// get an instance of the default GSSManager GSSManager manager = GSSManager.getInstance(); // Server name to connect GSSName serverName = manager.createName(server, null); // Create the context GSSContext context = manager.createContext(serverName, krb5Oid, null, GSSContext.DEFAULT_LIFETIME); // Establish the context token = context.initSecContext(token, 0, token.length); // Send a token to the server if one was generated by // initSecContext if (token != null) { System.out.println("Will send token of size " + token.length + " from initSecContext."); outStream.writeInt(token.length); outStream.write(token); outStream.flush(); } // More tokens ... if (context.getMutualAuthState()) System.out.println("Mutual authentication took place!"); // Encrypt message and send /* * The first MessageProp argument is 0 to request * the default Quality-of-Protection. * The second argument is true to request * privacy (encryption of the message). */ MessageProp prop = new MessageProp(0, true); /* * Encrypt the data and send it across. Integrity protection * is always applied, irrespective of encryption. */ token = context.wrap(messageBytes, 0, messageBytes.length, prop); System.out.println("Will send wrap token of size " + token.length); outStream.writeInt(token.length); outStream.write(token); outStream.flush();
Next, here's the server's outline:
// get an instance of the default GSSManager GSSManager manager = GSSManager.getInstance(); // Server name to connect GSSName serverName = manager.createName(server, null); // Create the context using default credentials GSSContext context = manager.createContext((GSSCredential)null); // Establish the context while (!context.isEstablished()) { token = new byte[inStream.readInt()]; System.out.println("Will read input token of size " + token.length + " for processing by acceptSecContext"); inStream.readFully(token); token = context.acceptSecContext(token, 0, token.length); // Send a token to the peer if one was generated by // acceptSecContext if (token != null) { System.out.println("Will send token of size " + token.length + " from acceptSecContext."); outStream.writeInt(token.length); outStream.write(token); outStream.flush(); } } System.out.print("Context Established! "); if (context.getMutualAuthState()) System.out.println("Mutual authentication took place!"); // receive and decrypt message /* * Create a MessageProp which unwrap will use to return * information such as the Quality-of-Protection that was * applied to the wrapped token, whether or not it was * encrypted, etc. Since the initial MessageProp values * are ignored, it doesn't matter what they are set to. */ MessageProp prop = new MessageProp(0, false); /* * Read the token. This uses the same token byte array * as that used during context establishment. */ token = new byte[inStream.readInt()]; System.out.println("Will read token of size " + token.length); inStream.readFully(token); byte[] bytes = context.unwrap(token, 0, token.length, prop); String str = new String(bytes); System.out.println("Received data \"" + str + "\" of length " + str.length()); System.out.println("Encryption applied: " + prop.getPrivacy());
JGSS API example programs
The JGSS installation includes sample programs. This section demonstrates how to run the client and server programs using JGSS for secure message exchange.
Before running the programs, you should have access to a Kerberos environment. However, installing and configuring Kerberos is not something for the fainthearted, so get some help if you need it.
Start kdc
on the network. Start the server program. The server waits in a loop for connections. The following output illustrates the remaining steps through the program:
C:\rags\>java -Djava.security.krb5.realm=JILEBI.SUN.COM -Djava.security.krb5.kdc=jujub -Djavax.security.auth.useSubjectCredsOnly=false -Djava.security.auth.login.config=bcsLogin.conf SampleServer 9696 Waiting for incoming connection... Got connection from client /24.128.136.197 Will read input token of size 490 for processing by acceptSecContext Kerberos username [rags]: raghavan Kerberos password for raghavan: Will send token of size 106 from acceptSecContext. Context Established! Client is raghavan@JILEBI.SUN.COM Server is raghavan@JILEBI.SUN.COM Mutual authentication took place! Will read token of size 61 Received data "Hello There! " of length 13 Confidentiality applied: true Will send MIC token of size 37 Closing connection with client /24.128.136.197 Waiting for incoming connection...
Now run the client program. The output below illustrates the steps through the program:
C:\rags>java -Djava.security.krb5.realm=JILEBI.SUN.COM -Djava.security.krb5.kdc=jujub -Djavax.security.auth.useSubjectCredsOnly=false -Djava.security.auth.login.config=bcsLogin.conf SampleClient raghavan anvil 9696 Connected to server anvil/24.128.136.197 Kerberos username [rags]: raghavan Kerberos password for raghavan: Will send token of size 490 from initSecContext. Will read input token of size 106 for processing by initSecContext Context Established! Client is raghavan@JILEBI.SUN.COM Server is raghavan Mutual authentication took place! Will send wrap token of size 61 Will read token of size 37 Verified received MIC for message. Exiting...
The client and server programs establish a connection, mutually authenticate, and exchange a message with confidentiality assured.
JGSS and JSSE
You may wonder how the JGSS approach differs from the JSSE approach, which can also mutually authenticate the client and server and securely exchange messages. A cursory examination of the commands used to run the example programs show that the JGSS sample programs don't use the truststore. Instead, the mutual authentication proceeds with Kerberos. The other differences between the two are documented in the JGSS documentation and summarized in the table below.
Comparison of JGSS and JSSE. (Condensed from Sun Microsystems's "When to Use Java GSS-API vs. JSSE.")
|
Security is everyone's business
In this article, we looked primarily at the new features of J2SE 1.4 security. Java security has continually evolved by enhancing the flexibility of a secure environment. The movement of the optional packages into the core and the two new packages I discussed make it easier to incorporate a variety of security solutions in a portable fashion.
Throughout this series I've strived to offer simple examples to drive home the concepts. I leave it as an exercise to you to build more complex and realistic solutions. I hope those who wish to build more complex solutions will benefit from a knowledge of these simple examples and concepts.
Learn more about this topic
- "Java Security Evolution and Concepts," Raghavan N. Srinivas (JavaWorld):
- Part 1Learn computer security concepts and terms in this introductory overview (April 2000)
- Part 2Discover the ins and outs of Java security (July 2000)
- Part 3Tackle Java applet security with confidence (December 2000)
- Part 4Learn how optional packages extend and enhance Java security (May 2001)
- Part 5J2SE 1.4 offers numerous improvements to Java security (December 2001)
- Java security resources from java.sun.com:
- For comprehensive Java security information, read Sun Microsystems' Java Security API page
http://java.sun.com/security - For the latest documentation on Java security, read the documentation from Java 2 1.4
http://java.sun.com/j2se/1.4/docs/relnotes/features.html#security - "Java 2 Platform, Standard Edition, v 1.4.0 API Specification"
http://java.sun.com/j2se/1.4/docs/api/index.html - "Java Cryptography Extension (JCE) Reference Guide"
http://java.sun.com/j2se/1.4/docs/guide/security/jce/JCERefGuide.html - "Java Secure Socket Extension (JSSE) Reference Guide"
http://java.sun.com/j2se/1.4/docs/guide/security/jsse/JSSERefGuide.html - For "Archives of java-security@sun.com," see
http://archives.java.sun.com/archives/java-security.html - "Frequently Asked Questions -- Java Security"
http://java.sun.com/sfaq/ - Java 2 SDK platform security tools
http://java.sun.com/j2se/1.4/docs/tooldocs/tools.html#security - "Default Policy Implementation and Policy File Syntax"
http://java.sun.com/j2se/1.3/docs/guide/security/PolicyFiles.html - "JDK 1.2 - Signed Applet Example,"
http://java.sun.com/security/signExample12/ - Java Plug-in documentation and download
http://java.sun.com/products/plugin/index.html - "Java Certification Path API Programmer's Guide," Sean Mullan
http://java.sun.com/j2se/1.4/docs/guide/security/certpath/CertPathProgGuide.html - "Java Authentication and Authorization Service (JAAS) Reference Guide"
http://java.sun.com/j2se/1.4/docs/guide/security/jaas/JAASRefGuide.html - "Introduction to JAAS and Java GSS-API Tutorials"
http://java.sun.com/j2se/1.4/docs/guide/security/jgss/tutorials/index.html
- Security-related Java Specification Requests at the Java Community Process:
- Java Certification Path API (JSR 000055)
http://jcp.org/jsr/detail/055.jsp - Java GSS-API (JSR 000072)
http://www.jcp.org/jsr/detail/72.jsp
- Other important Java security resources:
- A list of CAs for obtaining code-signing certificateshttps://certs.netscape.com/client.html
- Netscape's security tools, including signtool
http://developer.netscape.com/docs/manuals/index.html?content=security.html - A comprehensive list of security-related problems with suggested remedial action, known as CERT advisories
http://www.cert.org/ - Applied CryptographyProtocols, Algorithms, and Source Code in C, Second Edition, Bruce Schneier (John Wiley and Sons, 1996; ISBN0471117099) -- a fascinating book on the science and politics of cryptography
http://www.amazon.com/exec/obidos/ASIN/0471117099/javaworld - RSA Labs' FAQ about today's cryptography (in PDF format)ftp://ftp.rsasecurity.com/pub/labsfaq/labsfaq4.pdf
- X.509 standard for certificates
http://www.ietf.org/rfc/rfc2459.txt - Generic Security Service API Version 2Java Bindings
http://www.ietf.org/rfc/rfc2853.txt - Kerberos information, including source code and binaries
http://web.mit.edu/kerberos/www/
- JavaWorld's Java security resources:
- "Construct Secure Networked Applications with Certificates," Todd Sundsted (JavaWorld):
- Part 1Certificates add value to public-key cryptography (January 2001)
- Part 2Learn to use X.509 certificates (February 2001)
- Part 3Use the Java CRL and X509CRL classes (March 2001)
- Part 4Authenticate clients and servers, and verify certificate chains (April 2001)
- For more Java security stories, visit the Security section of JavaWorld's Topical Index
http://www.javaworld.com/channel_content/jw-security-index.shtml - Discuss Java security in our Java Security discussion
http://forums.idg.net/webx?50@@.ee6b80e - JavaWorld's Java Bookstore security page can point you to numerous security-related books
http://www.javaworld.com/javaworld/books/jw-books-security.html - Sign up for JavaWorld's free Enterprise Java newsletter
http://www.javaworld.com/subscribe
- You'll find a wealth of IT-related articles from our sister publications at IDG.net
This story, "Java security evolution and concepts, Part 5" was originally published by JavaWorld.