package com.codename1.security

Cryptographic primitives and conveniences: hashing, message authentication, symmetric/asymmetric encryption, digital signatures, JWTs, OTPs and random number generation.

What lives in this package

  • Hash / Hmac – pure-Java MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512 and HMAC variants. Available on every platform with identical output.
  • SecureRandom – wraps the platform CSPRNG.
  • Cipher – AES (CBC, GCM, ECB) and RSA (OAEP, PKCS#1) encryption. Backed by the platform’s native crypto.
  • Signature – RSA and ECDSA digital signatures.
  • KeyGenerator / KeyPair / SecretKey / PublicKey / PrivateKey – key material containers and generators.
  • Jwt – JSON Web Token signing and verification (HS, RS and ES families).
  • Otp – RFC 4226/6238 HOTP and TOTP one-time passwords, compatible with standard authenticator apps.
  • Base32 – 32-character encoding commonly used for OTP shared secrets. URL-safe Base64 (used by JWTs) lives on [com.codename1.util.Base64#encodeUrlSafe(byte[])] / Base64.decodeUrlSafe(String) so it can share the existing SIMD-optimized encoder.

For a segmented OTP input widget see OtpField.

Design notes

Hash and HMAC ship a built-in implementation written in portable Java so they work everywhere without depending on the platform’s crypto stack – they are also what JWT (HS family), HOTP and TOTP build on.

AES, RSA, digital signatures and the secure RNG go through the platform’s native crypto provider via CodenameOneImplementation. The default implementation uses the JRE’s java.security / javax.crypto via reflection, so JavaSE (simulator) and Android work out of the box. Other ports may override the bridge methods with direct native calls.

Types

class AuthenticationOptionsConfigures a single call to Biometrics.authenticate(AuthenticationOptions).
class Base32Base32 encoder/decoder per RFC 4648.
enum BiometricErrorTyped error codes returned by Biometrics and SecureStorage when an asynchronous operation fails.
class BiometricExceptionThrown via the failure path of an AsyncResource returned by Biometrics or SecureStorage when the underlying biometric or keychain operation fails.
enum BiometricTypeEnumerates the biometric authentication modalities that may be available on a device.
class BiometricsEntry point for biometric authentication (Touch ID, Face ID, fingerprint, Android BiometricPrompt).
class CipherConvenience entry points for symmetric (AES) and asymmetric (RSA) encryption.
class CryptoExceptionThrown by classes in this package when a cryptographic operation fails.
class DeviceIntegrityDevice-integrity and runtime self-protection (RASP) entry point.
class HashStreaming and one-shot cryptographic hash (message digest) functions.
class HmacKeyed-hash message authentication (HMAC, RFC 2104) on top of any hash algorithm supported by Hash.
class JwtJSON Web Token (RFC 7519) signing and verification.
class KeyCommon base for every key type in the security package – SecretKey for symmetric algorithms, PublicKey and PrivateKey for asymmetric ones.
class KeyGeneratorGenerates fresh cryptographic key material.
class KeyPairA matched pair of PublicKey / PrivateKey.
class OtpCounter-based (HOTP, RFC 4226) and time-based (TOTP, RFC 6238) one-time password generators.
class PrivateKeyA private key – paired with a PublicKey to form a key pair.
class PublicKeyA public key – paired with a PrivateKey to form a key pair.
class SecretKeyA symmetric secret key.
class SecretsRuntime access to the secrets your app needs (API keys such as a Google Maps key) WITHOUT shipping them inside the binary, where they are trivially extractable.
class SecureRandomCryptographically secure random number generator.
class SecureStorageBiometric-gated secure storage backed by the platform keychain.
class SignatureDigital signature creation and verification.
enum TapjackingPolicyWhat the framework should do about a touch that arrives while another application’s window is drawn over this app.