The following are text descriptions of images used in Java Cryptography Architecture (JCA) Reference Guide

Description of Figure 1: MD5 Message Digest Implementation

This figure consists of two diagrams. The first diagram represents an application that requests and MD5 algorithm implementation without specifying a provider name. The second diagram represents an application that requests and MD5 algorithm implementation from a specific provider:

Without Specifying Provider Name

This figure consists of five cylinders arranged in three rows. These cylinders, from top to bottom, are labeled as follows:

• Application
• Provider Framework
• This row contains three cylinders. Each cylinder in this row has an arrow pointing up towards the cylinder above it (Provider Framework):
  • ProviderA: Message Digest SHA-1 SHA-256 (this cylinder has an X on it)
  • ProviderB: Message Digest MD5 SHA-512 (this cylinder has a check mark on it)
  • ProviderC: Message Digest MD5 SHA-256

An arrow labeled MessageDigest_getInstance("MD5") with an arrow head labeled "MDS MessageDigest from ProviderB" starts from the Application cylinder and passes through the following objects:

• Provider Framework cylinder
• ProviderA arrow
• ProviderB arrow
• Provider Framework cylinder (again)

The arrow head points to the Application cylinder.

From Specific Provider

This figure consists of five cylinders arranged in three rows. These cylinders, from top to bottom, are labeled as follows:

• Application
• Provider Framework
• This row contains three cylinders. Each cylinder in this row has an arrow pointing up towards the cylinder above it (Provider Framework):
  • ProviderA: Message Digest SHA-1 SHA-256
  • ProviderB: Message Digest MD5 SHA-512
  • ProviderC: Message Digest MD5 SHA-256 (this cylinder has a check mark on it)

An arrow labeled MessageDigest_getInstance("MD5", "ProviderC") with an arrow head labeled "MDS MessageDigest from ProviderC" starts from the Application cylinder and passes through the following objects:

• Provider Framework cylinder
• ProviderC arrow
• Provider Framework cylinder (again)

The arrow head points to the Application cylinder.

Description of Figure 2: Example of How Application Retrieves "AES" Cipher Instance

This figure consists of five boxes:

• Application: This box contains the following pseudocode:

  c:Cipher.getInstance("AES");

• JCA/JCE: This box contains the following list:

  • Signature
  • Message Digest
  • Key Script Generator
  • Key Factory
  • Algorithm Parameters
  • Cipher
  • Key Agreement
  • Key Generator
  • Secret Key Factory
  • MAC

• CSP, CSP2, CSP3: These boxes represent cryptographic service providers

• The fifth box represents CSP3. It contains the following headers and pseudocode:

  • Provider.class

    "Cipher.AES" -> "com.foo.AESCipher"

  • com.foo.AESCipher.class

    package com.foo:
      class AESCipher extends CipherSPi {
        .
        .
        .
      }

Arrows connect the boxes as follows:

• From Application to JCA/JCE
• From JCA/JCE to CSP1, CSP2, and CSP3 (the arrow branches)

A dotted line connects CSP3 to the headings Provider.class and com.foo.AESCipher.class

Description of Figure 3: Example of Provider Subclass

This figure consists of a cylinder labeled Provider C and a box. Dotted lines are used to indicate that Provider C contains the contents of the box. The box contains the following headers and Java code:

• provider.java

  public class fooJCA extends Provider {
      .
      .
      .
      put("MessageDigest.MD5", "com.foo.MD5");
      .
      .
      .
  {}

• com.foo.MD5.java

  package com.foo;
  public class MD5 extends
      MessageDigestSpi {
      .
      .
      .
  }

Description of Figure 4: The SecureRandom Class

This figure consists of three boxes labeled as follows:

• Seed
• SecureRandom (SHA1PRNG)
• data

Labeled arrows connect these boxes:

• setSeed(): From Seed to SecureRandom (SHA1PRNG)
• digest() and nextBytes(): From SecureRandom (SHA1PRNG) to data

Description of Figure 5: The MessageDigest Class

This figure consists of three boxes labeled as follows:

• Data
• Message Digest (MD5)
• Digest/Hash

Labeled arrows connect these boxes:

• update(): From Data to Message Digest (MD5)
• digest(): From Message Digest (MD5) to Digest/Hash

Description of Figure 6: The Signature Class

This figure consists of boxes labeled as follows:

• Generated by a Key Pair Generator: Contains a box labeled Private Key/Public Key
• Data
• These two boxes are attached to each other:
  • Signature (MD5withRSA): Box 1 of 2
  • Sign
• Signature Bytes
• These two boxes are attached to each other:
  • Signature (MD5withRSA): Box 2 of 2
  • Verify
• Yes/No

Labeled arrows connect these boxes:

• update(): From Data to Signature (MD5withRSA) #1
• update(): From Data to Signature (MD5withRSA) #2
• sign(): From Signature (MD5withRSA) #1 to Signature Bytes
• verify(): From Signature Bytes Data to Signature (MD5withRSA) #2

Unlabeled arrows connect these boxes:

• From Generated by a Key Pair Generator to Signature (MD5withRSA) #1 and Signature (MD5withRSA) #2 (the arrow branches)
• From Signature (MD5withRSA) #2 to Yes/No

Description of Figure 7: The Cipher Class

This figure consists of boxes labeled as follows:

• Key: Contains a box labeled Secret Key
• Plaintext
• These two boxes are attached to each other:
  • Cipher (AES): Box 1 of 2
  • Encrypt
• Algorithm Parameters
• Ciphertext
• These two boxes are attached to each other:
  • Cipher (AES): Box 2 of 2
  • Decrypt
• Plaintext

Labeled arrows connect these boxes:

• update(): From Plaintext to the Cipher (AES) #1
• doFinal(): From Plaintext to Encrypt
• update(): From Ciphertext to the Cipher (AES) #2
• doFinal(): From Ciphertext to Decrypt

Unlabeled arrows connect these boxes:

• From Key to the Cipher (AES) #1 and Cipher (AES) #2 (the arrow branches)
• From Cipher (AES) #1 to Algorithm Parameters
• From Algorithm Parameters to the Cipher (AES) compartment of the Decrypt box
• From Cipher (AES) #2 to Plaintext
• From Decrypt to Plaintext

Description of Figure 8: The Mac Class

This figure consists of boxes labeled as follows:

• Data: Two boxes are labeled this
• MAC (HmacMD5): Two boxes are labeled this
• Shared Secret Key
• Signal Digest Hash: Two boxes are labeled this
• If data was the same, the hash is the same

Labeled arrows connect these boxes:

• update(): From Data #1 to MAC (HmacMD5) #1
• doFinal(): From Data #1 to MAC (HmacMD5) #1
• update(): From Data #2 to MAC (HmacMD5) #2
• doFinal(): From Data #2 to MAC (HmacMD5) #2

Unlabeled arrows connect these boxes:

• From Shared Secret Key to MAC (HmacMD5) (two separate arrows)
• From MAC (HmacMD5) #1 to Signed Digest Hash #1
• From MAC (HmacMD5) #2 to Signed Digest Hash #2
• From Signed Digest Hash #1 to If data was the same, the hash is the same
• From Signed Digest Hash #2 to If data was the same, the hash is the same

Description of Figure 9: Differences Between Generators and Factories

This figure consists of two diagrams:

Generators

This diagram contains the following caption: Generators — Generate new objects based on initialization parameters

It consists of boxes labeled as follows:

• Initialization Parameters (Key Length)
• Generator
• Object Secret Key

Unlabeled arrows connect these boxes:

• From Initialization Parameters (Key Length) to Generator
• From Generator to Object Secret Key

Factories

This diagram contains the following caption: Factories — Transform existing specific objects into other object types

It consists of boxes labeled as follows:

• Type 1 Key Spec
• Factory
• Type 2 Secret Key

Unlabeled arrows connect these boxes:

• From Type 1 Key Spec to Factory
• From Factory to Type 2 Secret Key

Description of Figure 10: The KeyFactory Class

This figure consists of boxes labeled as follows:

• Key Spec
• Key Factory (RSA): Two boxes are labeled this
• Private Key
• Public Key
• Key Spec

Labeled arrows connect these boxes:

• generatePrivate(): From Key Factory (RSA) #1 to Private Key
• generatePublic(): From Key Factory (RSA) #1 to Public Key
• getKeySpec(): From Key Factory (RSA) #2 to Key Spec

Unlabeled arrows connect these boxes:

• From Key Spec to Key Factory (RSA) #1
• From Key to Key Factory (RSA) #2

Description of Figure 11: The SecretKeyFactory Class

This figure consists of boxes labeled as follows:

• Key Spec: Two boxes are labeled this
• Secret Key Factory (DES): This box has a sublabel, generateSecret()
• Secret Key: Two boxes are labeled this
• Secret Key Factory (DES): This box has a sublabel, getKeySpec()

Unlabeled arrows connect these boxes:

• From Key Spec #1 to Secret Key Factory (DES), generateSecret()
• From Secret Key Factory (DES), generateSecret() to Secret Key #1
• From Secret Key #2 to Secret Key Factory (DES), getKeySpec()
• From Secret Key Factory (DES), getKeySpec() to Key Spec #2

Description of Figure 12: The KeyPairGenerator Class

This figure consists of boxes labeled as follows:

• These boxes are joined by the word "or":
  • key length
  • AlgorithmParameterSpec
• Key Pair Generator (DH)
• Key Pair
• Private Key
• Public Key

Labeled arrows connect these boxes:

• init(): From key length to Key Pair Generator (DH)
• init(): From AlgorithmParameterSpec to Key Pair Generator (DH)
• genKeyPair(): From Key Pair Generator (DH) to Key Pair
• getPrivate(): From Key Pair to Private Key
• getPublic(): From Key Pair to Public Key

Description of Figure 13: The KeyGenerator Class

This figure consists of boxes labeled as follows:

• These boxes are joined by the word "or":
  • key length
  • AlgorithmParameterSpec
• Key Generator (AES)
• Secret Key

Labeled arrows connect these boxes:

• init(): From key length to Key Generator (AES)
• init(): From AlgorithmParameterSpec to Key Generator (AES)
• generateKey(): From Key Generator (AES) to Secret Pair

Description of Figure 14: The KeyAgreement Class

This figure is divided into halves by a dashed line. The top half is labeled Alice, and the bottom half is labeled Bob. The figure consists of boxes labeled as follows:

• These boxes are in Alice's half:
  • Key: This box contains a box labeled Alice's Private
  • Key: This box contains a box labeled Bob's Public
  • Key Agreement (DH)
  • Bytes: This box has another label, Bytes
• These boxes are in Bob's half:
  • Key: This box contains a box labeled Bob's Private
  • Key: This box contains a box labeled Alice's Public
  • Key Agreement (DH)
  • Bytes: This box has another label, Bytes

Labeled arrows connect these boxes:

• These arrows are in Alice's half:
  • init(): From Alice's Private Key to Key Agreement (DH)
  • doPhase(): From Bob's Public Key to Key Agreement (DH)
  • generateSecret(): From Key Agreement (DH) to Bytes
• These arrows are in Bob's half:
  • init(): From Bob's Private Key to Key Agreement (DH)
  • doPhase(): From Alice's Public Key to Key Agreement (DH)
  • generateSecret(): From Key Agreement (DH) to Bytes

A double-headed arrow joins the Bytes boxes in Alice's and Bob's halves. This arrow is labeled "Should be the same."

• init(): From key length to Key Generator (AES)
• init(): From AlgorithmParameterSpec to Key Generator (AES)
• generateKey(): From Key Generator (AES) to Secret Pair

Description of Figure 15: The KeyStore Class

This figure consists of a table labeled JKS and a cylinder labeled File.

The table JKS contains the following:

Alias	Type	Data
Brad	Secret Key	...
Milton	Trusted Certificate	...
Duke	Trusted Certificate	...

An arrow labeled store() points from the JKS table to the File cylinder. An arrow labeled load() points from the File cylinder to the JKS cylinder.

Description of Figure 16: SSL Messages

This figure contains two lists of steps that are next to each other. The list to the left is labeled Client. The list to the right is labeled Server.

The Client list contains the following items:

• 1. Client hello
• 7. Certificate optional
• 8. Client key exchange
• 9. Certificate verify optional
• 10. Change cipher spec
• 11. Finished
• 14. Encrypted data
• 15. Close messages

Five empty lines separate item 1. Client hello and item 7. Certificate. Two empty lines separate item 11. Finished and item 14. Finished.

The Server list contains the following items:

• 2. Server hello
• 3. Certificate optional
• 4. Certificate request optional
• 5. Server key exchange optional
• 6. Server hello done
• 12. Change cipher spec
• 13. Finished
• 14. Encrypted data
• 15. Close messages

Five empty lines separate item 6. Server hello done and item 12. Change cipher spec.

An arrow points from each item in the Client list to the corresponding empty line in the Server list. Similarly, an arrow points from each item in the Server list to the corresponding empty line in the Client list. For items 14 and 15 in the Client and Server lists, double-headed arrows connect them instead.