Prior to JDK 1.4, many security functions had to be added to the base Java code distribution as extensions. Tight U.S. export restrictions required this separation of function.

Now, new relaxed regulations open the door to tighter integration of security features and the base language. The following packages -- used as extensions prior to the 1.4 release -- are now integrated into JDK 1.4:

• JCE (Java Cryptography Extension)
• JSSE (Java Secure Sockets Extension)
• JAAS (Java Authentication and Authorization Service)

JDK 1.4 also introduces two new functions:

• JGSS (Java General Security Service)
• CertPath API (Java Certification Path API)

JCE, JSSE, and the CertPath API are the subject of this tutorial. We'll focus on JAAS in the next tutorial in this series. Neither tutorial covers the JGSS (which provides a generic framework to securely exchange messages between applications).