With the addition of five new key algorithms in the last release, the key algorithm selection dialog has grown to a size that is a bit unwieldy. In KSE 5.7.0 it has been redesigned to make it easier to find the desired algorithm.

The new dialog has tabs for the following categories of key algorithms:

• "Standard" algorithms: RSA and DSA
• Elliptic Curve algorithms: NIST, SEC, ANSI, Brainpool, SM2, ECGOST and Edwards curves
• Post-Quantum Cryptography algorithms: SLH-DSA, ML-DSA and ML-KEM

This improvement has been contributed by Jairo Graterón.

The Java PKCS#12 implementation can only handle "trusted certificates", i.e. standalone certificates that are not associated with a key in the same file, when they are marked with a custom bag attribute. This works as long as the PKCS#12 file is created by Java software, but not for PKCS#12 files created by other software that do not use this custom bag attribute. Then KSE will not be able to read the trusted certificates.

In KSE 5.7.0 this compatibility issue is solved. The PKCS#12 file is now read first with low level parsing, circumventing the Java PKCS#12 implementation, and then trusted certificates without the custom bag attribute are added explicitly with the Java keystore API.

When saving a PKCS#12 file, KSE will use the Java PKCS#12 implementation just as before to ensure compatibility with Java software.

This improvement has been contributed by jonwltn.

KSE 5.7.0 continues to improve the support for JWT (JSON Web Token), JWS (JSON Web Signature) and JWK (JSON Web Key).

The following improvements have been made:

"EdDSA" Algorithm Name for JWS

Previously, KSE used the algorithm name "Ed25519" for Ed25519 keys in JWS (JSON Web Signature) as specified in RFC 9864.

The older RFC 8037 defines "EdDSA" as the signature algorithm identifier, and therefore many JWT tools still expect "EdDSA" in the "alg" header parameter. However, the newer RFC 9864 specifies "Ed25519" and deprecates "EdDSA". Therefore, any automatically chosen algorithm name in KSE would be wrong for some tools and right for others.

To solve this, KSE now allows the user to choose between those two algorithm names, with "EdDSA" being the (more compatible) default.

Ed448 Signatures for JWS

KSE now supports Ed448 signatures for JWS (JSON Web Signature) in addition to Ed25519 signatures.

Similar to Ed25519, the algorithm name for Ed448 can be chosen between "EdDSA" and "Ed448".

This feature has been contributed by jonwltn.

JWK Export as JWE

KSE now allows to export JWK (JSON Web Key) as JWE (JSON Web Encryption).

The exported JWE files are encrypted with PBES2-HS512+A256KW when exported as key pair (both private and public key). When only the private key is exported, then the encryption algorithm can be selected in the export dialog between the following options:

• PBES2-HS256+A128KW
• PBES2-HS384+A192KW
• PBES2-HS512+A256KW

This feature has been contributed by jonwltn.

JWK Import

KSE now allows to import keys in JWK (JSON Web Key) format. Just use the "Import Key Pair" dialog to select a JWK file and either provide a certificate for the key or let KSE generate a self-signed certificate.

This feature has been contributed by jonwltn.

KSE 5.7.0 adds support for the following new keystore types:

• PEM
• IBM CMS ("KDB")
• Windows Root Certificate Store ("Windows-ROOT")
• macOS Keychain

The first two are file formats that can be created, saved and opened in KSE, while the latter two are system keystores that can be accessed via "File -> Open Special".

PEM KeyStore

A PEM keystore can contain several certificates and private keys in PEM format concatenated in one file. This keystore type does not exist in Java, but it is not difficult to map PEM files to the KeyStore API.

KSE 5.7.0 can read and write such PEM files, and it can also convert them to other keystore types.

This feature has been contributed by jonwltn.

KDB KeyStore

The IBM CMS keystore type ("KDB") is a proprietary keystore format used by IBM software. KSE 5.7.0 can read and write such KDB files, and it can also convert them to other keystore types. Supported are version 6 (HMAC-SHA384 header MACs) and the older version 4 (HMAC-SHA1).

KSE can write stash files (.sth) together with .kdb files for password recovery. When opening a KDB keystore, KSE will ask whether to use the stash file if it exists. If the stash file is used, then the password for the KDB keystore does not need to be entered.

This feature has been contributed by Mike Lothian.

Windows ROOT KeyStore

KSE 5.7.0 can now access the Windows Root Certificate Store. This allows to view and export certificates from this system keystore.

The Windows Root Certificate Store is a system keystore that contains the trusted root certificates for the Windows operating system.

Note that there are different Windows truststores for the current user and for the local machine. This feature is about the user truststore.

This feature has been contributed by jonwltn.

macOS KeyStore

Similar to the Windows Certificate Store, the Apple Keychain is a system keystore that contains various types of credentials, including certificates and private keys.

With KSE you can not only view and export certificates from the Keychain, but also create and import certificates and private keys into the Keychain.

This feature has been contributed by jonwltn.

KSE 5.7.0 introduces the ability to reload keystores. This can be done via the "File -> Reload" menu option or automatically based on the preferences.

If automatic reloading is enabled, KSE will ask the user whether to reload the keystore when it detects that the keystore file has been changed on disk. This is useful when the keystore is modified by another application while KSE is running.

The reload prompt can also be disabled in the preferences, in which case KSE will automatically reload the keystore without prompting.

KSE also warns the user if reloading would result in data loss, for example, if there are unsaved changes in the keystore.

This feature has been contributed by jonwltn.

• Added additional secret key algorithms (contributed by jonwltn):
  • ARIA
  • DSTU 7624
  • GOST R 34.12-2015
  • SM4
  • Tnepres
  • ZUC-128, ZUC-256
• Added the ability to open keystores in an already running instance of KSE; this can be configured in the preferences (contributed by jonwltn).
• Added support for RFC 7093 key identifiers (contributed by jonwltn).
• Use PEM format for the public key in the generated JWT view and widened the text field to fit it.
• Improved Brainpool curve support (contributed by jonwltn).
• Added global keyboard shortcuts: Ctrl+Page Up / Ctrl+Page Down to switch between open keystore tabs and Ctrl+F4 to close the active tab (contributed by Jairo Graterón).
• Added overlays for export and details to key and certificate icons.
• Migrated dialogs to a standardized layout (contributed by jonwltn).
• Changed the accelerator key of "Examine Clipboard" from Ctrl+L to Ctrl+B, which can be used with one hand (contributed by The-Lum).
• Improved the context menu for multi-selections (contributed by The-Lum).
• The size of resizable dialogs is now remembered (contributed by jonwltn).
• More dialogs are now resizable (contributed by jonwltn).

• Fixed update check not working properly (fixed by ShiroKSH).
• Fixed certificate view not showing the correct hierarchy for certificates using Brainpool curves (fixed by beth-soptim).
• Properly ensure that PKCS#10 CSR PEM lines are 64 characters or less (fixed by Pierre Baudry).
• Removed UTF-8 BOM from PEM certificates (fixed by Jairo Graterón).
• Fixed version info of kse.exe not being updated (reported by op-cloudeteer-de).
• Fixed file dialog not opening in the PKCS#11 dialog (reported by ben221199).
• Fixed taskbar pinning/icon issue under Linux.
• Fixed use of incorrect AKI value when adding the AKI extension (fixed by jonwltn, reported by heymen61).
• Use issuer SKI for AKI when transferring CSR extensions (fixed by jonwltn).
• Fixed workflow problem when setting a new passphrase (fixed by jonwltn).
• Fixed issues when signing with PKCS#11 or MSCAPI keys (fixed by jonwltn).

• Removed several old standard Java Swing look&feels:
  • Metal
  • Nimbus
  • CDE/Motif
  • Windows Classic
• Removed Vaqua l&f for macOS (the FlatLaf macOS l&f and the JDK macOS l&f remain)

• Added AppImage package for Linux
• The Windows installers kse-570-setup.exe/kse-570-setup-no-jre.exe and kse.exe are now signed by SignPath
• Installation on Windows is now done in 64bit mode
• Windows launcher "kse.exe" is now 64bit and requires a 64bit JDK
• Improved deb packaging