Security and Signed Applets

The Java Security API is designed to allow developers to incorporate both low-level and high-level security functionality into their Java applications. The first release of Java Security in JDK 1.1 contains a subset of this functionality, including APIs for digital signatures and message digests. In addition, there are abstract interfaces for key management, certificate management and access control. Specific APIs to support X.509 v3 certificates and other certificate formats, and richer functionality in the area of access control, will follow in subsequent JDK releases.

JDK 1.1 also provides a tool that can sign Java ARchive (JAR) files, which can contain classes and other data (such as images and sounds). The appletviewer allows any downloaded applets in JAR files signed (using the tool) by a trusted entity to run with the same full rights as local applications. That is, such applets are not subject to the "sandbox" restrictions of the original Java security model. Later releases will provide more sophisticated security policies, including greater granularity in the allowable trust levels.

• Security API Overview
• Java Cryptography Architecture API Specification and Reference

Located on the JavaSoft website:
• Signed Applet Example

• java.security Package
• java.security.acl Package
• java.security.interfaces Package

• javakey - Java security tool - (for Solaris) (for Windows)

Located on the JavaSoft website:
• Security Home Page