Enterprise J2ME Developing Mobile Java Applications [Electronic resources] نسخه متنی

19.5 Phaos Technology Micro Foundation Toolkit

Phaos Technology is a Java and XML security solution provider. It offers toolkits for secure XML Java APIs, J2ME lightweight crypto APIs, and one of the first implementations of the SSL protocol on J2ME/CLDC. In this chapter, I focus on the Phaos Micro Foundation (MF, v1.2) lightweight crypto API.

Phaos XML security packages do not currently work with J2ME. However, they are at a leading position to provide future secure Web Services tools for mobile applications. Phaos toolkits are available for free evaluation. You must email the company to get a 30-day license key, which comes with tech support.

Phaos is a reputable security company with a good track record. The technical support staff is also very knowledgeable and responsive. All my support questions were answered via email within 24 hours.

19.5.1 The Phaos Micro Foundation

The Phaos MF runs on both CLDC and CDC. The CDC version also runs under J2SE. The toolkit footprint is 187 KB for the CLDC version and 169 KB for the CDC version. The Phaos API is intuitive and comes with excellent documentation and code examples.

Phaos MF supports a set of frequently used cryptographic algorithms to strike a balance between performance and features. Those algorithms include symmetric ciphers, such as AES, DES (Data Encryption Standard), RC2, and RC4; PKI (Public Key Infrastructure) ciphers and signature schemes, such as DSA (Digital Signature Algorithm) and RSA; and password-based encryption schemes (PBES), such as PKCS #5 and PKCS #12. Phaos MF also supports X.509 certificate parsing, ASN.1 encoding, and efficient memory pooling.

Phaos PBES implementations used in my examples perform worse than their Bouncy Castle and IAIK counterparts. For RSA and DSA algorithms, the Phaos library is better optimized than Bouncy Castle 1.16 and has comparable performance to the IAIK pure Java library.

However, even for IAIK and Phaos, the performance of public algorithms is only barely acceptable for MIDP cell phones. In fact, no matter how much optimization you do, those classic PKI algorithms might just prove too heavy for the smallest devices. Novel algorithms and approaches are needed. NTRU and a startup company called B3 Security provide such solutions.