I wrote this block of code a couple years ago, but it has served me well. I remember it being quite a challenge to get it to work properly. There was, and maybe still is a dearth of decent examples on using AES encryption from Java. The examples I found didn't deal with Cypher Block Coding (CBC). CBC is essential to decent encryption because it feeds the output of one cyphered block forward into the next, thus creating a cascade of randomness. All you need is an initial random phrase in the data you wish to encrypt. If you don't use CBC, you'll notice that blocks of your encrypted data can easily be recognized as separators in what you are encrypting. For example, let's say I encrypt the phrase "user:bob:password:abc". The substring "user:" and "password:" will cause an identifiable pattern in the encrypted data. If someone has access to snoop the wire, they can literally lift the encrypted username and password out of someone else's transmission, and paste it into their own. While CBC with a leading random phrase will make it impossible to identify such non-randomness, you still have to guard against someone injecting cruft into the encrypted data. This should be done by appending an MD5 hash of the unencrypted data, then encrypting the whole ball of wax.
private static String encrypt(String encryptMe, byte[] cryptKey, SecretKey secretKey, byte[] iv){
try {
Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding", "SunJCE");
cipher.init(Cipher.ENCRYPT_MODE, secretKey, new IvParameterSpec(iv));
byte[] raw = encryptMe.toString().getBytes("ASCII");
if(log.isDebugEnabled())log.debug("unencrypted bytes: " + raw.length);
byte[] cipherText = new byte[cipher.getOutputSize(raw.length)];
int ctLength = cipher.update(raw, 0, raw.length, cipherText, 0);
ctLength += cipher.doFinal(cipherText, ctLength);
if(log.isDebugEnabled())log.debug("ctLength: " + ctLength);
if(log.isDebugEnabled())log.debug("cipherText Length: " + cipherText.length);
//raw = cipher.doFinal(raw, 0, raw.length);
byte[] copy = new byte[ctLength];
System.arraycopy(cipherText, 0, copy, 0, ctLength);
String encrypted = new String(new Base64().encode(copy), "US-ASCII");
return encrypted;
} catch (Exception ex) {
throw new RuntimeException(ex.getMessage(), ex);
}
}
Posts
