JavaOne 2002 (San Francisco) has come and gone. In addition to the usual fare, there were a number of interesting talks on security. I'm always hopeful I'll pick up hints of what is to come. Below, I've collected some of the more interesting possibilities for future work.
- Support for AES (Advanced Encryption Standard) and the Rijndael cipher. Members of Sun's security team have hinted at this for many months.
- JSSE support for the new NIO (New I/O) API, which was added to Java in the recently released version 1.4.
- Support for proper online certificate revocation -- possibly via OCSP (Online Certificate Status Protocol) rather than CRLs (Certificate Revocation List).
- Support for X.509 attribute certificates.
- Support for hardware security tokens like smart cards and dongles.
- Enhancements to the Java GSS API including support for SPKM (Simple Public-Key GSS-API Mechanism) and SPNego (Simple and Protected GSS-API Negotiation Mechanism) for secure negotiation of GSS security.
- Support for public-key cryptography in Kerberos and support for Kerberos authentication within TLS (Transport Layer Security).
- Support for asynchronous callbacks in JAAS.
Surf over to Sun's JavaOne site (http://servlet.java.sun.com/javaone). You can download slides for many of the conference presentations.
