Package com.codename1.security

package com.codename1.security

Cryptographic primitives and conveniences: hashing, message authentication, symmetric/asymmetric encryption, digital signatures, JWTs, OTPs and random number generation.

What lives in this package
  • Hash / Hmac -- pure-Java MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512 and HMAC variants. Available on every platform with identical output.
  • SecureRandom -- wraps the platform CSPRNG.
  • Cipher -- AES (CBC, GCM, ECB) and RSA (OAEP, PKCS#1) encryption. Backed by the platform's native crypto.
  • Signature -- RSA and ECDSA digital signatures.
  • KeyGenerator / KeyPair / SecretKey / PublicKey / PrivateKey -- key material containers and generators.
  • CertificateRequest -- PKCS#10 certificate signing requests, for enrolling a device in mutual TLS.
  • Jwt -- JSON Web Token signing and verification (HS, RS and ES families).
  • Otp -- RFC 4226/6238 HOTP and TOTP one-time passwords, compatible with standard authenticator apps.
  • Base32 -- 32-character encoding commonly used for OTP shared secrets. URL-safe Base64 (used by JWTs) lives on [com.codename1.util.Base64#encodeUrlSafe(byte[])] / Base64.decodeUrlSafe(String) so it can share the existing SIMD-optimized encoder.

For a segmented OTP input widget see OtpField.

Design notes

Hash and HMAC ship a built-in implementation written in portable Java so they work everywhere without depending on the platform's crypto stack -- they are also what JWT (HS family), HOTP and TOTP build on.

AES, RSA, digital signatures and the secure RNG go through the platform's native crypto provider via CodenameOneImplementation. The default implementation uses the JRE's java.security / javax.crypto via reflection, so JavaSE (simulator) and Android work out of the box. Other ports may override the bridge methods with direct native calls.

  • Class
    Description
    AuthenticationOptions
    Configures a single call to Biometrics.authenticate(AuthenticationOptions).
    Base32
    Base32 encoder/decoder per RFC 4648.
    BiometricError
    Typed error codes returned by Biometrics and SecureStorage when an asynchronous operation fails.
    BiometricException
    Thrown via the failure path of an AsyncResource returned by Biometrics or SecureStorage when the underlying biometric or keychain operation fails.
    Biometrics
    Entry point for biometric authentication (Touch ID, Face ID, fingerprint, Android BiometricPrompt).
    BiometricType
    Enumerates the biometric authentication modalities that may be available on a device.
    CertificateRequest
    A PKCS#10 certificate signing request (RFC 2986): what a device sends a certificate authority to get the client certificate it then presents over mutual TLS.
    CertificateRequest.Signer
    Signs the encoded request body with the private key matching the request's public key, using CertificateRequest.getSignatureAlgorithm().
    Cipher
    Convenience entry points for symmetric (AES) and asymmetric (RSA) encryption.
    CryptoBatch
    Many signature verifications or hashes in one call: the deposits of a block an exchange scans, the transactions an indexer checks, the leaves of a Merkle tree.
    CryptoBatch.Callback<T>
    The answer of an asynchronous batch.
    CryptoEngine
    The seam through which a platform supplies faster implementations of the compute-heavy cryptography in this package.
    CryptoException
    Thrown by classes in this package when a cryptographic operation fails.
    DeviceIntegrity
    Device-integrity and runtime self-protection (RASP) entry point.
    Ed25519
    Ed25519 signatures (RFC 8032): the signatures of Solana, Cardano, Stellar, Tezos, SSH keys and many protocols beside.
    Hash
    Streaming and one-shot cryptographic hash (message digest) functions.
    Hkdf
    HMAC-based key derivation (HKDF), per RFC 5869.
    Hmac
    Keyed-hash message authentication (HMAC, RFC 2104) on top of any hash algorithm supported by Hash.
    Jwt
    JSON Web Token (RFC 7519) signing and verification.
    Key
    Common base for every key type in the security package -- SecretKey for symmetric algorithms, PublicKey and PrivateKey for asymmetric ones.
    KeyAgreement
    Elliptic-curve Diffie-Hellman key agreement over P-256.
    KeyGenerator
    Generates fresh cryptographic key material.
    KeyPair
    A matched pair of PublicKey / PrivateKey.
    NativeCryptoEngine
    The CryptoEngine of the ParparVM targets (iOS, macOS, native Windows and Linux, and the backend): secp256k1, Schnorr, Ed25519 and Keccak run in the linked C kernels, everything else goes to the engine it wraps.
    Otp
    Counter-based (HOTP, RFC 4226) and time-based (TOTP, RFC 6238) one-time password generators.
    Pbkdf2
    PBKDF2 (RFC 8018) with HMAC-SHA-256 or HMAC-SHA-512: the password hash of key stores and vaults, and with SHA-512 and 2048 iterations the seed of a BIP-39 mnemonic.
    PortCryptoEngine
    The client's default CryptoEngine: PBKDF2 goes to the port's native derivation (CodenameOneImplementation.pbkdf2(String, byte[], byte[], int, int)), everything else runs in Java, and the asynchronous CryptoBatch calls answer on the EDT.
    PrivateKey
    A private key -- paired with a PublicKey to form a key pair.
    PublicKey
    A public key -- paired with a PrivateKey to form a key pair.
    Schnorr
    BIP-340 Schnorr signatures over secp256k1: the signatures of Bitcoin's Taproot (key-path spends, P2TR) and of Nostr events.
    Schnorr.KeyPair
    A private key with its x-only public key, derived once, for signing many messages; the counterpart of libsecp256k1's secp256k1_keypair.
    Secp256k1
    ECDSA over the secp256k1 curve, the signature scheme of Bitcoin and Ethereum, written in portable Java so a wallet can sign on the device and a server can verify or sign with the same class.
    Secp256k1.EcdsaSignature
    An ECDSA signature: r and s as 32-byte big-endian integers, and the recovery id a signer knows and a verifier does not need.
    SecretKey
    A symmetric secret key.
    Secrets
    Runtime access to the secrets your app needs (API keys such as a Google Maps key) WITHOUT shipping them inside the binary, where they are trivially extractable.
    SecureRandom
    Cryptographically secure random number generator.
    SecureStorage
    Biometric-gated secure storage backed by the platform keychain.
    Signature
    Digital signature creation and verification.
    TapjackingPolicy
    What the framework should do about a touch that arrives while another application's window is drawn over this app.