Keystore type: which one to use?

user_1002972 0
Viewed 225756

By looking at the file java.security of my JRE, I see that the keystore type to use by default is set to JKS. Here, there is a list of the keystore types that can be used.

Is there a recommended keystore type? What are the pros/cons of the different keystore types?

jsse ssl security java
4 Answers

If you are using Java 8 or newer you should definitely choose PKCS12, the default since Java 9 (JEP 229).

The advantages compared to JKS and JCEKS are:

  • Secret keys, private keys and certificates can be stored
  • PKCS12 is a standard format, it can be read by other programs and libraries1
  • Improved security: JKS and JCEKS are pretty insecure. This can be seen by the number of tools for brute forcing passwords of these keystore types, especially popular among Android developers.2, 3

1 There is JDK-8202837, which has been fixed in Java 11

2 The iteration count for PBE used by all keystore types (including PKCS12) used to be rather weak (CVE-2017-10356), however this has been fixed in 9.0.1, 8u151, 7u161, and 6u171

3 For further reading:

user_42885060

Java 11 offers the following types of KeyStores:

jceks: The proprietary keystore implementation provided by the SunJCE provider.

jks: The proprietary keystore implementation provided by the SUN provider.

dks: A domain keystore is a collection of keystores presented as a single logical keystore. It is specified by configuration data whose syntax is described in the DomainLoadStoreParameter class.

pkcs11: A keystore backed by a PKCS #11 token.

pkcs12: The transfer syntax for personal identity information as defined in PKCS #12.

Source: https://docs.oracle.com/en/java/javase/11/docs/specs/security/standard-names.html#keystore-types

user_34085770
Related