Package com.codename1.security

package com.codename1.security

The part of the client's cryptography a server shares with it: the portable Java digests and message authentication codes, and the one-time passwords built on them.

• Otp -- RFC 4226 and RFC 6238 one-time passwords: the codes an authenticator application shows. Being the same class the client runs, a code made on a device is the code a server expects.
• Base32 -- the encoding an authenticator's shared secret travels in.
• Hash / Hmac -- MD5, SHA-1, the SHA-2 family, SHA3-256 and Keccak-256 (Ethereum's hash), and HMAC over each, written in Java. They are what Otp computes with.
• Secp256k1 -- ECDSA over the curve of Bitcoin and Ethereum: key derivation, deterministic low-S signing, verification and public key recovery. A server can sign a chain transaction, or check the signature a wallet made on the device, with the class the device used.
• CertificateRequest -- PKCS#10 certificate signing requests. A headless device enrolls for its mutual TLS client certificate with it, signing through Crypto.

A server reaches for these to verify a second factor and for little else. What a request path computes -- a password hash, a token's signature, a digest of something large -- goes through Crypto, which is OpenSSL in a packaged server and several times faster.

The client has more in this package -- ciphers, signatures, key storage -- which a server does not: see the client API reference.

Class	Description
Base32	Base32 encoder/decoder per RFC 4648.
CertificateRequest	A PKCS#10 certificate signing request (RFC 2986): what a device sends a certificate authority to get the client certificate it then presents over mutual TLS.
CertificateRequest.Signer	Signs the encoded request body with the private key matching the request's public key, using CertificateRequest.getSignatureAlgorithm().
CryptoException	Thrown by classes in this package when a cryptographic operation fails.
Hash	Streaming and one-shot cryptographic hash (message digest) functions.
Hkdf	HMAC-based key derivation (HKDF), per RFC 5869.
Hmac	Keyed-hash message authentication (HMAC, RFC 2104) on top of any hash algorithm supported by Hash.
Otp	Counter-based (HOTP, RFC 4226) and time-based (TOTP, RFC 6238) one-time password generators.
Secp256k1	ECDSA over the secp256k1 curve, the signature scheme of Bitcoin and Ethereum, written in portable Java so a wallet can sign on the device and a server can verify or sign with the same class.
Secp256k1.EcdsaSignature	An ECDSA signature: r and s as 32-byte big-endian integers, and the recovery id a signer knows and a verifier does not need.