JSSE中的术语和定义
| 术语/定义英文 | 介绍 |
|---|---|
| authentication | The process of confirming the identity of a party with whom one is communicating. 认证 : 确认通讯某一参与方的身份的过程 |
| cipher suite | A combination of cryptographic parameters that define the security algorithms and key sizes used for authentication, key agreement, encryption, and integrity protection. 加密套件:一组加密参数，定义了用于身份认证，密钥约定，加密和一致性保护的安全算法和密钥大小尺寸。 |
| certificate | A digitally signed statement vouching for the identity and public key of an entity (person, company, and so on). Certificates can either be self-signed or issued by a Certificate Authority (CA) , an entity that is trusted to issue valid certificates for other entities. Well-known CAs include VeriSign, Entrust, and GTE CyberTrust. X509 is a common certificate format that can be managed by the JDK’s keytool. 证书:一个数字签名的声明,用于证明一个实体的身份和公钥，这个实体可以是一个自然人，公司或者其他。 证书可以是自签名的或者由CA颁发，CA是一个可以信赖的可以向其它实体颁发有效证书的实体。 一些众所周知的CA包括VeriSign,Entrust和GTE CyberTrust。 X509是一个通用的证书格式，可以被JDK的keytool工具管理。 |
| cryptographic hash function | An algorithm that is used to produce a relatively small fixed-size string of bits (called a hash) from an arbitrary block of data. A cryptographic hash function is similar to a checksum and has three primary characteristics: it is a one-way function, meaning that it is not possible to produce the original data from the hash; a small change in the original data produces a large change in the resulting hash; and it does not require a cryptographic key. 密码哈希函数 从任意一块数据中生成相对小体积且固定长度的二进制位串，也称作哈希，的算法。 一个密码哈希函数类似于一个校验和，他有三个主要特征: 1.单向，意味着不能从生成的哈希值反向生成源始数据; 2.源数据一个微小的变化就会在结果哈希中产生一个较大的变化; 3.不需要加密密钥。 |
| Cryptographic Service Provider | Sometimes referred to simply as provider for short, the Java Cryptography Architecture (JCA) defines it as a package (or set of packages) that implements one or more engine classes for specific cryptographic algorithms. An engine class defines a cryptographic service in an abstract fashion without a concrete implementation. 加密服务提供者 有时候简称作提供者，JCA把它定义为一个或者一组包，这些包实现了特定加解密算法一个或者多个引擎类。 一个引擎类是一个加解密服务的抽象定义，不包含具体实现。 |
| digital signature | A digital equivalent of a handwritten signature. It is used to ensure that data transmitted over a network was sent by whoever claims to have sent it and that the data has not been modified in transit. For example, an RSA-based digital signature is calculated by first computing a cryptographic hash of the data and then encrypting the hash with the sender’s private key. 数字签名 数字领域中，跟现实世界手写签名对等的概念。用于确保网络上传输的数据来自所声明的发送者并且传输过程中没有被修改。 比如,一个基于RSA的数字签名的计算过程是首先计算出数据的加密哈希值，然后使用发送者的私钥加密这个哈希。 |
| encryption/decryption | Encryption is the process of using a complex algorithm to convert an original message (cleartext) to an encoded message (ciphertext) that is unintelligible unless it is decrypted. Decryption is the inverse process of producing cleartext from ciphertext. The algorithms used to encrypt and decrypt data typically come in two categories: secret key (symmetric) cryptography and public key (asymmetric) cryptography. 加密/解密 加密:使用复杂算法将原始信息(明文)转换成加密消息(密文)的过程，密文不经过解密是不可理解的。 解密:从密文产生明文的过程，可加密过程相反。 加解密算法主要分为两类:密码加解密(对称算法)和公钥加解密(非对称算法)。 |
| handshake protocol | The negotiation phase during which the two socket peers agree to use a new or existing session. The handshake protocol is a series of messages exchanged over the record protocol. At the end of the handshake, new connection-specific encryption and integrity protection keys are generated based on the key agreement secrets in the session. 握手协议 握手是套接字两端约定使用一个新的或者已经存在的会话的一个协商阶段。 握手协议是在记录协议之上的一系列消息交换。 在握手阶段的结束，新的连接相关的加密和一致性保护密钥被生成。 |
| key agreement | A method by which two parties cooperate to establish a common key. Each side generates some data, which is exchanged. These two pieces of data are then combined to generate a key. Only those holding the proper private initialization data can obtain the final key. Diffie-Hellman (DH) is the most common example of a key agreement algorithm. 密钥约定 双方协作建立一个通用密钥的方法。 每一方生成一些数据并交换，然后这两部分数据联合起来生成一个密钥。 只有那些持有正确的秘密初始化数据的参与方才能获得最终的密钥。 举个例子,DH就是一个最常见的密钥约定算法。 |
| key exchange | A method by which keys are exchanged. One side generates a private key and encrypts it using the peer’s public key (typically RSA). The data is transmitted to the peer, who decrypts the key using the corresponding private key. 密钥交换 密钥被交换的方法。 一方生成一个密钥并使用对方的公钥加密(典型例子RSA),数据传送到对方，对方使用相应的私钥解密得出该密钥。 |
| key manager/trust manager | Key managers and trust managers use keystores for their key material. A key manager manages a keystore and supplies public keys to others as needed (for example, for use in authenticating the user to others). A trust manager decides who to trust based on information in the truststore it manages. |
| keystore/truststore | A keystore is a database of key material. Key material is used for a variety of purposes, including authentication and data integrity. Various types of keystores are available, including PKCS12 and Oracle’s JKS. Generally speaking, keystore information can be grouped into two categories: key entries and trusted certificate entries. A key entry consists of an entity’s identity and its private key, and can be used for a variety of cryptographic purposes. In contrast, a trusted certificate entry contains only a public key in addition to the entity’s identity. Thus, a trusted certificate entry cannot be used where a private key is required, such as in a javax.net.ssl.KeyManager. In the JDK implementation of JKS, a keystore may contain both key entries and trusted certificate entries. A truststore is a keystore that is used when making decisions about what to trust. If you receive data from an entity that you already trust, and if you can verify that the entity is the one that it claims to be, then you can assume that the data really came from that entity. An entry should only be added to a truststore if the user trusts that entity. By either generating a key pair or by importing a certificate, the user gives trust to that entry. Any entry in the truststore is considered a trusted entry. It may be useful to have two different keystore files: one containing just your key entries, and the other containing your trusted certificate entries, including CA certificates. The former contains private information, whereas the latter does not. Using two files instead of a single keystore file provides a cleaner separation of the logical distinction between your own certificates (and corresponding private keys) and others’ certificates. To provide more protection for your private keys, store them in a keystore with restricted access, and provide the trusted certificates in a more publicly accessible keystore if needed. |
| message authentication code (MAC) | Provides a way to check the integrity of information transmitted over or stored in an unreliable medium, based on a secret key. Typically, MACs are used between two parties that share a secret key in order to validate information transmitted between these parties. A MAC mechanism that is based on cryptographic hash functions is referred to as HMAC. HMAC can be used with any cryptographic hash function, such as Secure Hash Algorithm (SHA-256), in combination with a secret shared key. HMAC is specified in RFC 2104. |
| public-key cryptography | A cryptographic system that uses an encryption algorithm in which two keys are produced. One key is made public, whereas the other is kept private. The public key and the private key are cryptographic inverses; what one key encrypts only the other key can decrypt. Public-key cryptography is also called asymmetric cryptography. |
| Record Protocol | A protocol that packages all data (whether application-level or as part of the handshake process) into discrete records of data much like a TCP stream socket converts an application byte stream into network packets. The individual records are then protected by the current encryption and integrity protection keys. |
| secret-key cryptography | A cryptographic system that uses an encryption algorithm in which the same key is used both to encrypt and decrypt the data. Secret-key cryptography is also called symmetric cryptography. |
| session | A named collection of state information including authenticated peer identity, cipher suite, and key agreement secrets that are negotiated through a secure socket handshake and that can be shared among multiple secure socket instances. 会话 一个命名了的状态信息集合，这些信息包括安全套接字握手阶段协商得到的认证对方的身份信息，加密套件信息盒密钥约定秘密信息，这些信息可以在多个安全套接字实例之间共享。 |
资料来源 :
Java Secure Socket Extension (JSSE) Reference Guide