javax.crypto.spec
Class PBEKeySpec

java.lang.Object
  |
  +--javax.crypto.spec.PBEKeySpec

All Implemented Interfaces:

java.security.spec.KeySpec

public class PBEKeySpec

extends java.lang.Object

implements java.security.spec.KeySpec

A user-chosen password that can be used with password-based encryption (PBE).

The password can be viewed as some kind of raw key material, from which the encryption mechanism that uses it derives a cryptographic key.

Different PBE mechanisms may consume different bits of each password character. For example, the PBE mechansim defined in PKCS #5 looks at only the low order 8 bits of each character, whereas PKCS #12 looks at all 16 bits of each character.

You convert the password characters to a PBE key by creating an instance of the appropriate secret-key factory. For example, a secret-key factory for PKCS #5 will construct a PBE key from only the low order 8 bits of each password character, whereas a secret-key factory for PKCS #12 will take all 16 bits of each character.

Also note that this class stores passwords as char arrays instead of String objects (which would seem more logical), because the String class is immutable and there is no way to overwrite its internal value when the password stored in it is no longer needed. Hence, this class requests the password as a char array, so it can be overwritten when done.

See Also:

SecretKeyFactory, PBEParameterSpec

Constructor Summary

PBEKeySpec(char[] password)
Constructor that takes a password.

Method Summary

char[]

getPassword() Returns the password.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

PBEKeySpec

public PBEKeySpec(char[] password)

Constructor that takes a password.

Note that the given password is cloned before it is stored in the new PBEKeySpec object.

Parameters:

password - - the password.

Method Detail

getPassword

public final char[] getPassword()

Returns the password.

Note that this method returns a reference to the password. It is the caller's responsibility to zero out the password information after it is no longer needed.

Returns:

the password