Este documento descreve a maneira correta de usar os recursos criptográficos do Android e inclui alguns exemplos de uso. Se o app exigir maior segurança de chave, use o sistema Android Keystore.
Especificar um provedor apenas com o sistema Android Keystore
Se você estiver usando o sistema Android Keystore, precisará especificar um provedor.
Em outras situações, no entanto, o Android não garante um provedor específico para um determinado algoritmo. A especificação de um provedor sem usar o sistema Android Keystore pode causar problemas de compatibilidade em versões futuras.
Escolher um algoritmo recomendado
Quando você tem a liberdade de escolher qual algoritmo usar (por exemplo, quando não precisa de compatibilidade com um sistema de terceiros), recomendamos o uso dos seguintes algoritmos:
Classe | Recomendação |
---|---|
Cipher | AES no modo CBC ou GCM com chaves de 256 bits (como AES/GCM/NoPadding ) |
MessageDigest | Família SHA-2 (por exemplo, SHA-256 ) |
Mac | HMAC da família SHA-2 (por exemplo, HMACSHA256 ) |
Assinatura | Família SHA-2 com ECDSA (por exemplo, SHA256withECDSA ) |
Executar operações criptográficas comuns
As seções a seguir incluem snippets que demonstram como você pode concluir operações criptográficas comuns no seu app.
Ler um arquivo
Kotlin
// Although you can define your own key generation parameter specification, it's // recommended that you use the value specified here. val mainKey = MasterKey.Builder(applicationContext) .setKeyScheme(MasterKey.KeyScheme.AES256_GCM) .build() val fileToRead = "my_sensitive_data.txt" val encryptedFile = EncryptedFile.Builder( applicationContext, File(DIRECTORY, fileToRead), mainKey, EncryptedFile.FileEncryptionScheme.AES256_GCM_HKDF_4KB ).build() val inputStream = encryptedFile.openFileInput() val byteArrayOutputStream = ByteArrayOutputStream() var nextByte: Int = inputStream.read() while (nextByte != -1) { byteArrayOutputStream.write(nextByte) nextByte = inputStream.read() } val plaintext: ByteArray = byteArrayOutputStream.toByteArray()
Java
// Although you can define your own key generation parameter specification, it's // recommended that you use the value specified here. Context context = getApplicationContext(); MasterKey mainKey = new MasterKey.Builder(context) .setKeyScheme(MasterKey.KeyScheme.AES256_GCM) .build(); String fileToRead = "my_sensitive_data.txt"; EncryptedFile encryptedFile = new EncryptedFile.Builder(context, new File(DIRECTORY, fileToRead), mainKey, EncryptedFile.FileEncryptionScheme.AES256_GCM_HKDF_4KB ).build(); InputStream inputStream = encryptedFile.openFileInput(); ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream(); int nextByte = inputStream.read(); while (nextByte != -1) { byteArrayOutputStream.write(nextByte); nextByte = inputStream.read(); } byte[] plaintext = byteArrayOutputStream.toByteArray();
Gravar um arquivo
Kotlin
// Although you can define your own key generation parameter specification, it's // recommended that you use the value specified here. val mainKey = MasterKey.Builder(applicationContext) .setKeyScheme(MasterKey.KeyScheme.AES256_GCM) .build() // Create a file with this name, or replace an entire existing file // that has the same name. Note that you cannot append to an existing file, // and the file name cannot contain path separators. val fileToWrite = "my_sensitive_data.txt" val encryptedFile = EncryptedFile.Builder( applicationContext, File(DIRECTORY, fileToWrite), mainKey, EncryptedFile.FileEncryptionScheme.AES256_GCM_HKDF_4KB ).build() val fileContent = "MY SUPER-SECRET INFORMATION" .toByteArray(StandardCharsets.UTF_8) encryptedFile.openFileOutput().apply { write(fileContent) flush() close() }
Java
// Although you can define your own key generation parameter specification, it's // recommended that you use the value specified here. Context context = getApplicationContext(); MasterKey mainKey = new MasterKey.Builder(context) .setKeyScheme(MasterKey.KeyScheme.AES256_GCM) .build(); // Create a file with this name, or replace an entire existing file // that has the same name. Note that you cannot append to an existing file, // and the file name cannot contain path separators. String fileToWrite = "my_sensitive_data.txt"; EncryptedFile encryptedFile = new EncryptedFile.Builder(context, new File(DIRECTORY, fileToWrite), mainKey, EncryptedFile.FileEncryptionScheme.AES256_GCM_HKDF_4KB ).build(); byte[] fileContent = "MY SUPER-SECRET INFORMATION" .getBytes(StandardCharsets.UTF_8); OutputStream outputStream = encryptedFile.openFileOutput(); outputStream.write(fileContent); outputStream.flush(); outputStream.close();
Criptografar uma mensagem
Kotlin
val plaintext: ByteArray = ... val keygen = KeyGenerator.getInstance("AES") keygen.init(256) val key: SecretKey = keygen.generateKey() val cipher = Cipher.getInstance("AES/CBC/PKCS5PADDING") cipher.init(Cipher.ENCRYPT_MODE, key) val ciphertext: ByteArray = cipher.doFinal(plaintext) val iv: ByteArray = cipher.iv
Java
byte[] plaintext = ...; KeyGenerator keygen = KeyGenerator.getInstance("AES"); keygen.init(256); SecretKey key = keygen.generateKey(); Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5PADDING"); cipher.init(Cipher.ENCRYPT_MODE, key); byte[] ciphertext = cipher.doFinal(plaintext); byte[] iv = cipher.getIV();
Gerar um resumo de mensagens
Kotlin
val message: ByteArray = ... val md = MessageDigest.getInstance("SHA-256") val digest: ByteArray = md.digest(message)
Java
byte[] message = ...; MessageDigest md = MessageDigest.getInstance("SHA-256"); byte[] digest = md.digest(message);
Gerar uma assinatura digital
Você precisa ter um objeto PrivateKey contendo a chave de assinatura, que pode ser gerada no momento da execução, lida em um arquivo incluído no seu app ou adquirida em alguma outra origem, dependendo das suas necessidades.
Kotlin
val message: ByteArray = ... val key: PrivateKey = ... val s = Signature.getInstance("SHA256withECDSA") .apply { initSign(key) update(message) } val signature: ByteArray = s.sign()
Java
byte[] message = ...; PrivateKey key = ...; Signature s = Signature.getInstance("SHA256withECDSA"); s.initSign(key); s.update(message); byte[] signature = s.sign();
Verificar uma assinatura digital
Você precisa ter um objeto PublicKey contendo a chave pública do assinante, que pode ser lida em um arquivo empacotado com seu app, extraída de um certificado ou adquirida em alguma outra origem, dependendo das suas necessidades.
Kotlin
val message: ByteArray = ... val signature: ByteArray = ... val key: PublicKey = ... val s = Signature.getInstance("SHA256withECDSA") .apply { initVerify(key) update(message) } val valid: Boolean = s.verify(signature)
Java
byte[] message = ...; byte[] signature = ...; PublicKey key = ...; Signature s = Signature.getInstance("SHA256withECDSA"); s.initVerify(key); s.update(message); boolean valid = s.verify(signature);
Complexidades de implementação
Alguns detalhes da implementação de criptografia do Android parecem incomuns, mas estão presentes devido a preocupações de compatibilidade. Esta seção discute as que você provavelmente encontrará.
Resumo da mensagem OAEP MGF1
As criptografias RSA OAEP são parametrizadas por dois resumos de mensagens diferentes: o resumo “principal”
e o resumo MGF1. Há identificadores de criptografia que incluem nomes de
resumo, por exemplo, Cipher.getInstance("RSA/ECB/OAEPwithSHA-256andMGF1Padding")
,
que especificam o resumo principal e deixam o resumo MGF1 não especificado. Para o Android
Keystore, o SHA-1 é usado para o resumo MGF1. Para outros
provedores criptográficos do Android, os dois resumos são iguais.
Para ter mais controle sobre os resumos que seu app usa, solicite uma
criptografia com OAEPPadding, como em Cipher.getInstance("RSA/ECB/OAEPPadding")
, e
forneça um OAEPParameterSpec
a init()
para escolher explicitamente os dois resumos.
Kotlin
val key: Key = ... val cipher = Cipher.getInstance("RSA/ECB/OAEPPadding") .apply { // To use SHA-256 the main digest and SHA-1 as the MGF1 digest init(Cipher.ENCRYPT_MODE, key, OAEPParameterSpec("SHA-256", "MGF1", MGF1ParameterSpec.SHA1, PSource.PSpecified.DEFAULT)) // To use SHA-256 for both digests init(Cipher.ENCRYPT_MODE, key, OAEPParameterSpec("SHA-256", "MGF1", MGF1ParameterSpec.SHA256, PSource.PSpecified.DEFAULT)) }
Java
Key key = ...; Cipher cipher = Cipher.getInstance("RSA/ECB/OAEPPadding"); // To use SHA-256 the main digest and SHA-1 as the MGF1 digest cipher.init(Cipher.ENCRYPT_MODE, key, new OAEPParameterSpec("SHA-256", "MGF1", MGF1ParameterSpec.SHA1, PSource.PSpecified.DEFAULT)); // To use SHA-256 for both digests cipher.init(Cipher.ENCRYPT_MODE, key, new OAEPParameterSpec("SHA-256", "MGF1", MGF1ParameterSpec.SHA256, PSource.PSpecified.DEFAULT));
Funcionalidades suspensas
As seções a seguir descrevem funcionalidades suspensas que você não deve mais usar no seu app.
Algoritmos do Bouncy Castle
As implementações do Bouncy Castle de muitos algoritmos estão obsoletas. Isso só afeta casos em que você solicita explicitamente o provedor do Bouncy Castle, conforme mostrado no exemplo a seguir:
Kotlin
Cipher.getInstance("AES/CBC/PKCS7PADDING", "BC") // OR Cipher.getInstance("AES/CBC/PKCS7PADDING", Security.getProvider("BC"))
Java
Cipher.getInstance("AES/CBC/PKCS7PADDING", "BC"); // OR Cipher.getInstance("AES/CBC/PKCS7PADDING", Security.getProvider("BC"));
Conforme mencionado acima, não é recomendável solicitar um provedor específico. Portanto, se seguir essa diretriz, essa suspensão de uso não afetará você.
Criptografias baseadas em senhas sem IV
As criptografias baseadas em senha (PBE, na sigla em inglês) que exigem um vetor de inicialização (IV, na sigla em inglês) podem adquiri-lo na chave, se ela for construída adequadamente ou em um IV transmitido explicitamente. Ao transmitir uma chave de PBE que não contém um IV e nenhum IV explícito, as criptografias PBE no Android atualmente assumem um IV de zero.
Ao usar criptografias PBE, sempre transmita um IV explícito, conforme mostrado neste snippet de código:
Kotlin
val key: SecretKey = ... val cipher = Cipher.getInstance("PBEWITHSHA256AND256BITAES-CBC-BC") val iv = ByteArray(16) SecureRandom().nextBytes(iv) cipher.init(Cipher.ENCRYPT_MODE, key, IvParameterSpec(iv))
Java
SecretKey key = ...; Cipher cipher = Cipher.getInstance("PBEWITHSHA256AND256BITAES-CBC-BC"); byte[] iv = new byte[16]; new SecureRandom().nextBytes(iv); cipher.init(Cipher.ENCRYPT_MODE, key, new IvParameterSpec(iv));
Provedor de criptografia
A partir do Android 9 (API de nível 28), o provedor de criptografia Java Cryptography Architecture
(JCA) foi removido. Se o app solicitar uma instância do
provedor de criptografia, por exemplo, chamar o método a seguir, ocorrerá um
NoSuchProviderException
.
Kotlin
SecureRandom.getInstance("SHA1PRNG", "Crypto")
Java
SecureRandom.getInstance("SHA1PRNG", "Crypto");
Algoritmos compatíveis
Estes são os identificadores de algoritmo JCA compatíveis com o Android em cada nível de API:
AlgorithmParameterGenerator
AlgorithmParameters
CertPathBuilder
CertPathValidator
CertStore
CertificateFactory
Cipher
KeyAgreement
KeyFactory
KeyGenerator
KeyManagerFactory
KeyPairGenerator
KeyStore
Mac
MessageDigest
SSLContext
SSLEngine.Supported
SSLSocket.Supported
SecretKeyFactory
SecureRandom
Signature
TrustManagerFactory
AlgorithmParameterGenerator
Algoritmo | Níveis de API compatíveis |
---|---|
AES | 1-8 |
DES | 1-8 |
DESede | 1-8 |
DH | 1+ |
DSA | 1+ |
AlgorithmParameters
Algoritmo | Níveis de API compatíveis |
---|---|
AES | 1+ |
BLOWFISH | 10+ |
ChaCha20 | 28+ |
DES | 1+ |
DESede | 1+ |
DH | 1+ |
DSA | 1+ |
EC | 26+ |
GCM | 22+ |
IES | 1-8 |
OAEP | 1+ |
PBEwithHmacSHA1AndAES_128 | 26+ |
PBEwithHmacSHA1AndAES_256 | 26+ |
PBEwithHmacSHA224AndAES_128 | 26+ |
PBEwithHmacSHA224AndAES_256 | 26+ |
PBEwithHmacSHA256AndAES_128 | 26+ |
PBEwithHmacSHA256AndAES_256 | 26+ |
PBEwithHmacSHA384AndAES_128 | 26+ |
PBEwithHmacSHA384AndAES_256 | 26+ |
PBEwithHmacSHA512AndAES_128 | 26+ |
PBEwithHmacSHA512AndAES_256 | 26+ |
PKCS12PBE | 1+ |
PSS | 1-8,24+ |
CertPathBuilder
Algoritmo | Níveis de API compatíveis |
---|---|
PKIX | 1+ |
CertPathValidator
Algoritmo | Níveis de API compatíveis |
---|---|
PKIX | 1+ |
CertStore
Algoritmo | Níveis de API compatíveis |
---|---|
Coleção | 1+ |
CertificateFactory
Algoritmo | Níveis de API compatíveis |
---|---|
X.509 | 1+ |
Cipher
Algoritmo | Modos | Paddings | Níveis de API compatíveis | Observações |
---|---|---|---|---|
AES | CBC CFB CTR CTS ECB OFB |
ISO10126Padding NoPadding PKCS5Padding |
1+ | |
GCM | NoPadding | 10+ | ||
AES_128 | CBC ECB |
NoPadding PKCS5Padding |
26+ | |
GCM | NoPadding | 26+ | ||
AES_256 | CBC ECB |
NoPadding PKCS5Padding |
26+ | |
GCM | NoPadding | 26+ | ||
ARC4 | ECB | NoPadding | 10+ | |
NONE | NoPadding | 28+ | ||
BLOWFISH | CBC CFB CTR CTS ECB OFB |
ISO10126Padding NoPadding PKCS5Padding |
10+ | |
ChaCha20 | NONE Poly1305 |
NoPadding | 28+ | ChaCha com 20 rodadas, valor de uso único de 96 bits e contador de 32 bits, conforme descrito em RFC 7539. |
DES | CBC CFB CTR CTS ECB OFB |
ISO10126Padding NoPadding PKCS5Padding |
1+ | |
DESede | CBC CFB CTR CTS ECB OFB |
ISO10126Padding NoPadding PKCS5Padding |
1+ | |
RSA | ECB NONE |
NoPadding OAEPPadding PKCS1Padding |
1+ | |
OAEPwithSHA-1andMGF1Padding OAEPwithSHA-256andMGF1Padding |
10+ | |||
OAEPwithSHA-224andMGF1Padding OAEPwithSHA-384andMGF1Padding OAEPwithSHA-512andMGF1Padding |
23+ |
KeyAgreement
Algoritmo | Níveis de API compatíveis |
---|---|
DH | 1+ |
ECDH | 11+ |
KeyFactory
Algoritmo | Níveis de API compatíveis |
---|---|
DH | 1+ |
DSA | 1+ |
EC | 11+ |
RSA | 1+ |
X.509 | 1-8 |
KeyGenerator
Algoritmo | Níveis de API compatíveis |
---|---|
AES | 1+ |
AESWRAP | 1-8 |
ARC4 | 14+ |
BLOWFISH | 10+ |
ChaCha20 | 28+ |
DES | 1+ |
DESede | 1+ |
DESedeWRAP | 1-8 |
HmacMD5 | 1+ |
HmacSHA1 | 11+ |
HmacSHA224 | 1-8, 22+ |
HmacSHA256 | 1+ |
HmacSHA384 | 1+ |
HmacSHA512 | 1+ |
RC4 | 10-13 |
KeyManagerFactory
Algoritmo | Níveis de API compatíveis |
---|---|
PKIX | 1+ |
KeyPairGenerator
Algoritmo | Níveis de API compatíveis |
---|---|
DH | 1+ |
DSA | 1+ |
EC | 11+ |
RSA | 1+ |
KeyStore
Algoritmo | Níveis de API compatíveis |
---|---|
AndroidCAStore | 14+ |
AndroidKeyStore | 18+ |
BCPKCS12 | 1-8 |
BKS | 1+ |
BouncyCastle | 1+ |
PKCS12 | 1+ |
PKCS12-DEF | 1-8 |
Mac
Algoritmo | Níveis de API compatíveis |
---|---|
DESMAC | 1-8 |
DESMAC/CFB8 | 1-8 |
DESedeMAC | 1-8 |
DESedeMAC/CFB8 | 1-8 |
DESedeMAC64 | 1-8 |
DESwithISO9797 | 1-8 |
HmacMD5 | 1+ |
HmacSHA1 | 1+ |
HmacSHA224 | 1-8, 22+ |
HmacSHA256 | 1+ |
HmacSHA384 | 1+ |
HmacSHA512 | 1+ |
ISO9797ALG3MAC | 1-8 |
PBEwithHmacSHA | 1+ |
PBEwithHmacSHA1 | 1+ |
PBEwithHmacSHA224 | 26+ |
PBEwithHmacSHA256 | 26+ |
PBEwithHmacSHA384 | 26+ |
PBEwithHmacSHA512 | 26+ |
MessageDigest
Algoritmo | Níveis de API compatíveis |
---|---|
MD5 | 1+ |
SHA-1 | 1+ |
SHA-224 | 1-8, 22+ |
SHA-256 | 1+ |
SHA-384 | 1+ |
SHA-512 | 1+ |
SSLContext
Algoritmo | Níveis de API compatíveis |
---|---|
Padrão | 10+ |
SSL | 10+ |
SSLv3 | 10-25 |
TLS | 1+ |
TLSv1 | 10+ |
TLSv1.1 | 16+ |
TLSv1.2 | 16+ |
SSLEngine
Algoritmo | Níveis de API compatíveis | Ativado por padrão |
---|---|---|
SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA | 9-22 | 9-19 |
SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA | 9-22 | 9-19 |
SSL_DHE_DSS_WITH_DES_CBC_SHA | 9-22 | 9-19 |
SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA | 9-22 | 9-19 |
SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA | 9-22 | 9-19 |
SSL_DHE_RSA_WITH_DES_CBC_SHA | 9-22 | 9-19 |
SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA | 9-22 | |
SSL_DH_anon_EXPORT_WITH_RC4_40_MD5 | 9-22 | |
SSL_DH_anon_WITH_3DES_EDE_CBC_SHA | 9-22 | |
SSL_DH_anon_WITH_DES_CBC_SHA | 9-22 | |
SSL_DH_anon_WITH_RC4_128_MD5 | 9-22 | |
SSL_RSA_EXPORT_WITH_DES40_CBC_SHA | 9-22 | 9-19 |
SSL_RSA_EXPORT_WITH_RC4_40_MD5 | 9-22 | 9-19 |
SSL_RSA_WITH_3DES_EDE_CBC_SHA | 9+ | 9-19 |
SSL_RSA_WITH_DES_CBC_SHA | 9-22 | 9-19 |
SSL_RSA_WITH_NULL_MD5 | 9-22 | |
SSL_RSA_WITH_NULL_SHA | 9-22 | |
SSL_RSA_WITH_RC4_128_MD5 | 9-25 | 9-19 |
SSL_RSA_WITH_RC4_128_SHA | 9-25 | 9-23 |
TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA | 1-8 | 1-8 |
TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA | 1-8 | 1-8 |
TLS_DHE_DSS_WITH_AES_128_CBC_SHA | 9-22 | 9-22 |
TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 | 20-22 | |
TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 | 20-22 | |
TLS_DHE_DSS_WITH_AES_256_CBC_SHA | 9-22 | 20-22 |
TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 | 20-22 | |
TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 | 20-22 | |
TLS_DHE_DSS_WITH_DES_CBC_SHA | 1-8 | 1-8 |
TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA | 1-8 | 1-8 |
TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA | 1-8 | 1-8 |
TLS_DHE_RSA_WITH_AES_128_CBC_SHA | 9-25 | 9-25 |
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 | 20-25 | |
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 | 20-25 | 20-25 |
TLS_DHE_RSA_WITH_AES_256_CBC_SHA | 9-25 | 20-25 |
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 | 20-25 | |
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 | 20-25 | 20-25 |
TLS_DHE_RSA_WITH_DES_CBC_SHA | 1-8 | 1-8 |
TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA | 1-8 | |
TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA | 1-8 | |
TLS_DH_DSS_WITH_DES_CBC_SHA | 1-8 | |
TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA | 1-8 | |
TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA | 1-8 | |
TLS_DH_RSA_WITH_DES_CBC_SHA | 1-8 | |
TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA | 1-8 | |
TLS_DH_anon_WITH_3DES_EDE_CBC_SHA | 1-8 | |
TLS_DH_anon_WITH_AES_128_CBC_SHA | 9-22 | |
TLS_DH_anon_WITH_AES_128_CBC_SHA256 | 20-22 | |
TLS_DH_anon_WITH_AES_128_GCM_SHA256 | 20-22 | |
TLS_DH_anon_WITH_AES_256_CBC_SHA | 9-22 | |
TLS_DH_anon_WITH_AES_256_CBC_SHA256 | 20-22 | |
TLS_DH_anon_WITH_AES_256_GCM_SHA384 | 20-22 | |
TLS_DH_anon_WITH_DES_CBC_SHA | 1-8 | |
TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA | 20-22 | |
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA | 20+ | 20+ |
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 | 20+ | |
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 | 20+ | 20+ |
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA | 20+ | 20+ |
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 | 20+ | |
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 | 20+ | 20+ |
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 | 24+ | 24+ |
TLS_ECDHE_ECDSA_WITH_NULL_SHA | 20-22 | |
TLS_ECDHE_ECDSA_WITH_RC4_128_SHA | 20-25 | 20-23 |
TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA | 21+ | 21+ |
TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA | 21+ | 21+ |
TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 | 24+ | 24+ |
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA | 20-22 | |
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA | 20+ | 20+ |
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 | 20+ | |
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 | 20+ | 20+ |
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA | 20+ | 20+ |
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 | 20+ | |
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 | 20+ | 20+ |
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 | 24+ | 24+ |
TLS_ECDHE_RSA_WITH_NULL_SHA | 20-22 | |
TLS_ECDHE_RSA_WITH_RC4_128_SHA | 20-25 | 20-23 |
TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA | 20-22 | |
TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA | 20-22 | |
TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 | 20-22 | |
TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 | 20-22 | |
TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA | 20-22 | |
TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 | 20-22 | |
TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 | 20-22 | |
TLS_ECDH_ECDSA_WITH_NULL_SHA | 20-22 | |
TLS_ECDH_ECDSA_WITH_RC4_128_SHA | 20-22 | |
TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA | 20-22 | |
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA | 20-22 | |
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 | 20-22 | |
TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 | 20-22 | |
TLS_ECDH_RSA_WITH_AES_256_CBC_SHA | 20-22 | |
TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 | 20-22 | |
TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 | 20-22 | |
TLS_ECDH_RSA_WITH_NULL_SHA | 20-22 | |
TLS_ECDH_RSA_WITH_RC4_128_SHA | 20-22 | |
TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA | 20-22 | |
TLS_ECDH_anon_WITH_AES_128_CBC_SHA | 20-22 | |
TLS_ECDH_anon_WITH_AES_256_CBC_SHA | 20-22 | |
TLS_ECDH_anon_WITH_NULL_SHA | 20-22 | |
TLS_ECDH_anon_WITH_RC4_128_SHA | 20-22 | |
TLS_EMPTY_RENEGOTIATION_INFO_SCSV | 20+ | 20+ |
TLS_FALLBACK_SCSV | 21+ | |
TLS_NULL_WITH_NULL_NULL | 1-8 | |
TLS_PSK_WITH_3DES_EDE_CBC_SHA | 21-22 | |
TLS_PSK_WITH_AES_128_CBC_SHA | 21+ | 21+ |
TLS_PSK_WITH_AES_256_CBC_SHA | 21+ | 21+ |
TLS_PSK_WITH_RC4_128_SHA | 21-25 | |
TLS_RSA_EXPORT_WITH_DES40_CBC_SHA | 1-8 | 1-8 |
TLS_RSA_WITH_3DES_EDE_CBC_SHA | 1-8 | 1-8 |
TLS_RSA_WITH_AES_128_CBC_SHA | 9+ | 9+ |
TLS_RSA_WITH_AES_128_CBC_SHA256 | 20+ | |
TLS_RSA_WITH_AES_128_GCM_SHA256 | 20+ | 20+ |
TLS_RSA_WITH_AES_256_CBC_SHA | 9+ | 20+ |
TLS_RSA_WITH_AES_256_CBC_SHA256 | 20+ | |
TLS_RSA_WITH_AES_256_GCM_SHA384 | 20+ | 20+ |
TLS_RSA_WITH_DES_CBC_SHA | 1-8 | 1-8 |
TLS_RSA_WITH_NULL_MD5 | 1-8 | |
TLS_RSA_WITH_NULL_SHA | 1-8 | |
TLS_RSA_WITH_NULL_SHA256 | 20-22 |
SSLSocket
Algoritmo | Níveis de API compatíveis | Ativado por padrão |
---|---|---|
SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA | 9-22 | 9-19 |
SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA | 9-22 | 9-19 |
SSL_DHE_DSS_WITH_DES_CBC_SHA | 9-22 | 9-19 |
SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA | 9-22 | 9-19 |
SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA | 9-22 | 9-19 |
SSL_DHE_RSA_WITH_DES_CBC_SHA | 9-22 | 9-19 |
SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA | 9-22 | |
SSL_DH_anon_EXPORT_WITH_RC4_40_MD5 | 9-22 | |
SSL_DH_anon_WITH_3DES_EDE_CBC_SHA | 9-22 | |
SSL_DH_anon_WITH_DES_CBC_SHA | 9-22 | |
SSL_DH_anon_WITH_RC4_128_MD5 | 9-22 | |
SSL_RSA_EXPORT_WITH_DES40_CBC_SHA | 9-22 | 9-19 |
SSL_RSA_EXPORT_WITH_RC4_40_MD5 | 9-22 | 9-19 |
SSL_RSA_WITH_3DES_EDE_CBC_SHA | 9+ | 9-19 |
SSL_RSA_WITH_DES_CBC_SHA | 9-22 | 9-19 |
SSL_RSA_WITH_NULL_MD5 | 9-22 | |
SSL_RSA_WITH_NULL_SHA | 9-22 | |
SSL_RSA_WITH_RC4_128_MD5 | 9-25 | 9-19 |
SSL_RSA_WITH_RC4_128_SHA | 9-25 | 9-23 |
TLS_DHE_DSS_WITH_AES_128_CBC_SHA | 9-22 | 9-22 |
TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 | 20-22 | |
TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 | 20-22 | |
TLS_DHE_DSS_WITH_AES_256_CBC_SHA | 9-22 | 11-22 |
TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 | 20-22 | |
TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 | 20-22 | |
TLS_DHE_RSA_WITH_AES_128_CBC_SHA | 9-25 | 9-25 |
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 | 20-25 | |
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 | 20-25 | 20-25 |
TLS_DHE_RSA_WITH_AES_256_CBC_SHA | 9-25 | 11-25 |
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 | 20-25 | |
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 | 20-25 | 20-25 |
TLS_DH_anon_WITH_AES_128_CBC_SHA | 9-22 | |
TLS_DH_anon_WITH_AES_128_CBC_SHA256 | 20-22 | |
TLS_DH_anon_WITH_AES_128_GCM_SHA256 | 20-22 | |
TLS_DH_anon_WITH_AES_256_CBC_SHA | 9-22 | |
TLS_DH_anon_WITH_AES_256_CBC_SHA256 | 20-22 | |
TLS_DH_anon_WITH_AES_256_GCM_SHA384 | 20-22 | |
TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA | 11-22 | 11-19 |
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA | 11+ | 11+ |
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 | 20+ | |
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 | 20+ | 20+ |
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA | 11+ | 11+ |
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 | 20+ | |
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 | 20+ | 20+ |
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 | 24+ | 24+ |
TLS_ECDHE_ECDSA_WITH_NULL_SHA | 11-22 | |
TLS_ECDHE_ECDSA_WITH_RC4_128_SHA | 11-25 | 11-23 |
TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA | 21+ | 21+ |
TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA | 21+ | 21+ |
TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 | 24+ | 24+ |
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA | 11-22 | 11-19 |
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA | 11+ | 11+ |
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 | 20+ | |
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 | 20+ | 20+ |
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA | 11+ | 11+ |
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 | 20+ | |
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 | 20+ | 20+ |
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 | 24+ | 24+ |
TLS_ECDHE_RSA_WITH_NULL_SHA | 11-22 | |
TLS_ECDHE_RSA_WITH_RC4_128_SHA | 11-25 | 11-23 |
TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA | 11-22 | 11-19 |
TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA | 11-22 | 11-19 |
TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 | 20-22 | |
TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 | 20-22 | |
TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA | 11-22 | 11-19 |
TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 | 20-22 | |
TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 | 20-22 | |
TLS_ECDH_ECDSA_WITH_NULL_SHA | 11-22 | |
TLS_ECDH_ECDSA_WITH_RC4_128_SHA | 11-22 | 11-19 |
TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA | 11-22 | 11-19 |
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA | 11-22 | 11-19 |
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 | 20-22 | |
TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 | 20-22 | |
TLS_ECDH_RSA_WITH_AES_256_CBC_SHA | 11-22 | 11-19 |
TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 | 20-22 | |
TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 | 20-22 | |
TLS_ECDH_RSA_WITH_NULL_SHA | 11-22 | |
TLS_ECDH_RSA_WITH_RC4_128_SHA | 11-22 | 11-19 |
TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA | 11-22 | |
TLS_ECDH_anon_WITH_AES_128_CBC_SHA | 11-22 | |
TLS_ECDH_anon_WITH_AES_256_CBC_SHA | 11-22 | |
TLS_ECDH_anon_WITH_NULL_SHA | 11-22 | |
TLS_ECDH_anon_WITH_RC4_128_SHA | 11-22 | |
TLS_EMPTY_RENEGOTIATION_INFO_SCSV | 11+ | 11+ |
TLS_FALLBACK_SCSV | 21+ | |
TLS_PSK_WITH_3DES_EDE_CBC_SHA | 21-22 | |
TLS_PSK_WITH_AES_128_CBC_SHA | 21+ | 21+ |
TLS_PSK_WITH_AES_256_CBC_SHA | 21+ | 21+ |
TLS_PSK_WITH_RC4_128_SHA | 21-25 | |
TLS_RSA_WITH_AES_128_CBC_SHA | 9+ | 9+ |
TLS_RSA_WITH_AES_128_CBC_SHA256 | 20+ | |
TLS_RSA_WITH_AES_128_GCM_SHA256 | 20+ | 20+ |
TLS_RSA_WITH_AES_256_CBC_SHA | 9+ | 11+ |
TLS_RSA_WITH_AES_256_CBC_SHA256 | 20+ | |
TLS_RSA_WITH_AES_256_GCM_SHA384 | 20+ | 20+ |
TLS_RSA_WITH_NULL_SHA256 | 20-22 |
SecretKeyFactory
Algoritmo | Níveis de API compatíveis |
---|---|
AES | 23+ |
DES | 1+ |
DESede | 1+ |
HmacSHA1 | 23+ |
HmacSHA224 | 23+ |
HmacSHA256 | 23+ |
HmacSHA384 | 23+ |
HmacSHA512 | 23+ |
PBEwithHmacSHA1 | 1+ |
PBEwithHmacSHA1AndAES_128 | 26+ |
PBEwithHmacSHA1AndAES_256 | 26+ |
PBEwithHmacSHA224AndAES_128 | 26+ |
PBEwithHmacSHA224AndAES_256 | 26+ |
PBEwithHmacSHA256AndAES_128 | 26+ |
PBEwithHmacSHA256AndAES_256 | 26+ |
PBEwithHmacSHA384AndAES_128 | 26+ |
PBEwithHmacSHA384AndAES_256 | 26+ |
PBEwithHmacSHA512AndAES_128 | 26+ |
PBEwithHmacSHA512AndAES_256 | 26+ |
PBEwithMD5AND128BITAES-CBC-OPENSSL | 1+ |
PBEwithMD5AND192BITAES-CBC-OPENSSL | 1+ |
PBEwithMD5AND256BITAES-CBC-OPENSSL | 1+ |
PBEwithMD5ANDDES | 1+ |
PBEwithMD5ANDRC2 | 1+ |
PBEwithSHA1ANDDES | 1+ |
PBEwithSHA1ANDRC2 | 1+ |
PBEwithSHA256AND128BITAES-CBC-BC | 1+ |
PBEwithSHA256AND192BITAES-CBC-BC | 1+ |
PBEwithSHA256AND256BITAES-CBC-BC | 1+ |
PBEwithSHAAND128BITAES-CBC-BC | 1+ |
PBEwithSHAAND128BITRC2-CBC | 10+ |
PBEwithSHAAND128BITRC4 | 10+ |
PBEwithSHAAND192BITAES-CBC-BC | 1+ |
PBEwithSHAAND2-KEYTRIPLEDES-CBC | 1+ |
PBEwithSHAAND256BITAES-CBC-BC | 1+ |
PBEwithSHAAND3-KEYTRIPLEDES-CBC | 1+ |
PBEwithSHAAND40BITRC2-CBC | 1+ |
PBEwithSHAAND40BITRC4 | 10+ |
PBEwithSHAANDTWOFISH-CBC | 10+ |
PBKDF2withHmacSHA1 | 10+ |
PBKDF2withHmacSHA1And8BIT | 19+ |
PBKDF2withHmacSHA224 | 26+ |
PBKDF2withHmacSHA256 | 26+ |
PBKDF2withHmacSHA384 | 26+ |
PBKDF2withHmacSHA512 | 26+ |
SecureRandom
Algoritmo | Níveis de API compatíveis |
---|---|
SHA1PRNG | 1+ |
Assinatura
Algoritmo | Níveis de API compatíveis |
---|---|
DSA | 1+ |
DSAwithSHA1 | 1+ |
DSS | 1-19 |
ECDSA | 11+ |
ECDSAwithSHA1 | 11+ |
MD2withRSA | 1-3 |
MD4withRSA | 1-8 |
MD5withRSA | 1+ |
MD5withRSA/ISO9796-2 | 1-8 |
NONEwithDSA | 1+ |
NONEwithECDSA | 11+ |
NONEwithRSA | 17+ |
RSASSA-PSS | 1-8 |
SHA1withDSA | 1+ |
SHA1withECDSA | 11+ |
SHA1withRSA | 1+ |
SHA1withRSA/ISO9796-2 | 1-8 |
SHA1withRSA/PSS | 23+ |
SHA224withDSA | 20+ |
SHA224withECDSA | 20+ |
SHA224withRSA | 20+ |
SHA224withRSA/PSS | 23+ |
SHA256withDSA | 1+ |
SHA256withECDSA | 11+ |
SHA256withRSA | 1+ |
SHA256withRSA/PSS | 23+ |
SHA384withECDSA | 11+ |
SHA384withRSA | 1+ |
SHA384withRSA/PSS | 23+ |
SHA512withECDSA | 11+ |
SHA512withRSA | 1+ |
SHA512withRSA/PSS | 23+ |
TrustManagerFactory
Algoritmo | Níveis de API compatíveis |
---|---|
PKIX | 1+ |