Re: Encrypting/Decrypting Password from a Config File


<michael.santamaria@xxxxxxxxx> wrote in message
news:1130960757.080256.197010@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
> Hello,
> I am looking for a way to encrypt a password in a configuration file
> that is being read by a Java program. Currently, I read-in the
> password from the text file, but that leaves the password sitting right
> out in the open if someone were to look at the config file.
>
> I was thinking of building a simple class where user could type in
> their desired password, get an encrypted version of the password, then
> paste the encrypted version into the configuration text file. Then the
> application would read encrypted password, decrypt the password back
> into a string, and move on.
>
> I am having trouble with the string-->encrytped bytes-->string
> conversions.
>
> I am using the built-in java security classes to implement this code.
> Here is some sample test code:
>
> // Reads password from config file
> String password = ScriptConfig.getString( "password" );
>
> // Generate Key
> KeyGenerator kg = KeyGenerator.getInstance("DES");
> Key key = kg.generateKey();
>
> // Create Encryption cipher
> Cipher cipher = Cipher.getInstance( "DES" );
> cipher.init( Cipher.ENCRYPT_MODE, key );
>
> // Encrypt password
> byte[] encrypted = cipher.doFinal( password.getBytes() );
>
> // Create decryption cipher
> cipher.init( Cipher.DECRYPT_MODE, key );
> byte[] decrypted = cipher.doFinal( encrypted );
>
> // Convert byte[] to String
> String decryptedString = new String(decrypted);
>
> System.out.println("password: " + password);
> System.out.println("encrypted: " + encrypted);
> System.out.println("decrypted: " + decryptedString);
>
> // Read encrypted string from config file
> String encryptedPassword = ScriptConfig.getString( "encryptedPassword"
> );
>
> // Convert encryptedPassword string into byte[]
> byte[] encryptedPasswordBytes = new byte[1024];
> encryptedPasswordBytes = encryptedPassword.getBytes();
>
> // Decrypt encrypted password from config file
> byte[] decryptedPassword = cipher.doFinal( encryptedPasswordBytes );
>
> System.out.println("encryptedPassword: " + encryptedPassword);
> System.out.println("decryptedPassword: " + decryptedPassword);
>
>
> The config file has the following variables:
> password=password
> encryptedPassword=[B@2a4983
>
>
> When I run the code, I get the following output:
> password: passwd
> encrypted: [B@2a4983
> decrypted: passwd
> javax.crypto.IllegalBlockSizeException: Input length must be multiple
> of 8 when decrypting with padded cipher
> at com.sun.crypto.provider.SunJCE_h.b(DashoA12275)
> at com.sun.crypto.provider.SunJCE_h.b(DashoA12275)
> at com.sun.crypto.provider.DESCipher.engineDoFinal(DashoA12275)
> at javax.crypto.Cipher.doFinal(DashoA12275)
> at com.sapient.fbi.uid.TestEncryption.main(TestEncryption.java:48)
>

If you actually included an SSCCE, I could find out which line is line
48, and it'd be easier for me to help you.

SSCCE: http://www.physci.org/codes/sscce.jsp

My guess is it has something to do with not padding the results
correctly. As the message implies, the decryption algorithm expects the
length to be a multile of 8, and "[B@2a4983" is of length 9.

- Oliver


.

Relevant Pages

  • Re: Web.config or App.config Security
    ... I would be surprised if you could use Data Protection Provider from a Web ... If I understand it correctly, it uses DPAPI, but DPAPI (with ... .config file. ... > encrypt all my configurations files. ...
    (microsoft.public.dotnet.security)
  • im still trying to get the grips of monoalphabetic substitution.
    ... Now one exercise is to create a keyword cipher. ... now I'm writing a program to do this, encrypt and decrypt. ... the key letter from the cipher letter and i would have my plaintext back, ...
    (sci.crypt)
  • encrypting connection strings for network installed application
    ... applications on the workstations and the appropriate permissions on the ... application's .config file, the connectionStrings section of the file ... Here is the code used to encrypt the connectionStrings section of the ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: TEA for real-life embedded project?
    ... thought that in symetric ciphers these functions are more or less, well, ... AFAIK "symmetric" means only that the same key is used for encrypt ... encrypt & decrypt. ... RC4 is a symmetric cipher with the same algo for ...
    (sci.crypt)
  • Re: 2 Keys decrypts same message
    ... also encrypt Hwith the master key K_m, call this cipher as C2. ... C1 with the key Hto retrieve D. ... K_m can be used to decrypt C2 ...
    (sci.crypt)