Unable to store SecretKey in KeyStore

Question

Hi there.
I am trying to store a SecretKey in a KeyStore, and that doesn't work.
I create a secret key, wrap it up in KeyStore.SecretKeyEntry to add it into my key store. Looking at the API for KeyStore class, we have a method setEntry(String alias, KeyStore.Entry entry, KeyStore.ProtectionParameter protParam). The second parameter being KeyStore.Entry, it should be accepting any implementation of KeyStore.Entry, which in my case is KeyStore.SecretKeyEntry. At runtime, an exception is thrown saying that non-private keys cannot be stored!
Can someone throw some light on this please.
Following is my source code and the exception that I see.
Thank you.
import java.io.*;
import java.security.*;
import java.security.cert.*;
import javax.crypto.*;
public class KeyStoreManager {
    private static final String PRIVATE_KEY_ALGORITHM_BLOWFISH = "Blowfish";
    private static final String PRIVATE_KEY_ALGORITHM_DSA = "DSA";
    private static final String KEYSTORE_TYPE = "jks";
    private static final String KEYSTORE_FILE = "C:\\keystore.ks";
    private static final String KEYSTORE_PASSWORD = "keystorepassword";
    private static final int PRIVATE_KEY_SIZE_IN_BITS = 448; //56 bytes
    private SecretKey createSecretKey() throws Exception {
        KeyGenerator keyGenerator = null;
        keyGenerator = KeyGenerator.getInstance(PRIVATE_KEY_ALGORITHM_BLOWFISH);
        keyGenerator.init(PRIVATE_KEY_SIZE_IN_BITS);
        return keyGenerator.generateKey();
    private KeyStore getKeyStore(String keyStoreName, char[] password) throws Exception {
        KeyStore keyStore = KeyStore.getInstance(KEYSTORE_TYPE);
        InputStream stream = null;
        keyStore.load(stream, password);
        keyStore.store(new FileOutputStream(keyStoreName), password);
        return keyStore;
    public static void main(String[] args) throws Exception {
        File keyStoreFile = new File(KEYSTORE_FILE);
        if (keyStoreFile.exists() && keyStoreFile.isFile()) {
            keyStoreFile.delete();
        KeyStoreManager ksm = new KeyStoreManager();
        KeyStore keyStore = ksm.getKeyStore(KEYSTORE_FILE, KEYSTORE_PASSWORD.toCharArray());
        SecretKey secretKey = ksm.createSecretKey();
        KeyStore.SecretKeyEntry secretKeyEntry = new KeyStore.SecretKeyEntry(secretKey);
        KeyStore.ProtectionParameter passwordProtection = new KeyStore.PasswordProtection("entrypassword".toCharArray());
        keyStore.setEntry("SecretKeyAlias", secretKeyEntry, passwordProtection);
        System.out.println("Added key into store");
The exception that I see is..._
Exception in thread "main" java.security.KeyStoreException: Cannot store non-PrivateKeys
at sun.security.provider.JavaKeyStore.engineSetKeyEntry(Unknown Source)
at sun.security.provider.JavaKeyStore$JKS.engineSetKeyEntry(Unknown Source)
at java.security.KeyStoreSpi.engineSetEntry(Unknown Source)
at java.security.KeyStore.setEntry(Unknown Source)
at KeyStoreManager.main(KeyStoreManager.java:42)

Answer 1

A 'JKS' keystore can only store private keys and certificates but not secret keys. Blowfish is a symmetric algorithm and uses a secret key so Blowfish keys cannot be stored in a 'JKS' keystore. You could switch to using 'JCEKS' which allows secret keys.