(Java) Create JCEKS Containing Secret Keys

Demonstrates how to create a JCEKS keystore file containing symmetric secret keys (for AES, Blowfish, HMAC SHA25, ChaCha20, etc.)

This example requires Chilkat v9.5.0.66 or greater.

Chilkat Java Downloads Java Libs for Windows, MacOS, Linux, Alpine Linux, Solaris Java Libs for Android

import com.chilkatsoft.*;

public class ChilkatExample {

  static {
    try {
        System.loadLibrary("chilkat");
    } catch (UnsatisfiedLinkError e) {
      System.err.println("Native code library failed to load.\n" + e);
      System.exit(1);
    }
  }

  public static void main(String argv[])
  {
    // IMPORTANT: This example requires Chilkat v9.5.0.66 or greater.

    // This example requires the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    CkJavaKeyStore jceks = new CkJavaKeyStore();

    // We'll need a pseudo-random number generator (PRNG) to generate symmetric keys.
    CkPrng prng = new CkPrng();

    // Generate some keys..

    // 128-bit AES key (16 bytes)
    String aesKey = prng.genRandom(16,"base64");

    // 256-bit Blowfish key (32 bytes)
    String blowfishKey = prng.genRandom(32,"base64");

    // HMAC SHA256 key
    // (An HMAC key can be anything, and any length. We'll use the following string:
    String hmacKey = "This is my HMAC key";

    // ChaCha20 256-bit
    String chachaKey = prng.genRandom(32,"base64");

    // Add each secret key to the JCEKS
    String encoding = "base64";
    String password = "secret";
    jceks.AddSecretKey(aesKey,encoding,"AES","my aes key",password);
    jceks.AddSecretKey(blowfishKey,encoding,"BLOWFISH","my blowfish key",password);
    // For HMAC, we're using the us-ascii bytes for the key..
    jceks.AddSecretKey(hmacKey,"ascii","HMAC_SHA256","my hmac key",password);
    jceks.AddSecretKey(chachaKey,encoding,"CHACHA","my chacha20 key",password);

    String filePassword = "password";
    // Write the JCEKs to a file.
    boolean success = jceks.ToFile(filePassword,"qa_output/secretKeys.jceks");
    if (success != true) {
        System.out.println(jceks.lastErrorText());
        return;
        }

    // We can also emit as a JWK Set..
    CkStringBuilder sbJson = new CkStringBuilder();
    success = jceks.ToJwkSet("secret",sbJson);
    if (success != true) {
        System.out.println(jceks.lastErrorText());
        return;
        }

    // Emit the JSON in pretty-printed (indented) form:
    CkJsonObject json = new CkJsonObject();
    json.LoadSb(sbJson);
    json.put_EmitCompact(false);
    System.out.println(json.emit());

    // Output is:

    // { 
    //   "keys": [
    //     { 
    //       "kty": "oct",
    //       "alg": "AES",
    //       "k": "vHekQQB0Gc1NvppapUTW2g",
    //       "kid": "my aes key"
    //     },
    //     { 
    //       "kty": "oct",
    //       "alg": "BLOWFISH",
    //       "k": "qHsdXaJsXicVCZbK8l8hJQpYOa0GkiO9gsRK9WLtht8",
    //       "kid": "my blowfish key"
    //     },
    //     { 
    //       "kty": "oct",
    //       "alg": "HMAC_SHA256",
    //       "k": "VGhpcyBpcyBteSBITUFDIGtleQ",
    //       "kid": "my hmac key"
    //     },
    //     { 
    //       "kty": "oct",
    //       "alg": "CHACHA",
    //       "k": "yNv832U43C9BcWvaQAH2_rG-GwfmpgT5JBRllWGQY1o",
    //       "kid": "my chacha20 key"
    //     }
    //   ]
    // }
    // 
  }
}