Are we using Java Crypto API Securely ?

on YouTube ↗30m

" summary

Concrete failures, not high-level warnings: JCA has insecure defaults and ambiguous docs, demonstrated with code that shows setSeed misuse producing deterministic RNG output and with examples where the ECB default silently breaks confidentiality. The session shows working code and a lab repo, recommends AES-GCM + 256-bit keys over legacy modes, specifies RSA >= 2048, PBKDF iterations ≈ 20,000 or more and suggests Argon2/Bcrypt for passwords, and points to provider/config fixes that actually work.

AI-written summary · about

" chapters (9)

1. 0:00Start
2. 3:56Java Cryptography Architecture (JCA)
3. 7:55Cryptographically Secure Pseudo-Random Number Generator (CSPRNG)
4. 14:08Encryption/Decryption
5. 15:58TRANSFORMATION_STRING
6. 21:03Properties/Strength/Applications
7. 23:17Message Authentication Code
8. 24:24Digital Signatures
9. 27:17Why should you care about Crypto ?

" related talks

• 41mHow to Use Java Cryptography API SecurelyMansi Sheth · Oracle OpenWorld 2017
• 52mCryptography 101 for Java developersMichel Schudel · Jfokus 2019
• 48mCryptography 101 for Java developersMichel Schudel · Devoxx Belgium 2019
• 52mUnlocking the unknowns: Cryptography Essentials for Spring DevelopersLaurentiu Spilca · Spring I/O 2025
• 34mUnlocking the unknowns: Cryptography EssentialsIonut Balosin, Laurentiu Spilca · Voxxed Days Bucharest 2025
• 01h 01mBroken crypto is brokenErlend Oftedal · NDC Sydney 2018
• 23mJS Bringing Crypto to the MassesMatt Bergman · CascadiaJS 2013
• 37mKeeping Your Java Applications Secure - Cryptographic Improvements and Best PracticesSean Mullan, Chris Ries · Oracle Developer Live—Java 2020