Java Security Essentials — Lesson 2: Cryptography Fundamentals, Passwords, Hashing, Keys, and Keystores

Learning Objectives

• Explain the purpose and operating context of hashing, encryption, signatures, MACs, salts, and secure random.
• Apply password storage, adaptive hashing awareness, and credential handling and JCA APIs, KeyStore basics, key separation, and configuration secrets in a controlled environment.
• Validate outcomes and troubleshoot risks involving algorithm misuse, hard-coded secrets, test vectors, and rotation planning.

Detailed Topics

• hashing, encryption, signatures, MACs, salts, and secure random
• password storage, adaptive hashing awareness, and credential handling
• JCA APIs, KeyStore basics, key separation, and configuration secrets
• algorithm misuse, hard-coded secrets, test vectors, and rotation planning

Instructor Demonstration

Demonstrate hashing, encryption, signatures, MACs, salts, and secure random for a small Java web application reviewed and corrected against common security failures; capture the exact configuration, code, command, transaction, query, dashboard, model, schedule, or report evidence that proves the expected result.

Hands-On Exercise

Complete a controlled Java Security Essentials exercise covering password storage, adaptive hashing awareness, and credential handling and JCA APIs, KeyStore basics, key separation, and configuration secrets; introduce an exception involving algorithm misuse, hard-coded secrets, test vectors, and rotation planning, diagnose it from evidence, apply the smallest reversible correction, and rerun acceptance checks.

1. Confirm scope, prerequisites, identities, dependencies, data, risks, and expected outcome.
2. Perform the course-specific configuration, development, administration, analysis, or business-process workflow.
3. Capture commands, settings, records, logs, screenshots, reports, metrics, or test results.
4. Compare the observed result with acceptance criteria and document corrective or preventive action.

Scenario Analysis

• Identify the technical or business decision and the stakeholders affected by it.
• Compare security, performance, reliability, compliance, cost, usability, and support trade-offs.
• Define rollback, recovery, communication, evidence, ownership, and escalation requirements.

Troubleshooting Guidance

Diagnose issues involving hashing, encryption, signatures, MACs, salts, and secure random, password storage, adaptive hashing awareness, and credential handling, JCA APIs, KeyStore basics, key separation, and configuration secrets, algorithm misuse, hard-coded secrets, test vectors, and rotation planning without making an unverified production change. Separate symptoms from causes, gather time-correlated evidence, test a reversible hypothesis, validate the correction, and record recurrence controls.

Validation Checklist

• The requirement, environment, inputs, dependencies, and expected result are documented.
• The result is reproducible and supported by product-specific evidence.
• Normal, boundary, failure, security, performance, and operational conditions are reviewed.
• Exceptions, rollback, ownership, support actions, and the next improvement priority are recorded.

Lesson Outcome

Learners can apply Cryptography Fundamentals, Passwords, Hashing, Keys, and Keystores in a realistic Java Security Essentials scenario and defend the result with documented evidence.