Specifications
Full specifications for KeyStore Explorer, including supported algorithms, key sizes and file formats, are included below.
KeyStores
KeyStore Explorer supports the management of the following KeyStore types:
| Type | Description |
|---|---|
| JKS | Java KeyStore. Oracle's KeyStore format. |
| JCEKS | Java Cryptography Extension KeyStore. More secure version of JKS. |
| PKCS #12 | Public-Key Cryptography Standards #12 KeyStore. RSA's KeyStore format. |
| BKS | Bouncy Castle KeyStore. Bouncy Castle's version of JKS. |
| UBER | Bouncy Castle UBER KeyStore. More secure version of BKS. |
| BCFKS | Bouncy Castle FIPS KeyStore (uses FIPS compliant algorithms PBDKF2, SHA-512 and AES CCM). |
| PEM | KeyStore using PEM format. Can hold several certificates and private keys concatenated in one PEM file. |
| KDB | IBM's CMS Key Database format (GSKit format used by enterprise web and application servers). Both the current version 6 (HMAC-SHA384 header MAC) and the older version 4 (HMAC-SHA1) are supported, along with their optional .sth stash files. |
Key Pairs
KeyStore Explorer supports RSA, DSA, EC and Post-Quantum Cryptography Key Pairs. It is capable of generating such Key Pairs with the following key sizes and signature algorithms:
| Key Pair Algorithm | Key Size (bits) | Signature Algorithm |
|---|---|---|
| DSA | 512 - 1024 | SHA-1 with DSA |
| SHA-224 with DSA | ||
| SHA-256 with DSA | ||
| SHA-384 with DSA | ||
| SHA-512 with DSA | ||
| RSA | 512 - 16384 | MD2 with RSA |
| MD5 with RSA | ||
| RIPEMD-128 with RSA | ||
| RIPEMD-160 with RSA | ||
| RIPEMD-256 with RSA | ||
| SHA-1 with RSA | ||
| SHA-224 with RSA | ||
| SHA-256 with RSA | ||
| SHA-384 with RSA * | ||
| SHA-512 with RSA ** | ||
| SHA-1 with RSA and MGF1 | ||
| SHA-224 with RSA and MGF1 | ||
| SHA-256 with RSA and MGF1 | ||
| SHA-384 with RSA and MGF1 * | ||
| SHA-512 with RSA and MGF1 ** |
| Key Pair Algorithm | Curve Set | Curves *** |
|---|---|---|
| EC | NIST | B-163, B-233, B-283, B-409, B-571, K-163, K-233, K-283, K-409, K-571, P-192, P-224, P-256, P-384, P-521 |
| SEC | secp112r1, secp112r2, secp128r1, secp128r2, secp160k1, secp160r1, secp160r2, secp192k1, secp192r1, secp224k1, secp224r1, secp256k1, secp256r1, secp384r1, secp521r1, sect113r1, sect113r2, sect131r1, sect131r2, sect163k1, sect163r1, sect163r2, sect193r1, sect193r2, sect233k1, sect233r1, sect239k1, sect283k1, sect283r1, sect409k1, sect409r1, sect571k1, sect571r1 | |
| ANSI X9.62 | prime192v1, prime192v2, prime192v3, prime239v1, prime239v2, prime239v3, prime256v1, c2pnb163v1, c2pnb163v2, c2pnb163v3, c2pnb176w1, c2tnb191v1, c2tnb191v2, c2tnb191v3, c2tnb239v1, c2tnb239v2, c2tnb239v3, c2tnb359v1, c2tnb431r1, c2pnb208w1, c2pnb272w1, c2pnb304w1, c2pnb368w1 | |
| Brainpool | brainpoolP160r1, brainpoolP160t1, brainpoolP192r1, brainpoolP192t1, brainpoolP224r1, brainpoolP224t1, brainpoolP256r1, brainpoolP256t1, brainpoolP320r1, brainpoolP320t1, brainpoolP384r1, brainpoolP384t1, brainpoolP512r1, brainpoolP512t1 | |
| Edwards curves | Ed25519, Ed448 | |
| SM2 **** | sm2p256v1, wapi192v1, wapip192v1 | |
| ECGOST | GostR3410-2001-CryptoPro-A, GostR3410-2001-CryptoPro-B, GostR3410-2001-CryptoPro-C, GostR3410-2001-CryptoPro-XchA, GostR3410-2001-CryptoPro-XchB, Tc26-Gost-3410-12-256-paramSetA, Tc26-Gost-3410-12-256-paramSetB, Tc26-Gost-3410-12-256-paramSetC, Tc26-Gost-3410-12-256-paramSetD, Tc26-Gost-3410-12-512-paramSetA, Tc26-Gost-3410-12-512-paramSetB, Tc26-Gost-3410-12-512-paramSetC |
* - Requires an RSA key size of at least 624 bits
** - Requires an RSA key size of at least 752 bits
*** - Availability of curves depends on the keystore type.
**** - SM2 Key Pairs can only be generated in BKS, UBER and BCFKS KeyStores.
KeyStore Explorer also supports the following Post-Quantum Cryptography (PQC) Key Pair algorithms, standardized by NIST:
| Key Pair Algorithm | Parameter Sets |
|---|---|
| ML-DSA | ML-DSA-44, ML-DSA-65, ML-DSA-87 |
| SLH-DSA | SLH-DSA-SHA2-128S, SLH-DSA-SHA2-128F, SLH-DSA-SHA2-192S, SLH-DSA-SHA2-192F, SLH-DSA-SHA2-256S, SLH-DSA-SHA2-256F, SLH-DSA-SHAKE-128S, SLH-DSA-SHAKE-128F, SLH-DSA-SHAKE-192S, SLH-DSA-SHAKE-192F, SLH-DSA-SHAKE-256S, SLH-DSA-SHAKE-256F |
| ML-KEM * | ML-KEM-512, ML-KEM-768, ML-KEM-1024 |
* - ML-KEM is a key encapsulation mechanism, not a signature algorithm, so it cannot be used for a self-signed Key Pair. ML-KEM Key Pairs can only be generated by signing a new Key Pair with an existing signing Key Pair, see Sign New Key Pair.
Secret Keys
KeyStore Explorer can generate Secret Keys using the following algorithms and key sizes. Note that not every algorithm is available in every KeyStore type — PKCS #12 and BCFKS in particular only support a limited subset.
| Algorithm | Key Size (bits) |
|---|---|
| AES | 128 - 256, step 64 |
| ARC4 | 40 - 2048, step 8 |
| ARIA | 128 - 256, step 64 |
| Blowfish | 32 - 448, step 64 |
| Camellia | 128 - 256, step 64 |
| CAST-128 | 40 - 128, step 8 |
| CAST-256 | 128 - 256, step 32 |
| ChaCha | 128 - 256, step 128 |
| DES | 64 |
| DESede (Triple DES) | 128 - 192, step 64 |
| DSTU 7624 | 128 - 512, step 128 |
| GOST 28147-89 | 256 |
| GOST R 34.12-2015 | 256 |
| Grain v1 | 80 |
| Grain-128 | 128 |
| HC-128 | 128 |
| HC-256 | 256 |
| HMac-MD2 | 128 |
| HMac-MD4 | 128 |
| HMac-MD5 | 128 |
| HMac-RipeMD128 | 128 |
| HMac-RipeMD160 | 160 |
| HMac-SHA1 | 160 |
| HMac-SHA224 | 224 |
| HMac-SHA256 | 256 |
| HMac-SHA384 | 384 |
| HMac-SHA512 | 512 |
| HMac-Tiger | 192 |
| IDEA | 128 |
| NOEKEON | 128 |
| RC2 | 8 - 128, step 8 |
| RC5 | 8 - 2040, step 8 |
| RC6 | 128 - 256, step 64 |
| Rijndael | 128 - 256, step 32 |
| Salsa20 | 128 - 256, step 128 |
| Serpent | 128 - 256, step 64 |
| Tnepres | 128 - 256, step 64 |
| SEED | 128 |
| Skipjack | 80 |
| SM4 | 128 |
| TEA | 128 |
| Twofish | 128 - 256, step 64 |
| Threefish-256 | 256 |
| Threefish-512 | 512 |
| Threefish-1024 | 1024 |
| XSalsa20 | 128 - 256, step 128 |
| XTEA | 128 |
| ZUC-128 | 128 |
| ZUC-256 | 256 |
Certificates and CRLs
KeyStore Explorer supports Version 1 and Version 3 X.509 certificates as well as CRLs. In addition for Version 3 Certificates and CRLs it supports the display of a wide range of extensions.
Certificate Signing Requests (CSR)
KeyStore Explorer supports the generation and signing of the following CSR types:
| Type | Description |
|---|---|
| PKCS #10 | Public-Key Cryptography Standards #10 CSR, RSA's CSR format. |
| SPKAC | Signed Public Key and Challenge (SPKAC), Netscape's CSR format. |
X.509 Extensions
KeyStore Explorer supports the display of the full set of extensions specified in RFC 5280 (Certificate and CRL Profile). In addition most of the certificate extensions are available for addition to generated certificates and signed CSRs.
| Extension Name | Extension OID | View | Add to Certificates / CSRs |
|---|---|---|---|
| Entrust Version Information | 1.2.840.113533.7.65.0 | X | |
| Authority Information Access | 1.3.6.1.5.5.7.1.1 | X | X |
| Subject Information Access | 1.3.6.1.5.5.7.1.11 | X | X |
| Subject Directory Attributes | 2.5.29.9 | X | |
| Subject Key Identifier | 2.5.29.14 | X | X |
| Key Usage | 2.5.29.15 | X | X |
| Private Key Usage Period | 2.5.29.16 | X | X |
| Subject Alternative Name | 2.5.29.17 | X | X |
| Issuer Alternative Name | 2.5.29.18 | X | X |
| Basic Constraints | 2.5.29.19 | X | X |
| CRL Number | 2.5.29.20 | X | X |
| Reason Code | 2.5.29.21 | X | N/A |
| Hold Instruction Code | 2.5.29.23 | X | N/A |
| Invalidity Date | 2.5.29.24 | X | N/A |
| Delta CRL Indicator | 2.5.29.27 | X | N/A |
| Issuing Distribution Point | 2.5.29.28 | X | N/A |
| Certificate Issuer | 2.5.29.29 | X | N/A |
| Name Constraints | 2.5.29.30 | X | X |
| CRL Distribution Points | 2.5.29.31 | X | X |
| Certificate Policies | 2.5.29.32 | X | X |
| Policy Mappings | 2.5.29.33 | X | X |
| Authority Key Identifier | 2.5.29.35 | X | X |
| Policy Constraints | 2.5.29.36 | X | X |
| Extended Key Usage | 2.5.29.37 | X | X |
| Freshest CRL | 2.5.29.46 | X | |
| Inhibit Any Policy | 2.5.29.54 | X | X |
| Signed Certificate Timestamp List | 1.3.6.1.4.1.11129.2.4.2 | X | N/A |
| MS Application Policies | 1.3.6.1.4.1.311.21.10 | X | N/A |
| MS NTDS CA Security | 1.3.6.1.4.1.311.25.2 | X | N/A |
| MASA URL | 1.3.6.1.5.5.7.1.32 | X | N/A |
Key Pair Import and Export
KeyStore Explorer supports the following formats for the import and export of Key Pair entries.
| Format | Private Part | Public Part |
|---|---|---|
| PKCS #12 | X | X |
| PKCS #8 DER * | X | |
| PKCS #8 PEM * | X | |
| PVK | X | |
| OpenSSL DER ** | X | |
| OpenSSL PEM ** | X | |
| JWK | X | X |
| X.509 DER | X | |
| X.509 PEM | X | |
| PKCS #7 DER | X | |
| PKCS #7 PEM | X | |
| PKI Path | X | |
| SPC | X |
* - Where PKCS #8 is encrypted KeyStore Explorer supports the following PBE algorithms:
| PBE Algorithm |
|---|
| SHA-1 and 40 bit RC4 |
| SHA-1 and 128 bit RC4 |
| SHA-1 and 2 key 3DES |
| SHA-1 and 3 key 3DES |
| SHA-1 and 40 bit RC2 |
| SHA-1 and 128 bit RC2 |
| PBES2 with SHA-1 and 3DES |
| PBES2 with SHA-1 and AES-128 |
| PBES2 with SHA-1 and AES-256 |
| PBES2 with SHA-256 and AES-256 |
** - Where OpenSSL is encrypted KeyStore Explorer supports the following PBE algorithms:
| PBE Algorithm |
|---|
| PBE with DES CBC |
| PBE with DESede CBC |
| PBE with 128 bit AES CBC |
| PBE with 192 bit AES CBC |
| PBE with 256 bit AES CBC |
Trusted Certificate Import and Export
KeyStore Explorer supports the following formats for the import and export of Trusted Certificate entries:
| Format |
|---|
| X.509 DER |
| X.509 PEM |
| PKCS #7 DER |
| PKCS #7 PEM |
| PKI Path |
| SPC |
Public Key Export
KeyStore Explorer can export the public keys of Key Pair and Trusted Certificate entries in OpenSSL (SubjectPublicKeyInfo) format.
Digital Signatures
KeyStore Explorer supports the digital signing of CSRs, JARs, certificates, CRLs, JWTs, PKCS#7/CMS, etc. using the following signature algorithms:
| Key Type | Signature Algorithms |
|---|---|
| RSA | |
| RIPEMD-160 with RSA | |
| SHA-1 with RSA | |
| SHA-224 with RSA | |
| SHA-256 with RSA | |
| SHA-384 with RSA | |
| SHA-512 with RSA | |
| SHA-1 with RSA and MGF1 | |
| SHA-224 with RSA and MGF1 | |
| SHA-256 with RSA and MGF1 | |
| SHA-384 with RSA and MGF1 | |
| SHA-512 with RSA and MGF1 | |
| EC | SHA-1 with ECDSA |
| SHA-256 with ECDSA | |
| SHA-384 with ECDSA | |
| SHA-512 with ECDSA | |
| Ed25519 * | |
| Ed25519 | |
| Ed448 * | |
| Ed448 | |
| SM2 | SHA-256 with SM2 |
| SM3 with SM2 | |
| ECGOST | GOST3411 with ECGOST3410 |
| GOST3411-2012-256 with ECGOST3410-2012-256 | |
| GOST3411-2012-512 with ECGOST3410-2012-512 | |
| ML-DSA | ML-DSA-44 |
| ML-DSA-65 | |
| ML-DSA-87 | |
| SLH-DSA | SLH-DSA-SHA2-128S |
| SLH-DSA-SHA2-128F | |
| SLH-DSA-SHA2-192S | |
| SLH-DSA-SHA2-192F | |
| SLH-DSA-SHA2-256S | |
| SLH-DSA-SHA2-256F | |
| SLH-DSA-SHAKE-128S | |
| SLH-DSA-SHAKE-128F | |
| SLH-DSA-SHAKE-192S | |
| SLH-DSA-SHAKE-192F | |
| SLH-DSA-SHAKE-256S | |
| SLH-DSA-SHAKE-256F |
* - When used to sign a JWT, the algorithm name written into the JWT header can be chosen between the RFC 8037 name ("EdDSA", the default) and the explicit RFC 9864 name ("Ed25519"/"Ed448"). ML-DSA and SLH-DSA Key Pairs cannot be used to sign a JWT.