sun.security.pkcs11.SunPKCS11 的访问限制
我正在尝试设置 PKCS11 提供程序来访问智能卡。 我在系统上安装了 PKCS11 库，并按照 Java PKCS#11 参考指南。 在参考文献中，他们只是创建一个 sun.security.pkcs11.SunPKCS11 的实例，并将配置文件的名称传递给构造函数。 当我尝试编译以下代码时
Provider p = new sun.security.pkcs11.SunPKCS11("pkcs11.cfg");
Security.addProvider(p);
，出现以下错误。
访问限制：由于所需库 /usr/lib/jvm/java-6-sun-1.6.0.24/jre/lib/ext/sunpkcs11.jar 的限制，无法访问构造函数 SunPKCS11(String)
我做错了什么？ 我在 Ubuntu x86 下使用 Eclipse 3.5 和 Java SE 1.6。
此致。
I'm trying to setup a PKCS11 provider for accessing a smartcard.
I installed a PKCS11 library on my system and followed the instructions in the Java PKCS#11 Reference Guide.
In the reference they simply create an instance of sun.security.pkcs11.SunPKCS11 and pass the name of the configuration file to the constructor.
When I try to compile the following code
Provider p = new sun.security.pkcs11.SunPKCS11("pkcs11.cfg");
Security.addProvider(p);
I get the following error.
Access restriction: The constructor SunPKCS11(String) is not accessible due to restriction on required library /usr/lib/jvm/java-6-sun-1.6.0.24/jre/lib/ext/sunpkcs11.jar
What am I doing wrong?
I use Eclipse 3.5 with Java SE 1.6 under Ubuntu x86.
Best regards.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
查看项目的属性并打开
Libraries选项卡。我假设您已将JRE 系统库设置为执行环境。将其更改为工作区 JRE 或手动选择特定 JRE。背景：
通过选择执行环境，您表示您想要编写一个符合 Java API 的应用程序。
sun.security.pkcs11.SunPKCS11类位于 sun 包中，该包将其标记为 Sun Java 实现专有，并且不是标准 Java API 的一部分。Look into the projects's properties and open the
Librariestab. I assume you have set theJRE System Libraryto an execution environment. Change it to the workspace JRE or select a specific JRE manually.Background:
By selecting an execution environment you say that you want to write an app that is compliant to the Java API. The class
sun.security.pkcs11.SunPKCS11is located in the sun package which marks it as proprietary to Sun Java implementation and is not part of the standard Java API.转到项目属性的 Java 构建路径 窗格，然后展开 JRE 系统库条目。单击访问规则，然后单击“编辑...”按钮。添加一条访问规则，使规则模式sun/security/pkcs11/**可访问。这将使 Eclipse 停止抱怨。
Go to your project properties, Java Build Path pane, and expand the JRE System Library entry. Click Access rules and click the Edit... button. Add an Access Rule that makes Accessible the Rule Pattern sun/security/pkcs11/**. This will make Eclipse stop whining.
如果您在 Windows 上使用
64 位运行时，还有另一个原因。在这种情况下，根本不存在必要的类。解决方案：使用32位运行时。
https://bugs.java.com/bugdatabase/view_bug?bug_id=6880559
There is one other cause if you use a
64 bit runtime on Windows. In that case, the necessary classes are simply not present.Solution: Use a 32 bit runtime.
https://bugs.java.com/bugdatabase/view_bug?bug_id=6880559
据我了解，在 Java 中使用 PKCS#11 令牌有两种方法：使用 Sun API 和使用一些专有实现。每个都有其优点和缺点。
Sun'API 的主要优点是它将 PKCS#11 令牌映射到常规密钥库。因此，BouncyCastle 可以访问令牌中的私钥，而无需实际弄清楚它正在与硬件设备进行交互。此外，任何本机依赖项都已与 Sun 的 JVM 捆绑在一起，您不必担心在不同平台上移植或支持本机代码。主要缺点是它不是标准的，因此不能保证您可以在任何 JVM 上找到它。
商业 API（请参阅 IAIK 的 PKCS11 包装器）很好，甚至是开源的，但它们有两个缺点：它们是为了与另一个 API（您必须付费...）一起使用，因此它们不会公开令牌作为 KeyStore，您无法透明地使用 BouncyCastle，并且它们具有您必须维护和分发的本机组件。如果您必须在浏览器中使用 PKCS#11，您就会知道那是多么痛苦......
As far as I have come to understand, there are two ways of using PKCS#11 tokens in Java: using the Sun APIs, and using some proprietary implementation. Each has its advantages and disadvantages.
Sun'API main advantage is that it maps PKCS#11 tokens onto regular KeyStores. BouncyCastle can thus access the private keys in the token without actually figuring out that it is interacting with an hardware device. Moreover any native dependency is already bundled with Sun's JVM, and you don't have to worry about porting or supporting native code on different platforms. The main disadvantage is that it is non standard, so you are not guaranteed to find it on any JVM.
The commercial APIs (see IAIK's PKCS11 wrapper) are good, and even open sourced, but they have two disadvantages: they are made to work with another API (which you have to pay for...), so they do not expose the token as a KeyStore and you cannot use BouncyCastle transparently, and they have a native component which you have to maintain and distribute. If you have to work with PKCS#11 in a browser, you know what a pain that is...
该错误的原因是某些类仅假定由 Sun JVM 使用，而较新版本的 Eclipse 会进行警告检查，以警告开发人员不正确/非法使用类。
另一个 stackoverflow 线程建议使用 Bouncy Castle 实现。
使用 sun.security.pkcs11.SunPKCS11 的奇怪问题: 找不到指定的程序？
The reason for that error is certain classes are only suppose to be used by the Sun JVM and with newer versions of Eclipse a warning check was put in to warn the developer of improper/illegal use of classes.
Another stackoverflow thread recommends using the Bouncy Castle implementation.
Weird problem using sun.security.pkcs11.SunPKCS11: The specified procedure could not be found?