8d58fabf c5f5ba30 f6cb9b55 6cd7813b
    801d346f f26660b7 6b9950a5 a49f9fe8 047b1022 c24fbba9 d7feb7c6
    1bf83b57 e7c6a8a6 150f04fb 83f6d3c5 1ec30235 54135a16 9132f675
    f3ae2b61 d72aeff2 2203199d d14801c7
q = 9760508f 15230bcc b292b982 a2eb840b f0581cf5

g = f7e1a085 d69b3dde cbbcab5c 36b857b9 7994afbb fa3aea82 f9574c0b
    3d078267 5159578e bad4594f e6710710 8180b449 167123e8 4c281613
    b7cf0932 8cc8a6e1 3c167a8b 547c8d28 e0a3ae1e 2bb3a675 916ea37f
    0bfa2135 62f1fb62 7a01243b cca4f1be a8519089 a883dfe1 5ae59f06
    928b665e 807b5525 64014c3b fecf492a

RSA KeyPair Generation Algorithm

DSA Parameter Generation Algorithm

Implementation Requirements

This section defines the security algorithm requirements for Java SE 7 implementations. These requirements are intended to improve the interoperability of Java SE 7 implementations and applications that use these algorithms.

Note that the requirements in this section are not a measure of the strength or security of the algorithm. For example, recent advances in cryptanalysis have found weaknesses in the strength of the MD5 MessageDigest algorithm. It is your responsibility to determine whether the algorithm meets the security requirements of your application.

Every implementation of the Java SE 7 platform must support the specified algorithms in the table that follows. These requirements do not apply to 3rd party providers. Consult the release documentation for your implementation to see if any other algorithms are supported.

[1] No specific Configuration type, Policy type or SecureRandom algorithm is required; however, an implementation-specific default must be provided.

[2] A TLSv1 implementation must support the cipher suite SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA as defined in RFC 2246 and the special signaling cipher suite TLS_EMPTY_RENEGOTIATION_INFO_SCSV for safe renegotiation as defined in RFC 5746.

XML Signature Algorithms

Every implementation of the Java SE 7 platform must support the specified XML Signature algorithms in the table that follows. These requirements do not apply to 3rd party providers. Consult the release documentation for your implementation to see if any other algorithms are supported.

---

Copyright © 1993, 2011, Oracle and/or its affiliates. All rights reserved.

Contact Us