SecretKeyFactory

SecretKeyFactory is a component of the Java Cryptography Architecture (JCA) that converts a KeySpec into a SecretKey suitable for use with symmetric encryption algorithms. It is obtained with SecretKeyFactory.getInstance(algorithm) and is supplied by security providers such as SunJCE. The factory does not generate raw keys directly; instead it derives or builds a SecretKey from a specification that describes the source material and the derivation parameters.

The usual workflow is: select an algorithm supported by a provider, acquire a SecretKeyFactory for that algorithm, create an appropriate KeySpec, and invoke generateSecret(spec) to obtain a SecretKey. The resulting key can be used with a Cipher configured for encryption or decryption with the corresponding algorithm. A common example is deriving a key from a password using a password-based key specification.

Key specifications include PBEKeySpec for password-based keys, and legacy specs such as DESKeySpec or DESedeKeySpec for certain DES family ciphers. Not all KeySpecs are supported by every algorithm, and generateSecret may throw InvalidKeySpecException if the spec is incompatible.

SecretKeyFactory is part of the provider-based architecture of JCA/JCE, meaning implementations vary by provider and platform but conform to the same API. Key-derived SecretKey objects produced by the factory are suitable for use with standard Java cipher APIs.

See also: KeySpec, PBEKeySpec, SecretKey, PBKDF2, and Java Cryptography Architecture.