java Digest 5 Sep 2003 15:03:44 -0000 Issue 1283

Fri Sep 5 15:21:00 GMT 2003

> I?m currently writing a client-server applications which needs to be secure.
> I?ve found several working ssl implementations for java, but some of 
> them rely on a thing calles "JCE".
> Is JCE already in GCJ included (since which release of GCJ?)?
> Are there already working javax.crypto classes?

By the way, have you considered tunneling traffic over ssh?
I mean, it is considered very secure. It is easy to set up. It doesn't require you to
modify the original, unsecured application. You would delegate cpu intensive tasks
(encrypting/decrypting) to higly optimized native code.
It doesn't require going to the certificate rigmarole, since it uses a very
defendable system of avoiding the re-exchange of keys.
Another advantage is that in case of a vulnerability in the encryption, you won't
have to change your original application. It will all be handled outside the
application at the level of the operating system.
Just my 5 cent.