Abstract

The Java Development Kit (JDK) has included the concepts of cryptographic keys, signatures and certificates since version 1.0, and they have been improved and extended in JDK 1.2. However, the certificate interfaces still only cover identity certificates. As more and more security software makes use of authorization certificates, we feel that the concept of an authorization certificate and its implementation need to be added to the Java Security API. In this paper, we analyze the certificate model of the JDK 1.2. We also describe an extension to the JDK 1.2 cryptography architecture, providing support for authorization certificates in general and SPKI certificates in particular. In the future, we intend to use the extensions described in this paper to customize the JDK 1.2 policy management to be easier to distribute. In particular, we are going to replace the identity based security management that is configured through a configuration file, with a capability base...

Citations