1. Chapter 1 Java Application Security

   1. What Is Security?

   2. Software Used in This Book

   3. The Java Sandbox

   4. Security Debugging

   5. Summary

2. Chapter 2 The Default Sandbox

   1. Elements of the Java Sandbox

   2. Permissions

   3. Keystores

   4. Code Sources

   5. Policy Files

   6. The Default Sandbox

   7. The java.security File

   8. Comparison with Previous Releases

   9. Summary

3. Chapter 3 Java Language Security

   1. Java Language Security Constructs

   2. Enforcement of the Java Language Rules

   3. Comparisons with Previous Releases

   4. Summary

4. Chapter 4 The Security Manager

   1. Overview of the Security Manager

   2. Operating on the Security Manager

   3. Methods of the Security Manager

   4. Comparison with Previous Releases

   5. Summary

5. Chapter 5 The Access Controller

   1. The CodeSource Class

   2. Permissions

   3. The Policy Class

   4. Protection Domains

   5. The AccessController Class

   6. Guarded Objects

   7. Comparison with Previous Releases

   8. Summary

6. Chapter 6 Java Class Loaders

   1. The Class Loader and Namespaces

   2. Class Loading Architecture

   3. Implementing a Class Loader

   4. Miscellaneous Class Loading Topics

   5. Comparison with Previous Releases

   6. Summary

7. Chapter 7 Introduction to Cryptography

   1. The Need for Authentication

   2. The Role of Authentication

   3. Cryptographic Engines

   4. Summary

8. Chapter 8 Security Providers

   1. The Architecture of Security Providers

   2. The Provider Class

   3. The Security Class

   4. The Architecture of Engine Classes

   5. Comparison with Previous Releases

   6. Summary

9. Chapter 9 Keys and Certificates

   1. Keys

   2. Generating Keys

   3. Key Factories

   4. Certificates

   5. Keys, Certificates, and Object Serialization

   6. Comparison with Previous Releases

   7. Summary

10. Chapter 10 Key Management

    1. Key Management Terms

    2. The keytool

    3. The Key Management API

    4. A Key Management Example

    5. Secret Key Management

    6. Comparison with Previous Releases

    7. Summary

11. Chapter 11 Message Digests

    1. Using the Message Digest Class

    2. Secure Message Digests

    3. Message Digest Streams

    4. Implementing a MessageDigest Class

    5. Comparison with Previous Releases

    6. Summary

12. Chapter 12 Digital Signatures

    1. The Signature Class

    2. Signed Classes

    3. Implementing a Signature Class

    4. Comparison with Previous Releases

    5. Summary

13. Chapter 13 Cipher-Based Encryption

    1. The Cipher Engine

    2. Cipher Streams

    3. Sealed Objects

    4. Comparison with Previous Releases

    5. Summary

14. Chapter 14 SSL and HTTPS

    1. An Overview of SSL and JSSE

    2. SSL Client and Server Sockets

    3. SSL Sessions

    4. SSL Contexts and Key Managers

    5. Miscellaneous SSL Issues

    6. The HTTPS Protocol Handler

    7. Debugging JSSE

    8. Summary

15. Chapter 15 Authentication and Authorization

    1. JAAS Overview

    2. Simple JAAS programming

    3. Simple JAAS Administration

    4. Advanced JAAS Topics

    5. Summary

1. Appendix A The java.security File

2. Appendix B Security Resources

   1. Security Bugs

   2. Third-Party Security Providers

   3. Security References

3. Appendix C Identity-Based Key Management

   1. Javakey

   2. Identities

   3. Identity Scopes

   4. Key Management in an Identity Scope

   5. Summary

4. Appendix D The Secure Java Container

   1. The 1.1-Based Class Loader

   2. The 1.1-Based Security Manager

   3. Running Secure Applications

   4. Summary

5. Appendix E Implementing a JCE Security Provider

6. Appendix F Quick Reference

   1. Package java.security

   2. Package java.security.cert

   3. Package java.security.interfaces

   4. Package java.security.spec

   5. Package javax.crypto

   6. Package javax.crypto.interfaces

   7. Package javax.crypto.spec

   8. Package javax.net

   9. Package javax.net.ssl

   10. Package javax.security.auth

   11. Package javax.security.auth.callback

   12. Package javax.security.auth.login

   13. Package javax.security.auth.spi

   14. Package javax.security.cert

   15. Package com.sun.net.ssl

   16. Package com.sun.security.auth

   17. Package com.sun.security.auth.login

   18. Package com.sun.security.auth.module

   19. Miscellaneous Packages

7. Colophon

Our look is the result of reader comments, our own experimentation, and feedback from distribution channels. Distinctive covers complement our distinctive approach to technical topics, breathing personality and life into potentially dry subjects. The animal on the cover of Java Security, Second Edition is a tiger (Panthera tigris). Tigers evolved in eastern Asia; like all carnivores, they descended from civet-like animals called miacids that lived 60 million years ago during the age of the dinosaurs. It is estimated that there were 100,000 tigers living in the wild at the beginning of the 20th century, but today that number has fallen to less than 7,000.

Of the original eight subspecies, the Bali, Caspian, and Javan are now extinct. The five remaining subspecies are the Siberian (also known as Amur, Manchurian, or Northeast China), South China (also known as Amoy or Chinese), Indochinese, Bengal, and Sumatran. Siberian tigers are the largest: males measure up to 10 feet 9 inches long and weigh up to 660 lbs. South China tigers, considered the evolutionary ancestor of all the subspecies, are the most critically endangered. Only 20-30 of these tigers still live in the wild, while 47 more live in zoos in China. Indochinese tigers live in remote areas of southeast Asia, and little is known about them. Bengal tigers are the most populous in the wild; the famous white tiger is a rare variant of this subspecies. Sumatran tigers are the smallest, with males measuring only 8 feet long and weighing approximately 260 lbs on average.

Tigers are the largest cats in the world. They are at the top of the food chain, and prey mainly on elk and wild boars, pigs, deer, and cattle. Tigers can be found in Russia, India, China, and throughout southeast Asia, in habitats ranging from tropical forests to mangrove swamps, tall grass jungles, and the Himalayan mountains and valleys. Their biggest threat is human predators, followed by habitat loss and population fragmentation.

Tigers are shy, nocturnal creatures. With the exception of mother tigers and their cubs, they live alone. Each adult male has a territory that usually ranges from about 10-30 square miles and overlaps the territories of several adult females. Females typically raise 1-3 cubs, which stay with her until she has her next litter. Cubs are born blind. They learn to kill at the age of 6 months, and at 15-18 months can hunt for themselves. Tigers move well on land but are also strong swimmers. They have a highly developed sense of smell, and their night vision is six times better than humans. Their stripes provide effective camouflage in grassland and forest environments and, like human fingerprints, each pattern is unique. Colleen Gorman was the production editor and proofreader, and Rachel Wheeler was the copyeditor for Java Security Second Edition. Linley Dolby provided quality control. Seth Maislin and Ellen Troutman-Zaig wrote the index.

Hanna Dyer designed the cover of this book, based on a series design by Edie Freedman. The cover image is a 19th-century engraving from the Dover Pictorial Archive. Emma Colby produced the cover layout with QuarkXPress 4.1 using Adobe's ITC Garamond font.

David Futato designed the interior layout based on a series design by Nancy Priest. The heading font is Bitstream Bodoni, the text font is ITC New Baskerville, and the code font is Constant Willison. The illustrations that appear in the book were produced by Robert Romano and Jessamyn Read using Macromedia FreeHand 9 and Adobe Photoshop 6. This colophon was written by Rachel Wheeler.

Whenever possible, our books use a durable and flexible lay-flat binding. If the page count exceeds this binding's limit, perfect binding is used.