Last updated by Roedy Green ©1996-1999 Canadian Mind Products.
Stuck in a frame? Click here to break out.
There are many different types of certificate. Unfortunately, you need a separate certificate for every application and every browser, e.g. SSL web server, SSL web browser (Netscape, Opera, Internet Explorer ...), software publisher jar signing (in three flavours: Microsoft Authenticode, Netscape and Sun), SET financial Visa/Mastercard web transactions and secure email (S/MIME X.509 v3 for Netscape, PGP for Eudora).
Unfortunately, all this innovation and competition leads to a tower of Babel. When you want to send a message to someone else, you both must be using compatible encryption/signing software. PGP is not compatible with S/MIME email for example. It is not always obvious what scheme an incoming message is using. Further, most of the time the certificate file looks like gibberish. You can't tell just by looking at the file with a text viewer, which signing authority created it, who owns it, what program is needed to make sense of it, which browsers/emailers/newsreaders it works with or even whether the file includes a private key. You need to keep track of that externally.
Security software is typically not in the least user-friendly. It is designed for nerds. For example, if you feed an X.509 v3 SHA-1 certificate to browser that only supports X.509 MD5, it will complain the file is "invalid or corrupt", instead of telling you what sort that certificate is, and what kind it wants, and where to get one.
We need software that can handle multiple schemes depending on the automatically determined preferences of the recipient. However, it is a Good Thing TM there are so many schemes. Not only does it complicate the code-breaker's task, a breakthrough can render an encryption technique void overnight. We need to have viable alternatives waiting in the wings.
Certificates vary in cost depending mainly on how much research the certificate authority does to verify you are really you, and how much information is in the certificate that the authority is attesting is true. If you are buying a certificate for an SSL webserver, for example, Thawte are about 1/3 the price of industry leader Verisign. Personal certificates are often free, especially ones with a short expiry date. Corporate ones are hundreds of dollars per year. For SSL server certificates, or Applet signing certificates, you want to choose a certificate authority already built into the standard browsers such as Netscape, Internet Explorer and Opera, e.g. Thawte.
The certificate may contain information such as your email address, your name, address, birthdate, gender, SIN/SSA number, passport number and other information including your personal public encryption/signing key. The certificate has an issue and expiry date. It does not contain your private key. Some certificates may have a lifetime of only minutes. The signing authority is guaranteeing the information is true. They use their private key to sign the certificate attesting to its authenticity.
You can then use the certificate to digitally sign email, documents, jar files etc.
You can also use it as digital ID. Others can electronically challenge you to prove you know the private key that fits with the public key in the certificate by encrypting a message they provide. The problem with that is, all the information in the certificate is revealed to whoever you show it to. If you want to selectively reveal information, you need several certificates. You might want one with just your birthdate for entry to pornsites, but no other information. You might want one that revealed only a very minimal amount of information when dealing with online vendors to avoid being bombarded with junk electronic and snail mail.
Certificates can be used instead of passwords to verify who you are to some site. The site challenges you by sending you a message that you digitally sign and send back. If some spy had snooped on you logging in before, it would not help him to spoof you, the way it would had you used a password.
Other types of certificate allow you to encrypt and sign all HTML traffic leaving your web server, thus proving it came from you and providing privacy. Recipients can determine whether data did indeed did come from you by checking the digital signature. To verify, all they need is a master certificate from the signing authority, which comes built into their browser or email software. They don't need to check up your key in an online database unless they want to check to see if the certificate has been revoked.
Mastercard and Visa have designed the SET certificate that can be used for secure financial transactions over the web. Verisign supplies the certificates.
Certificates are primarily concerned with digital signatures, though they can be used for encryption. Certificates contain your public keys so that other people can encrypt the mail they send you so that if anyone intercepts it, they cannot make any sense of it. You can safely hand out your certificates to others since they do not contain your private keys. The certificate-issuing authority at no time is privy to your private key. Your browser generates your random private key when you purchase your certificate, and sends only the public key to the certificate authority. The process of purchasing a certificate may require installing the certificate authority's public key in your browser, three visits to the certificate authority's website, and some email. Depending on the cost/class of the certificate, the certificate authority may need a substantial amount of time to check you out before issuing the certificate.
You need passphrases for your browser and for each certificate. If you forget a passphrase, you are totally hosed. You will never be able to use the certificate again. Thankfully some certificates offer a hint (which you compose) in case you forget the passphrase.
There are plenty of indirect ways to crack security:
For more information see this tutorial on installing a Netscape SSL server. It also contains plenty of general information. See this list of links to find out more detail. See MD5, PGP, SET, SHA-1, SSL, Security, X.509 v3, blowfish, digital signatures.
e.g. to compute the expected check digit 7 for: 706-511-227 7 0 6 5 1 1 2 2 7 * 2 * 2 * 2 * 2 --------------------------------- 7 + 0 + 6 +1+0+ 1 + 2 + 2 + 4 = 23 23 MOD 10 = 3 10 - 3 = 7 -- the check digitNote that the digits of the multiplication results must be added before doing the sum. Here is method more amenable to computer calculation:
e.g. to compute see if the check digit is as expected: 706-511-227 7 0 6 5 1 1 2 2 7 z z z z --------------------------------- 7 + 0 + 6 + 1 + 1 + 2 + 2 + 4 + 7 = 30 30 MOD 10 had better = 0 where int z (int digit) { // 0->0 1->2 2->4 3->6 4->8 5->1 6->3 7->5 8->7 9->9 if (digit == 0) return 0; else return (digit*2-1) % 9 + 1; }
The odd-looking chmod 755 name.class command sets the permissions. The permissions are encoded in binary, 111 101 101, then in octal 755, one bit for each permission, 1=ok 0=not ok to do that. 755 means I give myself permission to do everything, but I don't let others write, though I let them read and execute. See the Learn To Count Applet to sharpen your intuition on how binary and octal work. Also see binary and octal.
For a practical example of the technique, see the source code for Learn To count. It uses Class.forName to allow you to add new language translator classes without modifying or recompiling the program. You just add the class names to a properties file.
Note that CLASSPATH uses forward (or optionally backslashes under Windows and NT) to separate levels, and semicolons to separate directories. In contrast, inside Java programs in import statements, you use dots to separate levels. Inside <APPLET CODE statements it is best if you use dots to represents levels inside jar files and slashes to represent files. Java.exe uses only forward slashes and dots, no backslashes allowed.
You might think that you could have an import like this:
import VCP.BIN.COMPONENTS.SYMBEANS.SomePackage.MyClass
However, you cannot respecify anything already mentioned in the
CLASSPATH. You just give the low levels of qualification like this:
import SomePackage.MyClass
The SomePackage is the internal directory name stored inside the jar
file. Similarly you might try to get at the class in D:\MyStuff\MyPackage\Great\MyClass.class
with the following import:
import MyStuff.MyPackage.Great.MyClass
That will not work. You may only specify the low order qualification
like this:
import MyPackage.Great.MyClass
Basically the rule is, your package name cannot provide redundant
information that the CLASSPATH has already provided, and together between
the CLASSPATH and the package name, you have to fully qualify the package
name.
You can check the CLASSPATH setting by typing:
echo %CLASSPATH%
under Win95 or
echo $CLASSPATH
under Unix.
If you want to be really sure, use the Wassup utility which will also find and
report on Symantec's SC.INI CLASSPATH when it applies.
If you don't want to be bothered with manually composing a CLASSPATH,
try SmartJ. (see SmartJ).
Symantec Visual Cafe hides its CLASSPATH in C:\VCP\BIN\SC.ini. Internet Explorer hides its CLASSPATH in the registry under HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Java VM. Netscape uses the CLASSPATH in the standard SET environment. Windows 95 controls the environment with SET CLASSPATH= in autoexec.bat. Linux controls the environment with export CLASSPATH= in your .bashrc file. NT controls the environment with the Control Panel / System / Environment settings. One would think a platform independent language would have a platform independent way of controlling the CLASSPATH, but it doesn't. Symantec's is closest.
You can also specify the CLASSPATH on the command line with the -classpath
or -cp (for short) option switch. e.g.
java.exe -cp C:\MyStuff;C:\MyStuff\MyGoodies.jar HelloWorld
This is the safest place especially when every app needs a slightly
different CLASSPATH and/or a different JVM. The catch is the CLASSPATH can
be very long which makes the command line hard to type and read.
In Linux and NT under bash, the elements of the CLASSPATH are separated by colons. In Win95 and standard NT, they are separated by semicolons. Somebody deserves a major raspberry.
Beware of inserting extra semicolons in your CLASSPATH. Everything to the right will be ignored!, leading you to pull out your remaining hair in frustration wondering why java can't find the classes. You must have exactly one semicolon between elements, no lead/trail/extras.
Keep in mind that Java is extremely case senstive, even if your operating system is not. Be very careful to get case precisely right any time you specify a filename, <APPLET CODE, or CLASSPATH. Unfortunately Windows and Windows NT will often lie to you about the actual case of a name. Tracking down case mismatches can drive you nuts. JP Soft's 4NT DIR /F is useful at getting at the true case of a filename.
Just to keep you on your toes, in JDK 1.1 putting classes.zip on the CLASSPATH is optional. In 1.2 it is an error. The classfiles live in JDK1.2\jre\lib\rt.jar, but they automatically go on the classpath.
See java.exe for a detailed discussion of how Java.exe combines package names, class names and the CLASSPATH to find the classes. See java.exe, HelloWorld, javac.exe, SmartJ.
You can then use it like this:
Rabbit r1 = new Rabbit();
Rabbit r2 = (Rabbit) r1.clone();
Note: To comply with Cloneable, clone() must return an Object not a Rabbit.
Instead of using super.clone(), you could use new Rabbit() and copy the fields one by one to the new object and return the new object. Then you don't have to mess with CloneNotSupportedException.
However, I am not aware of any universally accepted conventions for: /* and // comments on lines by themselves. Do they belong to the line following or preceding? To be consistent, I suggest the following convention: /* belong to the line following, // belong to the line preceding.
It may be advisable to include a blank line prior to a /* comment (and no blank line after that would separate it from the code it describes), or after a run of // comments (and no blank line prior that would separate it from the code it describes) to further clarify your meaning.
I further suggest using /* comments for big-picture forest level overviews and // comments for line-by-line tree level details.
platform | problems |
---|---|
JavaSoft JDK 1.1.5 | ok |
JavaSoft JDK 1.1.6 | load problems with the JIT in Win95/NT. Problems with reading serialised files. |
Jbuilder 2.0 | ok |
Microsoft Internet Explorer 4.01 | Not only does IE 4 leave out the RMI classes, its security manager prevents you from using Sun's. It complains that you are trying to access "localhost" which it considers to be a different host from the nameless one it loaded the applets from. Problems loading jar files. Microsoft wants you to use proprietary cab files instead. |
Microsoft Internet Explorer 4.01
with the Activator Java Plug-in |
ok |
Netscape Communicator 4.05 | ok. In earlier versions the JIT fails. You can turn it off by deleting the jit3240.dll file. |
Netscape Communicator 4.05
with the Activator Java Plug-in |
ok |
Supercede 2.01 | Needs registry entries like this
HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Runtime Environment\1.1\JavaHome "C:\Program Files\Supercede\Jre" HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Runtime Environment\1.1\MicroVersion "4" HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Runtime Environment\1.1\RuntimeLib "C:\WINNT\System32\sc30rtl.dll" |
Symantec 2.5 Visual Cafe
JIT activated |
ignores standard CLASSPATH, uses SC.INI. |
Symantec 2.5 Visual Cafe
JIT disabled SET JAVA_COMPCMD=DIS |
ignores standard CLASSPATH, uses SC.INI. |
Class | Extends | Default Layout | Swing Equivalent | Key characteristics |
---|---|---|---|---|
Applet | Panel | FlowLayout | JApplet | represents the featureless Window provided by the browser for an Applet to run in. |
Canvas | Component | n/a | JCanvas | Raw material for creating your own components. Just a place you can draw. It cannot contain components. |
Container | Component | n/a | JContainer | Abstract base class for all classes that can contain components. |
Dialog | Window | BorderLayout | JDialog | Temporary Window for displaying information or requesting keystrokes. It requires a parent Frame, thus in cannot be used inside an Applet which has no Frame. It can be modal, which means it blocks input to all other Windows until it is dismissed. |
Frame | Window | BorderLayout | JFrame | Free standing Window with a menu bar. |
Panel | Container | FlowLayout | JPanel | No visible doodads or border of its own. It is purely for organising components. Lives inside some enclosing Container. |
Window | Container | BorderLayout | JWindow | Free standing Window, not inside any other Window. |
Suppose further that a class Animal_printer implements the method:
void print(Animal a);
Can I say that Animal_printer implements Dog_printer? Logically, I should be able to. Anywhere that a Dog_printer is expected, I can supply an Animal_printer, and the dog will get printed. (Because all dogs are animals.) So, logically, there is the relation:
Animal_printer is a subtype of Dog_printer.
Although logically correct, this is weird looking. Then again, something that can print any animal "extends" something that can print any dog, so maybe it isn't so weird. Anyway, to determine whether Animal_printer is a subtype of Dog_printer, we have used the "contravariant argument rule". Similarly, there is a "covariant return value rule" that would state that:
Dog_creator is a subtype of Animal_creator.
See contravariance.
More generally CRCs are a technique for creating a signature from a string of bytes. If any of the bytes changes, then most likely the calculated signature would change too. CRC's are used to verify a message has been sent unmolested and for hashCodes. JDK 1.1 offers the java.util.zip.Checksum interface and CRC32 and Adler32 classes that implement it. CRC32 produces a classic 32 bit result using native code for speed. The CRC calculation can be thought of as polynomial division, with the individual bits as coefficients, or as XOR division that ignores carries. It works much like treating the message as a giant binary number and dividing it by some prime number and taking the remainder as the signature, except the calculation is easier for computers. Adler32 uses a even more simplified and speedy algorithm that produces almost as satisfactorily "random" a result. Here is how to use the undocumented 16-bit CRC built into Java 1.0.2.
import sun.misc.*; ... byte[] b = new byte[200]; ... // create a new CRC-calculating object CRC16 crc = new CRC16(); // loop, calculating CRC for each byte of the string for (int i=0; i<b.length; i++) { crc.update(b[i]); } short result = (short) crc.value;The innermost loop of a 16-bit CRC calculation looks something like this:
for (int i = 0; i<256; i++) { int crc = i; crc = (crc >> 1) ^ ((crc & 1) ? poly : 0); crc = (crc >> 1) ^ ((crc & 1) ? poly : 0); crc = (crc >> 1) ^ ((crc & 1) ? poly : 0); crc = (crc >> 1) ^ ((crc & 1) ? poly : 0); crc = (crc >> 1) ^ ((crc & 1) ? poly : 0); crc = (crc >> 1) ^ ((crc & 1) ? poly : 0); crc = (crc >> 1) ^ ((crc & 1) ? poly : 0); crc = (crc >> 1) ^ ((crc & 1) ? poly : 0); CRCTable[i] = crc; }
![]() |
![]() |
![]() | |
![]() |
Canadian Mind Products | You can get an updated copy of this page from http://mindprod.com/jglossb.html | The Mining Company's
Focus on Java Best of the Net Award |