Client API. The Codename One framework your app is built on: this runs on the device, not in a backend.

package com.codename1.security

Cryptographic primitives and conveniences: hashing, message authentication, symmetric/asymmetric encryption, digital signatures, JWTs, OTPs and random number generation.

What lives in this package

  • Hash / Hmac – pure-Java MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512 and HMAC variants. Available on every platform with identical output.
  • SecureRandom – wraps the platform CSPRNG.
  • Cipher – AES (CBC, GCM, ECB) and RSA (OAEP, PKCS#1) encryption. Backed by the platform’s native crypto.
  • Signature – RSA and ECDSA digital signatures.
  • KeyGenerator / KeyPair / SecretKey / PublicKey / PrivateKey – key material containers and generators.
  • CertificateRequest – PKCS#10 certificate signing requests, for enrolling a device in mutual TLS.
  • Jwt – JSON Web Token signing and verification (HS, RS and ES families).
  • Otp – RFC 4226/6238 HOTP and TOTP one-time passwords, compatible with standard authenticator apps.
  • Base32 – 32-character encoding commonly used for OTP shared secrets. URL-safe Base64 (used by JWTs) lives on [com.codename1.util.Base64#encodeUrlSafe(byte[])] / Base64.decodeUrlSafe(String) so it can share the existing SIMD-optimized encoder.

For a segmented OTP input widget see OtpField.

Design notes

Hash and HMAC ship a built-in implementation written in portable Java so they work everywhere without depending on the platform’s crypto stack – they are also what JWT (HS family), HOTP and TOTP build on.

AES, RSA, digital signatures and the secure RNG go through the platform’s native crypto provider via CodenameOneImplementation. The default implementation uses the JRE’s java.security / javax.crypto via reflection, so JavaSE (simulator) and Android work out of the box. Other ports may override the bridge methods with direct native calls.

Types

class AuthenticationOptionsConfigures a single call to Biometrics.authenticate(AuthenticationOptions).
class Base32 sharedBase32 encoder/decoder per RFC 4648.
enum BiometricErrorTyped error codes returned by Biometrics and SecureStorage when an asynchronous operation fails.
class BiometricExceptionThrown via the failure path of an AsyncResource returned by Biometrics or SecureStorage when the underlying biometric or keychain operation fails.
enum BiometricTypeEnumerates the biometric authentication modalities that may be available on a device.
class BiometricsEntry point for biometric authentication (Touch ID, Face ID, fingerprint, Android BiometricPrompt).
class CertificateRequest sharedA PKCS#10 certificate signing request (RFC 2986): what a device sends a certificate authority to get the client certificate it then presents over mutual TLS.
class CipherConvenience entry points for symmetric (AES) and asymmetric (RSA) encryption.
class CryptoBatch sharedMany signature verifications or hashes in one call: the deposits of a block an exchange scans, the transactions an indexer checks, the leaves of a Merkle tree.
class CryptoEngine sharedThe seam through which a platform supplies faster implementations of the compute-heavy cryptography in this package.
class CryptoException sharedThrown by classes in this package when a cryptographic operation fails.
class DeviceIntegrityDevice-integrity and runtime self-protection (RASP) entry point.
class Ed25519 sharedEd25519 signatures (RFC 8032): the signatures of Solana, Cardano, Stellar, Tezos, SSH keys and many protocols beside.
class Hash sharedStreaming and one-shot cryptographic hash (message digest) functions.
class Hkdf sharedHMAC-based key derivation (HKDF), per RFC 5869.
class Hmac sharedKeyed-hash message authentication (HMAC, RFC 2104) on top of any hash algorithm supported by Hash.
class JwtJSON Web Token (RFC 7519) signing and verification.
class KeyCommon base for every key type in the security package – SecretKey for symmetric algorithms, PublicKey and PrivateKey for asymmetric ones.
class KeyAgreementElliptic-curve Diffie-Hellman key agreement over P-256.
class KeyGeneratorGenerates fresh cryptographic key material.
class KeyPairA matched pair of PublicKey / PrivateKey.
class NativeCryptoEngine sharedThe CryptoEngine of the ParparVM targets (iOS, macOS, native Windows and Linux, and the backend): secp256k1, Schnorr, Ed25519 and Keccak run in the linked C kernels, everything else goes to the engine it wraps.
class Otp sharedCounter-based (HOTP, RFC 4226) and time-based (TOTP, RFC 6238) one-time password generators.
class Pbkdf2 sharedPBKDF2 (RFC 8018) with HMAC-SHA-256 or HMAC-SHA-512: the password hash of key stores and vaults, and with SHA-512 and 2048 iterations the seed of a BIP-39 mnemonic.
class PortCryptoEngineThe client’s default CryptoEngine: PBKDF2 goes to the port’s native derivation (CodenameOneImplementation.pbkdf2), everything else runs in Java, and the asynchronous CryptoBatch calls answer on the EDT.
class PrivateKeyA private key – paired with a PublicKey to form a key pair.
class PublicKeyA public key – paired with a PrivateKey to form a key pair.
class Schnorr sharedBIP-340 Schnorr signatures over secp256k1: the signatures of Bitcoin’s Taproot (key-path spends, P2TR) and of Nostr events.
class Secp256k1 sharedECDSA over the secp256k1 curve, the signature scheme of Bitcoin and Ethereum, written in portable Java so a wallet can sign on the device and a server can verify or sign with the same class.
class SecretKeyA symmetric secret key.
class SecretsRuntime access to the secrets your app needs (API keys such as a Google Maps key) WITHOUT shipping them inside the binary, where they are trivially extractable.
class SecureRandomCryptographically secure random number generator.
class SecureStorageBiometric-gated secure storage backed by the platform keychain.
class SignatureDigital signature creation and verification.
enum TapjackingPolicyWhat the framework should do about a touch that arrives while another application’s window is drawn over this app.