Java Crypto API questions
Today, CP's own Marianne Mueller was scheduled to give a talk at JavaOne on the eagerly awaited (at least by this user) Java Crypto API. I could not attend the conference, but downloaded the slides for the presentation <http://java.sun.com/javaone/pres/Crypto.pdf> Viewing the slides left me with some questions that I hope someone that attended the talk might be able to answer: o "Developers do not call into Security Packages directly." It seems the developer calls java.security (presumably provided by Sun), which then will call the Security Packages. Is this view correct? o "Security Packages must be signed. Policy for signing is public and open." I assume the packages must be signed by Sun. How much will it cost to have a package signed? How do I obtain a copy of this "public and open" policy? o "Exportable API. Exportable applications." One code example shows performing a DES encryption. Another slide mentions "Support for [...] RSA." This is exportable? What am I missing? o Where can I get more info on "Jeeves", the Java HTTP Server? TIA, Disclaimer: My opinions are my own, not those of my employer. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.
On Thu, 30 May 1996, Lucky Green wrote:
o "Security Packages must be signed. Policy for signing is public and open." I assume the packages must be signed by Sun. How much will it cost to have a package signed? How do I obtain a copy of this "public and open" policy?
o "Exportable API. Exportable applications." One code example shows performing a DES encryption. Another slide mentions "Support for [...] RSA." This is exportable? What am I missing?
My guess would be that the first of these two points answers the second. Everything is exportable -- except signed third-party security packages. My bet would be that the exportable code would not be more than RC4-40 or perhaps 1DES, but that a signed package would go to RC4-128, 3DES, and RSA-1024. However, the signature on that package would be on the condition that the vendor/distributor of that package follow all export regulations. This is the way Micro$oft's CAPI is supposed to work; it's got commodities jurisdiction approval already, my bet is Sun can get the same. ---------- Jon Lasser (410)532-7138 - Obscenity is a crutch for jlasser@rwd.goucher.edu inarticulate motherfuckers. http://www.goucher.edu/~jlasser/ Finger for PGP key (1024/EC001E4D) - Fuck the CDA.
participants (2)
-
Moltar Ramone -
shamrock＠netcom.com