using bouncy castle jce provider??

[hugo anderson]

Hello All
I am new to java.
I want to use bouncy castle jce provider.
I have copied the bcprov-jdk14-118.jar file in home\lib\ext and also updated the java.security file by adding
security.provider.6=org.bouncycastle.jce.provider.BouncyCastleProvider
I am using jdk1.4.0_01 in win2k.
While running it says:
Exception in thread "main" java.lang.NoClassDefFoundError: Filename .....
plz help
thanks in advance

[Peter den Haan]

Did you put it in lib/ext of the JRE? And I assume you are aware that JDK 1.4.1 ships with a fairly complete JCE provider.
- Peter

[hugo anderson]

Thanks peter for replying but I have already tried what you told.
I even tried by putting the jar file in both (jsdk\jre\lib\ext and also in programs\java\jre\lib\ext) and is still not working.
Plz help.
Also I am aware that SUNJce is quite sufficient but I want to use BC for generating self signed certificate...is there some other way without using keytool?

[Robert Paris]

I know you posted this a while ago, but if you're still interested... You can do all this (and more!) programmatically. I have some sample code below:

//CREATE A KEYSTORE OF TYPE "Java Key Store"
KeyStore ks = KeyStore.getInstance("JKS");
/*
 * LOAD THE STORE
 * The first time you're doing this (i.e. the keystore does not
 * yet exist - you're creating it), you HAVE to load the keystore
 * from a null source with null password. Before any methods can
 * be called on your keystore you HAVE to load it first. Loading
 * it from a null source and null password simply creates an empty
 * keystore. At a later time, when you want to verify the keystore
 * or get certificates (or whatever) you can load it from the
 * file with your password.
 */
ks.load( null, null );
//GET THE FILE CONTAINING YOUR CERTIFICATE
FileInputStream fis = new FileInputStream( "MyCert.cer" );
BufferedInputStream bis = new BufferedInputStream(fis);
//I USE x.509 BECAUSE THAT'S WHAT keytool CREATES
CertificateFactory cf = CertificateFactory.getInstance( "X.509" );
//NOTE: THIS IS java.security.cert.Certificate NOT java.security.Certificate
Certificate cert = null;
/*
 * I ONLY HAVE ONE CERT, I JUST USED "while" BECAUSE I'M JUST
 * DOING TESTING AND WAS TAKING WHATEVER CODE I FOUND IN
 * THE API DOCUMENTATION. I COULD HAVE DONE AN "if", BUT I
 * WANTED TO SHOW HOW YOU WOULD HANDLE IT IF YOU GOT A CERT
 * FROM VERISIGN THAT CONTAINED MULTIPLE CERTS
 */
//GET THE CERTS CONTAINED IN THIS ROOT CERT FILE
while ( bis.available() > 0 )
{
 cert = cf.generateCertificate( bis );
 ks.setCertificateEntry( "SGCert", cert );
}
//ADD TO THE KEYSTORE AND GIVE IT AN ALIAS NAME
ks.setCertificateEntry( "SGCert", cert );
//SAVE THE KEYSTORE TO A FILE
/*
 * After this is saved, I believe you can just do setCertificateEntry
 * to add entries and then not call store. I believe it will update
 * the existing store you load it from and not just in memory.
 */
ks.store( new FileOutputStream( "NewClientKeyStore" ), "MyPass".toCharArray() );

Now if you also want to verify a signed jar file (say one that you signed with that certificate from before), then my code below will help with that. Hope this helps someone!

/*
 * Call this from a main method. If you want to verify that the entries
 * were ALL signed, then pass true for verifySigned. If you want to verify
 * that the entry was signed by a certificate that exists in your
 * keystore then pass true for verifyInKeyStore. These correspond to
 * the values "s" and "k" as printed by jarsigner when verifying.
 */
public static boolean verifyJar(String jarName, KeyStore keyStore, boolean
verifySigned, boolean verifyInKeyStore) throws Exception
{
 boolean isVerified = false;
 boolean inManifest = false;
 String entryName = null;
 try {
  JarFile jarFile = new JarFile( jarName, true );
  Manifest manifest = jarFile.getManifest();
  Enumeration entries = jarFile.entries();
  while ( entries.hasMoreElements() )
  {
   //PRESET VARIABLES IN CASE ALTERED LAST TIME THROUGH
   inManifest = false;
   entryName = null;
   //THE ENTRY AND ITS NAME
   JarEntry jarEntry = ( JarEntry ) entries.nextElement
();
   entryName = jarEntry.getName();
   /*
    * Was it in the manifest? We only care about those
    * entries as that's all that will be loaded by
    * the classloader (assuming you don't have an evil
    * classloader that loads entries secretly that
    * aren't in the manifest) as classes. These are
    * the ones to be signed. Can anyone tell me why
    * Java doesn't require that all files in a jar
    * be signed and listed in the manifest? Even
    * the manifest should be!
    */
   if ( ( manifest.getAttributes( entryName ) !=
null ) || ( manifest.getAttributes( "./" + entryName ) != null ) || (
manifest.getAttributes( "/" + entryName ) != null ) )
    inManifest = true;
   //VERIFY BY READING THE FILE IF ARE ALTERED
   verifyDigestsImplicitly( jarFile,
jarEntry ); //WILL RETURN QUIETLY IF NO PROBLEM
   //LOOKING ONLY AT ENTRIES IN MANIFEST
   if ( manifest != null && inManifest == true )
   {
    Certificate[] certs =
jarEntry.getCertificates();
    boolean isSigned = ( ( certs != null ) && (
certs.length > 0 ) );
    boolean inKeyStore = findInKeyStore( certs,
keyStore );
    if ( ( verifySigned && !isSigned ) || (
verifyInKeyStore && ! inKeyStore ) )
    {
     isVerified = false;
     break;
    }
    else
    {
     isVerified = true;
    }
   }
  }
  //CLOSE JAR FILE
  jarFile.close();
 }
 catch (Exception e) {
  System.out.println("jarsigner: "+e);
  e.printStackTrace();
  System.exit(1);
 }
 return isVerified;
}
/*
 * This checks that everything is valid and unchanged from the digest
 * listed in the manifest next to the name. For example, the
 * digest might look like this (along with the file name)
 *      Name: com/site/MyBestClassYet.class
 *      SHA1-Digest: ew1SIDdlG8cVaiR/FlvwXcasTns=
 */
public static void verifyDigestsImplicitly(JarFile jar, JarEntry entry)
throws SecurityException, IOException
{
 InputStream is = jar.getInputStream( entry );
 byte[] buffer = new byte[8192];
 int n;
 while ((n = is.read(buffer, 0, buffer.length)) != -1) {
  //JUST READ THE ENTRY. WILL THROW A SECURITYEXCEPTION
  //IF SIGNATURE OR DIGEST CHECK FAILS. SINCE WE INSTANTIATED
  //JARFILE WITH "TRUE", THAT TELLS IT TO VERIFY THAT THE
FILES
  //MATCH THE DIGESTS AND HAVEN'T BEEN CHANGED.
 }
 is.close();
}
/*
 * See if any of the certificates used in signing this jar entry
 * are in your keystore
 */
public static boolean findInKeyStore(Certificate[] certificates, KeyStore
keyStore)
{
 String alias = null;
 boolean found = false;
 if ( certificates == null || keyStore == null )
  return false;
 //DID WE FIND A CERT IN THE KEYSTORE, IF YES, IS OK
 for ( int i = 0; i < certificates.length; i++ )
 {
  Certificate cert = certificates[i];
  try
  {
   alias = keyStore.getCertificateAlias( cert );
  }
  catch (KeyStoreException kse)
  {
   System.out.println( kse );
  }
  if ( alias != null )
  {
   found = true;
   break;
  }
 }
 return found;
}