Administration

The CipherTrust Application Data Protection for Java (CADP for Java) is a Java Cryptography Extension (JCE) provider that enables users to integrate the Key Manager's capabilities into their Java applications. CADP for Java is available in two variants:

• Centrally Managed APIs

• Traditional APIs

Centrally Managed APIs

This is our new set of APIs available from CADP for Java 8.18.0 release. CADP for Java offers simplified APIs (Protect/Reveal) to perform cryptography operations. CADP for Java integrates seamlessly with Application Data Protection on CipherTrust Manager, enabling organizations to centrally configure, manage, and enforce data-centric cryptographic policies in a reusable, human-readable format, providing flexibility and ease of management.

Protection policy (ciphers, keys, IV, tweak, and so on) defines how to protect the sensitive data. Whereas, Access policy determines who can view sensitive data and how (plaintext, ciphertext, custom masking format or redacted).

Centrally Managed APIs offer several advantages over traditional APIs, including:

• Developers do not need to understand cryptographic parameters (cipher, key, IV, Nonce, Tweak, and so on) to protect data as the Data Security Admins are responsible to handle configurations and policies.

• Each deployed application with CADP for Java is visible on CipherTrust Manager (providing a Single Pane of Glass view).

• Data Security Admins gain Crypto Agility, enabling real time changes to cipher, keys, and parameters.

Traditional APIs

This is our standard release of CADP for Java which has been delivered so far.

CADP for Java integrates with the Java Cryptographic Extension (JCE), allowing your Java application to perform cryptographic operations for data protection either locally (with key material securely cached in memory) or remotely (by forwarding cryptographic requests to CipherTrust Manager). CADP for Java provides encryption/decryption ciphers, tokenization/detokenization ciphers, sign/verify, MAC/verify operations, along with key management functionalities.

Traditional APIs have some drawbacks compared to centrally managed APIs, as developers must understand and handle cryptographic parameters (cipher, key, IV, nonce, tweak, and so on.) and configurations file by themselves. The CADP for Java configuration is stored in a local file that is deployed with each instance of the application.

General system architecture

The CADP for Java solution consists of the following components:

• CADP for Java Provider

  The CADP for Java Provider offers APIs to secure your data. Install the CADP for Java Provider on all backend servers that will handle cryptographic or key management requests (currently, can be only done through traditional APIs). All applications, servlets, or scripts interact with a standard JCE interface and issue simple Java-based (JCE) commands to the Key Manager for cryptographic operations. The CADP for Java Provider is independent of the underlying backend server.

  The CADP for Java Provider requires:

  • Java Virtual Machine (JVM) with support for SSL and Java Cryptographic Extensions (JCE).

  • Any of the following Java version:

    • Oracle Java version 8 (minimum 1.8.0_111)

    • Oracle Java 10

    • Oracle Java 11 (including OpenJDK and Amazon Corretto)

    • Oracle Java 12 (including OpenJDK and Azul Java)

    • Oracle Java 14, 15, 17, 19, 21 (including OpenJDK)

    • IBM Java 8 (minimum 8.0.6.25)

• Key Manager

  The CADP for Java uses the CipherTrust Manager as its trusted key source.

What's Next

After getting familiar with centrally managed and traditional APIs, follow the quick start section to deploy CADP for Java.