Package org.mozilla.jss.crypto
Interface CryptoToken
- All Known Implementing Classes:
PK11Token
public interface CryptoToken
A CryptoToken performs cryptographic operations and stores
cryptographic items, such as keys and certs. It corresponds to a
Cryptographic Service Provider (CSP) in CDSA, and to a PKCS #11 token.
Instances of CryptoToken are obtained from CryptoManager.
- See Also:
-
Field Summary
FieldsModifier and TypeFieldDescriptionstatic final int
Need to provide a password before each crypto operation.static final int
Login once, never need to re-enter the password until you log out.static final int
Need to re-login after a period of time. -
Method Summary
Modifier and TypeMethodDescriptionvoid
changePassword
(PasswordCallback oldpw, PasswordCallback newpw) Change the password of this token.cloneKey
(SymmetricKey key) Clones a SymmetricKey from a different token onto this token.boolean
doesAlgorithm
(Algorithm alg) Determines whether this token supports the given algorithm.boolean
Deep comparison operation.generateCertRequest
(String subject, int keysize, String keyType, byte[] P, byte[] Q, byte[] G) Generates a b64 encoded PKCS10 blob used for making cert request.getCipherContext
(EncryptionAlgorithm algorithm) Creates a Cipher object, which can be used for encryption and decryption.Get the CryptoStore interface to this token's objects.getDigestContext
(DigestAlgorithm algorithm) Creates a Digest object.getKeyGenerator
(KeyGenAlgorithm algorithm) Creates a KeyGenerator object, which can be used to generate symmetric encryption keys.getKeyPairGenerator
(KeyPairAlgorithm algorithm) Creates a KeyPairGenerator object, which can be used to generate key pairs.getKeyWrapper
(KeyWrapAlgorithm algorithm) int
Returns the login mode of this token: ONE_TIME, TIMEOUT, or EVERY_TIME.int
Returns the login timeout period.getName()
Obtain the nickname, or label, of this token.getSignatureContext
(SignatureAlgorithm algorithm) Creates a Signature object, which can perform signing and signature verification.void
importPublicKey
(PublicKey pubKey, boolean permanent) void
initPassword
(PasswordCallback securityOfficerPW, PasswordCallback userPW) Initialize the password of this token.boolean
Find out if the token is currently logged in.boolean
Determines whether this token is currently present.void
login
(PasswordCallback pwcb) Login to the token.void
logout()
Logout of the token.boolean
returns true if this token needs to be logged into before it can be used.boolean
Determine whether the password has been initialized yet.void
setLoginMode
(int mode) Sets the login mode of this token.void
setLoginTimeoutMinutes
(int timeoutMinutes) Sets the timeout period for logging in.
-
Field Details
-
ONE_TIME
static final int ONE_TIMELogin once, never need to re-enter the password until you log out.- See Also:
-
TIMEOUT
static final int TIMEOUTNeed to re-login after a period of time.- See Also:
-
EVERY_TIME
static final int EVERY_TIMENeed to provide a password before each crypto operation.- See Also:
-
-
Method Details
-
getSignatureContext
Signature getSignatureContext(SignatureAlgorithm algorithm) throws NoSuchAlgorithmException, TokenException Creates a Signature object, which can perform signing and signature verification. Signing and verification cryptographic operations will take place on this token. The signing key must be located on this token.- Parameters:
algorithm
- The algorithm used for the signing/verification.- Throws:
NoSuchAlgorithmException
- If the given algorithm is not supported by this provider.TokenException
-
getDigestContext
JSSMessageDigest getDigestContext(DigestAlgorithm algorithm) throws NoSuchAlgorithmException, DigestException Creates a Digest object. Digesting cryptographic operations will take place on this token.- Parameters:
algorithm
- The algorithm used for digesting.- Throws:
NoSuchAlgorithmException
- If this provider does not support the given algorithm.DigestException
-
getCipherContext
Cipher getCipherContext(EncryptionAlgorithm algorithm) throws NoSuchAlgorithmException, TokenException Creates a Cipher object, which can be used for encryption and decryption. Cryptographic operations will take place on this token. The keys used in the operations must be located on this token.- Parameters:
algorithm
- The algorithm used for encryption/decryption.- Throws:
NoSuchAlgorithmException
- If this provider does not support the given algorithm.TokenException
-
getSymmetricKeyDeriver
- Throws:
TokenException
-
getKeyWrapper
KeyWrapper getKeyWrapper(KeyWrapAlgorithm algorithm) throws NoSuchAlgorithmException, TokenException -
getKeyGenerator
KeyGenerator getKeyGenerator(KeyGenAlgorithm algorithm) throws NoSuchAlgorithmException, TokenException Creates a KeyGenerator object, which can be used to generate symmetric encryption keys. Any keys generated with this KeyGenerator will be generated on this token.- Parameters:
algorithm
- The algorithm that the keys will be used with.- Throws:
NoSuchAlgorithmException
- If this token does not support the given algorithm.TokenException
-
cloneKey
SymmetricKey cloneKey(SymmetricKey key) throws SymmetricKey.NotExtractableException, InvalidKeyException, TokenException Clones a SymmetricKey from a different token onto this token.- Throws:
SymmetricKey.NotExtractableException
- If the key material cannot be extracted from the current token.InvalidKeyException
- If the owning token cannot process the key to be cloned.TokenException
-
getKeyPairGenerator
KeyPairGenerator getKeyPairGenerator(KeyPairAlgorithm algorithm) throws NoSuchAlgorithmException, TokenException Creates a KeyPairGenerator object, which can be used to generate key pairs. Any keypairs generated with this generator will be generated on this token.- Parameters:
algorithm
- The algorithm that the keys will be used with (RSA, DSA, EC, etc.)- Throws:
NoSuchAlgorithmException
- If this token does not support the given algorithm.TokenException
-
generateCertRequest
String generateCertRequest(String subject, int keysize, String keyType, byte[] P, byte[] Q, byte[] G) throws TokenException, InvalidParameterException, PQGParamGenException Generates a b64 encoded PKCS10 blob used for making cert request. Begin/End brackets included.- Parameters:
subject
- subject dn of the certificatekeysize
- size of the keykeyType
- "rsa" or "dsa"P
- The DSA prime parameterQ
- The DSA sub-prime parameterG
- The DSA base parameter- Returns:
- base64 encoded pkcs10 certificate request with Begin/end brackets
- Throws:
TokenException
InvalidParameterException
PQGParamGenException
-
doesAlgorithm
Determines whether this token supports the given algorithm.- Parameters:
alg
- A JSS algorithm. Note that for Signature, a token may fail to support a specific SignatureAlgorithm (such as RSASignatureWithMD5Digest) even though it does support the generic algorithm (RSASignature). In this case, the signature operation will be performed on that token, but the digest operation will be performed on the internal token.- Returns:
- true if the token supports the algorithm.
-
login
Login to the token. If a token is logged in, it will not trigger password callbacks.- Parameters:
pwcb
- The password callback for this token.- Throws:
IncorrectPasswordException
- If the supplied password is incorrect.TokenException
- See Also:
-
logout
Logout of the token.- Throws:
TokenException
-
getLoginMode
Returns the login mode of this token: ONE_TIME, TIMEOUT, or EVERY_TIME. The default is ONE_TIME.- Throws:
TokenException
- If an error occurs on the token.- See Also:
-
setLoginMode
Sets the login mode of this token.- Parameters:
mode
- ONE_TIME, TIMEOUT, or EVERY_TIME- Throws:
TokenException
- If this mode is not supported by this token, or an error occurs on the token.- See Also:
-
getLoginTimeoutMinutes
Returns the login timeout period. The timeout is only used if the login mode is TIMEOUT.- Throws:
TokenException
- If an error occurs on the token.- See Also:
-
setLoginTimeoutMinutes
Sets the timeout period for logging in. This will only be used if the login mode is TIMEOUT.- Throws:
TokenException
- If timeouts are not supported by this token, or an error occurs on the token.- See Also:
-
isLoggedIn
Find out if the token is currently logged in.- Throws:
TokenException
- See Also:
-
needsLogin
returns true if this token needs to be logged into before it can be used.- Throws:
TokenException
- See Also:
-
initPassword
void initPassword(PasswordCallback securityOfficerPW, PasswordCallback userPW) throws IncorrectPasswordException, AlreadyInitializedException, TokenException Initialize the password of this token.- Parameters:
securityOfficerPW
- A callback to obtain the password of the SecurityOfficer. Pass in a NullPasswordCallback if there is no security officer password. Must not be null.userPW
- A callback to obtain the new password for this token. Must not be null.- Throws:
IncorrectPasswordException
- If the supplied security officer password is incorrect.AlreadyInitializedException
- If the token only allows one password initialization, and it has already occurred.TokenException
- If an error occurs on the token.
-
passwordIsInitialized
Determine whether the password has been initialized yet. Some tokens (such as the Netscape Internal Key Token) don't allow initializing the PIN more than once.- Throws:
TokenException
- If an error occurs on the token.
-
changePassword
void changePassword(PasswordCallback oldpw, PasswordCallback newpw) throws IncorrectPasswordException, TokenException Change the password of this token.- Parameters:
oldpw
- A callback (which could be just a Password) to retrieve the current password.newpw
- A callback (which could be just a Password) to retrieve the new password.- Throws:
IncorrectPasswordException
- If the supplied old password is incorrect.TokenException
-
getName
Obtain the nickname, or label, of this token.- Throws:
TokenException
- If an error occurs on the token.
-
getCryptoStore
CryptoStore getCryptoStore()Get the CryptoStore interface to this token's objects. -
equals
Deep comparison operation. Use this, rather than ==, to determine whether two CryptoTokens are the same. -
isPresent
boolean isPresent()Determines whether this token is currently present. This could return false if the token is a smart card that was removed from its slot. -
importPublicKey
- Throws:
TokenException
-