Skip to Main Content

Java Security

Announcement

For appeals, questions and feedback about Oracle Forums, please email oracle-forums-moderators_us@oracle.com. Technical questions should be asked in the appropriate category. Thank you!

PBE encryption/decryption

843810Nov 26 2002 — edited Nov 27 2002
I need a simple method that encrypts a(n serialized) Object and
returns the byte array that represents the object serialized and
encrypted, using a PBE encryption. Since it didn't work the way I
expected, I tried to narrow down the application until I came up
with the very simple you can see somewhere below. To be short, the
problem is that the call to java API that is supposed to do the
encryption returns different results for every execution. To be
more specific, for the same clear text and same password, the
encrypted text is different every time. One of the first things I
noticed it that, every time, the key generated from my password if
different. That would explain why the encrypted text is different
each time. Then I saved the key in a file and run the program
reading the very same key every time from the file. And I still
get different results. This is very weird. Looks like the
encryption itself generates and uses internally some sort of a
nonce (build from current time, phase of the Moon or NBA scores).
Why does this happen since, this PBE encryption is supposed to be
useful for sending encrypted data to a remote host where it should
be decrypted using the symmetric algorithm with the same password?
TO summarize my questions are:

1. Why does SecretKeyFactory.generateSecret returns different keys
from the same password?

2. Assuming I have the key and reuse it at different runs of the
algorithm on the same input clear text, why do I get different
outputs?

3. Can anybody show me what is wrong in the code below and explain
/ show me how to encrypt an object (well, serialized form) and
decrypt it on another host using a PBE algorithm?

It seems the call doesn't do the most elementary/basic/fundamental
thing it is supposed to do. This is why I believe I make a mistake
somewhere.

The test code:
---------------------------------

/**
* Crypto.java
*
* @author Created by Radu Handorean
*/

import java.io.*;

import javax.crypto.*;
import javax.crypto.spec.*;


public class Crypto {
public static byte[] encrypt(Object o, char[] password)
{

PBEKeySpec pbeKS = null;
SecretKeyFactory skf = null;
SecretKey sk = null;
Cipher c = null;

byte[] clear = null;
byte[] result = null;

ByteArrayOutputStream baos = null;
ObjectOutputStream oos = null;

try
{
File file = new File("secret.key");
if(file.exists())
/* if I have the file with the key, use the key form the file*/
{
FileInputStream fis = new FileInputStream(file);
ObjectInputStream ois1 = new ObjectInputStream(fis);
sk = (SecretKey)ois1.readObject();
ois1.close();
System.out.println("1");

} // if
else
/* if I don;t have the file with the key, generate the key and use it*/
{
pbeKS = new PBEKeySpec(password);
skf = SecretKeyFactory.getInstance("PBEWithMD5AndDES");
sk = skf.generateSecret(pbeKS);

file.createNewFile();
FileOutputStream fos = new FileOutputStream(file);
ObjectOutputStream oos1 = new ObjectOutputStream(fos);
oos1.writeObject(sk);
oos1.flush();
oos1.close();
System.out.println("2");
} // else
System.out.println("Crypto:encrypt:sk = " + sk);
c = Cipher.getInstance("PBEWithMD5AndDES");
c.init(Cipher.ENCRYPT_MODE, sk);

baos = new ByteArrayOutputStream();
oos = new ObjectOutputStream(baos);
oos.writeObject(o);
clear = baos.toByteArray();

System.out.println("Crypto:encrypt:clear text");
for(int i=0; i<clear.length; i++)
{
System.out.print(" " + clear);
}
System.out.println();

result = c.doFinal(clear);

System.out.println("Crypto:encrypt:encrypted text");
for(int i=0; i<result.length; i++)
{
System.out.print(" " + result[i]);
}
System.out.println();
}
catch
(Exception e)
{
e.printStackTrace();
System.exit(-1);
}
return result;
} // public byte[] encrypt(Object o, byte[] password)

public static void main (String[] args)
{
encrypt("Happy Hour", "Password".toCharArray());

} // public static void main (String[] args)

}

----------------------------------------------------------------

Thank you very much for your time and patience to read the entire
story ( I apologize for making it soooooo long ).

And thank you very much for any kind of help.

Radu

Comments
Locked Post
New comments cannot be posted to this locked post.
Post Details
Locked on Dec 25 2002
Added on Nov 26 2002
5 comments
1,288 views