Java Command Line Generate Securerandom Key

Posted on by
This class provides a cryptographically strong random number generator (RNG).

A cryptographically strong random number minimally complies with the statistical random number generator tests specified in FIPS 140-2, Security Requirements for Cryptographic ModulesKey generator online. , section 4.9.1. Additionally, SecureRandom must produce non-deterministic output. Therefore any seed material passed to a SecureRandom object must be unpredictable, and all SecureRandom output sequences must be cryptographically strong, as described in RFC 1750: Randomness Recommendations for Security.

  • The following are top voted examples for showing how to use javax.crypto.KeyGenerator.These examples are extracted from open source projects. You can vote up the examples you like and your votes will be used in our system to generate more good examples.
  • The following are Jave code examples for showing how to use setSeed of the java.security.SecureRandom class. You can vote up the examples you like. Your votes will be used in our system to get more good examples.
  • Key generators are constructed using one of the getInstance class methods of this class. KeyGenerator objects are reusable, i.e., after a key has been generated, the same KeyGenerator object can be re-used to generate further keys. There are two ways to generate a key: in an algorithm-independent manner, and in an algorithm-specific manner.

Since this lesson assumes that you don't yet have such keys, you are going to create a keystore named examplestore and create an entry with a newly generated public/private key pair (with the public key in a certificate). Type the following command in your command window to create a keystore named examplestore and to generate keys. Nov 01, 2018 After obtaining an instance of the key generator we have to initialize it. The initialize method takes two parameters, the key size and a source of randomness. We set the key size to 1024 and pass and instance of SecureRandom. Finally to generate the key pairs we call the generateKeyPair method of the KeyPairGenerator class. Additionally, SecureRandom must produce non-deterministic output. Therefore any seed material passed to a SecureRandom object must be unpredictable, and all SecureRandom output sequences must be cryptographically strong, as described in RFC 1750: Randomness Recommendations for Security. If (when) I need to have, in Java, randomness which is good enough for formal cryptography (i.e. Good, and also demonstrably good for regulatory purposes), then I use java.security.SecureRandom to generate an initial seed (at least 16 bytes), that I then run through HMACDRBG (specified in NIST SP800-90A)(the same publication contains the DualECDRBG of sinister fame, but HMACDRBG is.

A caller obtains a SecureRandom instance via the no-argument constructor or one of the getInstance methods:

Many SecureRandom implementations are in the form of a pseudo-random number generator (PRNG), which means they use a deterministic algorithm to produce a pseudo-random sequence from a true random seed. Other implementations may produce true random numbers, and yet others may use a combination of both techniques.

Typical callers of SecureRandom invoke the following methods to retrieve random bytes:

Callers may also invoke the generateSeed method to generate a given number of seed bytes (to seed other random number generators, for example): Note: Depending on the implementation, the generateSeed and nextBytes methods may block as entropy is being gathered, for example, if they need to read from /dev/random on various Unix-like operating systems.

If a code signer does not yet have a suitable private key for signing the code, the key must first be generated, along with a corresponding public key that can be used by the code receiver's runtime system to verify the signature.

Since this lesson assumes that you don't yet have such keys, you are going to create a keystore named examplestore and create an entry with a newly generated public/private key pair (with the public key in a certificate).

Type the following command in your command window to create a keystore named examplestore and to generate keys:

Java Command Line Generate Secure Random Key Generator

You will be prompted to enter passwords for the key and keystore.

Subparts of the keytool Command

Java Command Line Generate Securerandom Key West

Let's look at what each of the keytool subparts mean.

  • The command for generating keys is -genkey.
  • The -alias signFiles subpart indicates the alias to be used in the future to refer to the keystore entry containing the keys that will be generated.
  • The -keystore examplestore subpart indicates the name (and optionally path) of the keystore you are creating or already using.
  • The storepass value that you are promted for specifies the keystore password.
  • The keypass value that you are prompted for specifies a password for the private key about to be generated. You will always need this password in order to access the keystore entry containing that key. The entry doesn't have to have its own password. When you are prompted for the key password, you are given the option of letting it be the same as the keystore password.
Java command line generate securerandom key west

Note: For security reasons you should not set your key or keystore passwords on the command line, because they can be intercepted more easily that way.

Java Command Line Generate Securerandom Key Code

Distinguished-Name Information

If you use the preceding keystore command, you will be prompted for your distinguished-name information. Following are the prompts; the bold indicates what you should type.

Command Results

Command

The keytool command creates the keystore named examplestore (if it doesn't already exist) in the same directory in which the command is executed. The command generates a public/private key pair for the entity whose distinguished name has a common name of Susan Jones and the organizational unit of Purchasing.

The command creates a self-signed certificate that includes the public key and the distinguished-name information. (The distinguished name you supply will be used as the 'subject' field in the certificate.) This certificate will be valid for 90 days, the default validity period if you don't specify a -validity option. The certificate is associated with the private key in a keystore entry referred to by the alias signFiles.

Java Command Line Generate Securerandom Keyboard

Self-signed certificates are useful for developing and testing an application. However, users are warned that the application is signed with an untrusted certificate and asked if they want to run the application. To provide users with more confidence to run your application, use a certificate issued by a recognized certificate authority.

Java Command Line Generate Securerandom Keys

Note: The command could be shorter if option defaults are accepted or you wish to be prompted for various values. Whenever you execute a keytool command, defaults are used for unspecified options that have default values, and you are prompted for any required values. For the genkey command, options with default values include alias (whose default is mykey), validity (90 days), and keystore (the file named .keystore in your home directory). Required values include dname, storepass, and keypass.