The Cryptonite Java Package


What is it?
Cryptonite is a non-certified 100% pure java library for using strong encryption in your java 1.1 programs. It will eventually include all the various key management tools including key certificates, and even a key-server for automatic exchange of keys. It is distributed with full source-code, since noone can be expected to trust an encryption package without seeing the source.

However, Cryptonite is still in a pre-beta form with most of the key-management features untested, although key generation and encryption/decryption is supported.

What does it cost?
Cryptonite is distributed in two ways. You can choose to use it according to the Free software Foundation's (FSF) General Public License (GPL), in which case it is free but you must release your program for free, with full source, under the GPL.

You can also choose to purchase a copy of Cryptonite with a more conventional license for USD 100 per copy.

Is it legal?
That's a difficult question. Cryptonite is developed in Iceland, which has no laws about encryption whatsoever. This means that the use in and export from Iceland is clearly legal.

Most countries allow the use of encryption software within their borders, but do not allow export. This includes the US and much of Europe. Some countries do not allow the use of encryption software at all. These tend to be run by governments who are afraid of their own people.

I'm afraid you will have to check the legal status of encryption software in your region if you are unsure.

Also, some of the algorithms used in Cryptonite are patented and you will need to purchase a license for the algorithms separately. Personally I believe software patents are evil, especially cryptographic patents which tend to be heavily mathematical and based on thousands of years of work by other people. However, companies such as RSA inc. may disagree and you should check the patent status of the algorithms you wish to use in your region before releasing anything.

How does it work?
Cryptonite is a framework for both private and public key encryption and stream classes to easily encrypt and decrypt all data flowing through them. This means that using strong encryption becomes about as easy as using the compression streams included in JDK 1.1. For information about particular encryption algorithms you should look at the RSAKey and DESKey classes in the javadoc documentation.

Cryptonite also includes a lot of helper classes, including fingerprinting and digital signatures.

How secure is it?
There are no known attacks against the RSA algorithm, but it has slight flaws which can be exploited if it is used carelessly. These can be avoided by always padding encrypted messages with random data and by never signing messages directly, but always a hash of the message. The strength also depends heavily on the size of the key you use and the quality of the random number generator used when creating it.

The random number generator included in Cryptonite is fair, but not perfect. It passes the Chi-square test and the gap test as often as you would expect a truly random stream of bytes to do when running in Linux, but slightly less often when running on OS/2. The implementation of the random number generator is such that it may behave differently on different systems and concievably could behave quite predictably on some. Note that it uses a similar technique as the initialization of the SecureRandom class in the java libraries.

You should run the TestRandom program on your system to see if it behaves well on your system.

The DES algorithm is good but suffers from a too small key and the block size is beginning to become too small. The former is addressed by the Triple-DES variant of DES and the latter by using CBC mode in which case up to 32GB og data can be encrypted with a single key.

The TEA algorithm which was included in Cryptonite up to version 0.08 has been broken. Please do not use it.

How do I use it?
Encryption with Cryptonite happens on three levels. The simplest is to encrypt single blocks of data directly by calling the CipherKey.encrypt() methods and decrypt them with the CipherKey.decrypt() methods.

Alternatively you can create an EncryptMode object with a particular cipher-key to encrypt arbitrary arrays of data and decrypt them again with a corresponding DecryptMode object.

The most useful method is to use the EncryptStream and DecryptStream classes to filter your i/o operations. They will encrypt or decrypt all data that passes through them. If you need interactive key exchange you can use the CipherStreamClient and CipherStreamServer classes.

You can also have a look at the complete javadoc documentation for more details..

How do I get it?
Here you may view the commercial license agreement and if you agree to its terms or choose to use Cryptonite according to the GPL you may download the archive. If you use Cryptonite in one of your projects, I'd like to hear about it. If you decide not to use Cryptonite I'd also like to hear why, so that I may improve it.
How do I know about new releases?
By entering your e-mail address and pressing the button below, you will be notified by the url-minder service whenever this page is changed.

[ General info | Status & Plans | FAQ | Commercial License | Class docs ] [ Logi Ragnarsson | Send Mail ]