As I export the privateKey of a certificate, I'd like to validate user's input password/pin.

JCAPIProperties.getInstance().setPrivateKeyExportable(true);
KeyStore ks = KeyStore.getInstance("msks", "JCAPI");
ks.load(null, null);
Key privateKey=ks.getKey(certiticateAlias, pin.toCharArray());

The above code always return the valid PrivateKey no matter what value with "pin".

Does any one know how to validate user's input of password/pin ?

thank you.

Hi,

The password parameter in the KeyStore.getKey() method is ignored by JCAPI, see the method description of JCE implementation class JCAPIKeyStore.engineGetKey() in the JCAPI Javadoc:
http://pheox.com/products/jcapi/javadoc/index.html

The reason for ignoring the parameter is that JCAPI has no control of the protection mechanism of the key since it is exclusively handled by Microsoft's CryptoAPI (MS CAPI). This might be more obvious when you are trying to export a private key from MS CAPI that is password protected. In these occasions, MS CAPI will launch a native GUI password dialog for the user to enter his/her password in order to access the specific private key. This dialog, and the private key decryption mechanism is not available for JCAPI. JCAPI will either receive the private key or an error code if the private key could not be exported through MS CAPI (depending on the user's given password, and if the key is exportable or not).

You can test this yourself by creating a RSA private key in Java and store it in MS CAPI through JCAPI by running the JCAPI example program CreateKeyEntry.java. The shown dialogs (that suggests different protection/security levels) are displayed by MS CAPI and is not known, neither handled, by JCAPI i.e JCAPI will not know of you choose to protect the key with a password or not.

Regards,
Tommy