1 2 Previous Next 19 Replies Latest reply on Feb 25, 2004 9:46 PM by 843853 Go to original post
      • 15. Re: 3DES algorithm
        843853
        This is what my key looks like when it is posted in the database
        com.sun.crypto.provider.DESedeKey@4f96414d

        I guess this does not do the trick right?
        • 16. Re: 3DES algorithm
          843853
          This is what my key looks like when it is posted in
          the database
          com.sun.crypto.provider.DESedeKey@4f96414d

          I guess this does not do the trick right?
          I think you need to post the code that generated the key and writes it to the database! Unless you have serialized the key directly to the database then this looks very wrong. It is almost as if you have placed key.toString() in the database! This simple will not work. You need to place the key bytes in the database.

          The following shows the essential features of what I would do. I can't give you access to the Hex converter class, I don't own it but I'm sure you can find an alternative.
          mport javax.crypto.*;
          import javax.crypto.spec.*;
          
          public class TestEncryption_1
          {   
              public static void main(String[] args)
              {
                  try
                  {
                      java.security.Security.addProvider(new com.sun.crypto.provider.SunJCE());
                      
                      String keyAsString = null;
                      byte[] encryptedBytes = null;;
                      
                      // Generate the key as a String to store in the database
                      // Encode some data using this key.
                      {
                          // Generate a random key
                          KeyGenerator kg = KeyGenerator.getInstance("DESede", "SunJCE");
                          SecretKey  key = kg.generateKey();
                          
                          // Encode the key using Hex
                          byte[] keyAsBytes = key.getEncoded();
                          HexEncoder hexEncoder = new HexEncoder();
                          keyAsString = new String(hexEncoder.encode(keyAsBytes));
                          System.out.println("Key to be saved in db (hex) = [" + keyAsString + "]");
                          
                          // Generate a Cipher based on the random key
                          Cipher cipher = Cipher.getInstance("DESede/ECB/PKCS5Padding", "SunJCE");
                          cipher.init(Cipher.ENCRYPT_MODE, key);
                          
                          // Encrypt some text
                          byte[] bytesToEncrypt = "Hello World".getBytes(); // Should realy say what char encoding
                          encryptedBytes = cipher.doFinal(bytesToEncrypt);
                      }
                      
                      // Regenerate the Key from the key String
                      // and decrypt the encrypted bytes
                      {
                          // Get the key as bytes
                          HexEncoder hexEncoder = new HexEncoder();
                          byte[] keyAsBytes = hexEncoder.decode(keyAsString);
                          
                          // Generate the Key object from the key bytes
                          SecretKeyFactory keyFactory = SecretKeyFactory.getInstance("DESede", "SunJCE");
                          DESedeKeySpec    DESedeKeySpec = new DESedeKeySpec(keyAsBytes);
                          SecretKey key = keyFactory.generateSecret(DESedeKeySpec);
                         
                          // Generate the Cipher using the key reconstructed from the database
                          Cipher cipher = Cipher.getInstance("DESede/ECB/PKCS5Padding", "SunJCE");
                          cipher.init(Cipher.DECRYPT_MODE, key);
                          
                          // Use the Cipher to decrypt the the encrypted bytes.
                          byte[] decryptedBytes = cipher.doFinal(encryptedBytes);
                          String decryptedBytesAsString = new String(decryptedBytes);
                          
                          System.out.println("Decrypted = [" + decryptedBytesAsString + "]");
                      }
                  }
                  catch (Exception e)
                  {
                      System.err.println("Problem, exception " + e);
                      e.printStackTrace(System.err);
                  }
              }
          }
          • 17. Re: 3DES algorithm
            843853
            Ok this is what the Insert code looks like .This encrypts the string before it gets stored in the dbase table. I have not serialized the key no.

            import javax.servlet.*;
            import javax.servlet.http.*;
            import java.io.*;
            import java.util.*;
            import java.sql.*;
            import java.security.*;
            import javax.crypto.*;




            public class InsertcryptoServlet extends HttpServlet

                 {      //public static void main (String[] args){
                      
                 
                 //}     
                      
                      
                      private String last = "";
                      private String first = "";
                      private String email = "";
                      private String home = "";          


                 
            public void init()
                 
                 {
                 try {
                      
                      
                      Class.forName("org.gjt.mm.mysql.Driver");
                      System.out.println("Driver loaded successfully");
                 
                      
                           }

                 catch (ClassNotFoundException e)
                 {

                      System.out.println(e.toString());
                 }
                 
                 

                 }
                           





            public void doGet(HttpServletRequest request,
                      HttpServletResponse response)
                 throws ServletException, IOException
                      {
                      
                      }





            public void doPost(HttpServletRequest request,
                      HttpServletResponse response)
                 throws ServletException, IOException
                      {

                           
                           
                                
                           last = request.getParameter("last");
                           
                                     

                           
                           boolean error = false;
                           String message = null;

                           



                      try {

                      Connection con = DriverManager.getConnection("jdbc:mysql://localhost/project","root","");
                      System.out.println("Successfully connected to database");
                      
                      Statement stmt = con.createStatement();
                      //Generation of 3DES KEY
                      System.out.println("Generating a 3DES key");

                      KeyGenerator keyGenerator = KeyGenerator.getInstance("DESede");
                      keyGenerator.init(112);
                      Key key = keyGenerator.generateKey();
                      
                      System.out.println("\n\nGENERATION OF KEY STATUS-DONE!!!!\n");
                      System.out.print(key);
                      
                      //Initialize a cipher object-this is where enc really takes place-using the above created key
                           Cipher cipher = Cipher.getInstance("DESede/ECB/PKCS5Padding");
                           cipher.init(Cipher.ENCRYPT_MODE, key);
                           
                           System.out.println("\n\nCONVERTING INTO BYTE ARRAY");
                           //convert the plaintext into a byte array using UTF8
                           byte[] plaintext = last.getBytes("UTF8"); //converts the user string into array of bytes ready for enc
                           
                           

                           System.out.println("\nPlaintext:");
                                for (int i=0;i<plaintext.length;i++){
                           
                                     System.out.print(plaintext[i]+"");
                                }
                                
                      
                           //this command is how the actual encryption is triggered(ofcourse after all the byte arraying etc)
                           byte[] ciphertext = cipher.doFinal(plaintext);
                           System.out.println("\n\nEncrypting your string user just now...........");     

                           
                                
                           
                           System.out.println("\n\nCiphertext:");
                           for(int i=0;i<ciphertext.length;i++){
                                     System.out.print(ciphertext[i]+ "");
                                
                                }
                      
                      String last = new String(ciphertext);
                      String sql2 = "INSERT INTO personaldetails" + " (sessionkey,last_name,first_name,email_address,home_address)" +
                      " VALUES " +
                      " ('" + (key) + "'," +
                      " '" + (last) + "'," +
                      " '" + (first) + "'," +
                      " '" + (email) + "'," +
                      " '" +(home) + "') ";

                      int k = stmt.executeUpdate(sql2);
                      
                      //if (i==1)
                           //{

                                //message = "You were successfully added to our database";
                                //message= "Thank you for registering";
                                response.sendRedirect ("http://localhost:8080/thankyou.html");
                                System.out.println("You were successfully added to our database");//this is shown in Tomcat prompt
                                //PrintWriter out = response.getWriter();
                                //out.println("<B>" + message + "</B><br>");
                                //out.println("<B>" + message + "<br>");
                           //}

                 

                      stmt.close();
                      con.close();
                      
                 }

                 catch (SQLException e) {
                                     message = "Error." + e.toString();
                                     error = true;
                           }
                 
                 catch (NoSuchAlgorithmException nsae)
                 {
                           nsae.printStackTrace();
                           throw new RuntimeException("Missing Crypto Algorithm");
                 }
                 
                 catch (NoSuchPaddingException nspe){

                           nspe.printStackTrace();
                           throw new RuntimeException("Missing Crypto Algorithm");}
                 
                 catch (InvalidKeyException ike){

                           ike.printStackTrace();
                           throw new RuntimeException("Invalid key");
                      }
                 
                 catch (UnsupportedEncodingException uee){

                           uee.printStackTrace();
                           throw new RuntimeException("UnsupportedEncoding");
                      }
                 
                 catch (IllegalBlockSizeException ibse){

                           ibse.printStackTrace();
                           throw new RuntimeException("illegal block");
                      }
                 
                 catch (BadPaddingException bpe){

                           bpe.printStackTrace();
                           throw new RuntimeException("Bad padding");

                      }
            }
            }

                      
            • 18. Re: 3DES algorithm
              843853
                                  }
                        
                        String last = new String(ciphertext);
              String sql2 = "INSERT INTO personaldetails" + "
              "
              (sessionkey,last_name,first_name,email_address,home_add
              ess)" +
                        " VALUES " +
                        " ('" + (key) + "'," +
                        " '" + (last) + "'," +
                        " '" + (first) + "'," +
                        " '" + (email) + "'," +
                        " '" +(home) + "') ";

                   
              As I suspected, this just places the key.toString() value into the database and NOT NOT NOT the key!

              I have just found a Base64 implementation within the jdk1.4.1 source so I have used that in my example. Please try it out and try to understand it. Appart from the actual JDBC code, all the features you will need are there!
              import javax.crypto.*;
              import javax.crypto.spec.*;
              
              public class TestEncryption_1
              {
                  public static void main(String[] args)
                  {
                      try
                      {
                          java.security.Security.addProvider(new com.sun.crypto.provider.SunJCE());
                          
                          String keyAsString = null;
                          byte[] encryptedBytes = null;;
                          
                          // Generate the key as a String to store in the database
                          // Encode some data using theis key.
                          {
                              // Generate a random key
                              KeyGenerator kg = KeyGenerator.getInstance("DESede", "SunJCE");
                              SecretKey  key = kg.generateKey();
                              
                              // Encode the key using Base 64
                              byte[] keyAsBytes = key.getEncoded();
                              keyAsString = Base64.byteArrayToBase64(keyAsBytes);
                              System.out.println("Key to be saved in db (hex) = [" + keyAsString + "]");
                              
                              // Generate a Cipher based on the random key
                              Cipher cipher = Cipher.getInstance("DESede/ECB/PKCS5Padding", "SunJCE");
                              cipher.init(Cipher.ENCRYPT_MODE, key);
                              
                              // Encrypt some text
                              byte[] bytesToEncrypt = "Hello World".getBytes(); // Should realy say what char encoding
                              encryptedBytes = cipher.doFinal(bytesToEncrypt);
                          }
                          
                          // Regenerate the Key from the key String
                          // and decrypt the encrypted bytes
                          {
                              // Get the key as bytes by decoding the String
                              byte[] keyAsBytes = Base64.base64ToByteArray(keyAsString);
                              
                              // Generate the Key object from the key bytes
                              SecretKeyFactory keyFactory = SecretKeyFactory.getInstance("DESede", "SunJCE");
                              DESedeKeySpec    DESedeKeySpec = new DESedeKeySpec(keyAsBytes);
                              SecretKey key = keyFactory.generateSecret(DESedeKeySpec);
                              
                              // Generate the Cipher using the key reconstructed from the database
                              Cipher cipher = Cipher.getInstance("DESede/ECB/PKCS5Padding", "SunJCE");
                              cipher.init(Cipher.DECRYPT_MODE, key);
                              
                              // Use the Cipher to decrypt the the encrypted bytes.
                              byte[] decryptedBytes = cipher.doFinal(encryptedBytes);
                              String decryptedBytesAsString = new String(decryptedBytes);
                              
                              System.out.println("Decrypted = [" + decryptedBytesAsString + "]");
                          }
                      }
                      catch (Exception e)
                      {
                          System.err.println("Problem, exception " + e);
                          e.printStackTrace(System.err);
                      }
                  }
                  
                  /**
                   * Static methods for translating Base64 encoded strings to byte arrays
                   * and vice-versa.
                   *
                   * @author  Josh Bloch
                   * @version 1.3, 12/03/01
                   * @see     Preferences
                   * @since   1.4
                   */
                  static class Base64
                  {
                      /**
                       * Translates the specified byte array into a Base64 string as per
                       * Preferences.put(byte[]).
                       */
                      static String byteArrayToBase64(byte[] a)
                      {
                          return byteArrayToBase64(a, false);
                      }
                      
                      /**
                       * Translates the specified byte array into an "aternate representation"
                       * Base64 string.  This non-standard variant uses an alphabet that does
                       * not contain the uppercase alphabetic characters, which makes it
                       * suitable for use in situations where case-folding occurs.
                       */
                      static String byteArrayToAltBase64(byte[] a)
                      {
                          return byteArrayToBase64(a, true);
                      }
                      
                      private static String byteArrayToBase64(byte[] a, boolean alternate)
                      {
                          int aLen = a.length;
                          int numFullGroups = aLen/3;
                          int numBytesInPartialGroup = aLen - 3*numFullGroups;
                          int resultLen = 4*((aLen + 2)/3);
                          StringBuffer result = new StringBuffer(resultLen);
                          char[] intToAlpha = (alternate ? intToAltBase64 : intToBase64);
                          
                          // Translate all full groups from byte array elements to Base64
                          int inCursor = 0;
                          for (int i=0; i<numFullGroups; i++)
                          {
                              int byte0 = a[inCursor++] & 0xff;
                              int byte1 = a[inCursor++] & 0xff;
                              int byte2 = a[inCursor++] & 0xff;
                              result.append(intToAlpha[byte0 >> 2]);
                              result.append(intToAlpha[(byte0 << 4)&0x3f | (byte1 >> 4)]);
                              result.append(intToAlpha[(byte1 << 2)&0x3f | (byte2 >> 6)]);
                              result.append(intToAlpha[byte2 & 0x3f]);
                          }
                          
                          // Translate partial group if present
                          if (numBytesInPartialGroup != 0)
                          {
                              int byte0 = a[inCursor++] & 0xff;
                              result.append(intToAlpha[byte0 >> 2]);
                              if (numBytesInPartialGroup == 1)
                              {
                                  result.append(intToAlpha[(byte0 << 4) & 0x3f]);
                                  result.append("==");
                              } else
                              {
                                  // assert numBytesInPartialGroup == 2;
                                  int byte1 = a[inCursor++] & 0xff;
                                  result.append(intToAlpha[(byte0 << 4)&0x3f | (byte1 >> 4)]);
                                  result.append(intToAlpha[(byte1 << 2)&0x3f]);
                                  result.append('=');
                              }
                          }
                          // assert inCursor == a.length;
                          // assert result.length() == resultLen;
                          return result.toString();
                      }
                      
                      /**
                       * This array is a lookup table that translates 6-bit positive integer
                       * index values into their "Base64 Alphabet" equivalents as specified
                       * in Table 1 of RFC 2045.
                       */
                      private static final char intToBase64[] =
                      {
                          'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M',
                          'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z',
                          'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm',
                          'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z',
                          '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', '+', '/'
                      };
                      
                      /**
                       * This array is a lookup table that translates 6-bit positive integer
                       * index values into their "Alternate Base64 Alphabet" equivalents.
                       * This is NOT the real Base64 Alphabet as per in Table 1 of RFC 2045.
                       * This alternate alphabet does not use the capital letters.  It is
                       * designed for use in environments where "case folding" occurs.
                       */
                      private static final char intToAltBase64[] =
                      {
                          '!', '"', '#', '$', '%', '&', '\'', '(', ')', ',', '-', '.', ':',
                          ';', '<', '>', '@', '[', ']', '^',  '`', '_', '{', '|', '}', '~',
                          'a', 'b', 'c', 'd', 'e', 'f', 'g',  'h', 'i', 'j', 'k', 'l', 'm',
                          'n', 'o', 'p', 'q', 'r', 's', 't',  'u', 'v', 'w', 'x', 'y', 'z',
                          '0', '1', '2', '3', '4', '5', '6',  '7', '8', '9', '+', '?'
                      };
                      
                      /**
                       * Translates the specified Base64 string (as per Preferences.get(byte[]))
                       * into a byte array.
                       *
                       * @throw IllegalArgumentException if <tt>s</tt> is not a valid Base64
                       *        string.
                       */
                      static byte[] base64ToByteArray(String s)
                      {
                          return base64ToByteArray(s, false);
                      }
                      
                      /**
                       * Translates the specified "aternate representation" Base64 string
                       * into a byte array.
                       *
                       * @throw IllegalArgumentException or ArrayOutOfBoundsException
                       *        if <tt>s</tt> is not a valid alternate representation
                       *        Base64 string.
                       */
                      static byte[] altBase64ToByteArray(String s)
                      {
                          return base64ToByteArray(s, true);
                      }
                      
                      private static byte[] base64ToByteArray(String s, boolean alternate)
                      {
                          byte[] alphaToInt = (alternate ?  altBase64ToInt : base64ToInt);
                          int sLen = s.length();
                          int numGroups = sLen/4;
                          if (4*numGroups != sLen)
                              throw new IllegalArgumentException(
                              "String length must be a multiple of four.");
                          int missingBytesInLastGroup = 0;
                          int numFullGroups = numGroups;
                          if (sLen != 0)
                          {
                              if (s.charAt(sLen-1) == '=')
                              {
                                  missingBytesInLastGroup++;
                                  numFullGroups--;
                              }
                              if (s.charAt(sLen-2) == '=')
                                  missingBytesInLastGroup++;
                          }
                          byte[] result = new byte[3*numGroups - missingBytesInLastGroup];
                          
                          // Translate all full groups from base64 to byte array elements
                          int inCursor = 0, outCursor = 0;
                          for (int i=0; i<numFullGroups; i++)
                          {
                              int ch0 = base64toInt(s.charAt(inCursor++), alphaToInt);
                              int ch1 = base64toInt(s.charAt(inCursor++), alphaToInt);
                              int ch2 = base64toInt(s.charAt(inCursor++), alphaToInt);
                              int ch3 = base64toInt(s.charAt(inCursor++), alphaToInt);
                              result[outCursor++] = (byte) ((ch0 << 2) | (ch1 >> 4));
                              result[outCursor++] = (byte) ((ch1 << 4) | (ch2 >> 2));
                              result[outCursor++] = (byte) ((ch2 << 6) | ch3);
                          }
                          
                          // Translate partial group, if present
                          if (missingBytesInLastGroup != 0)
                          {
                              int ch0 = base64toInt(s.charAt(inCursor++), alphaToInt);
                              int ch1 = base64toInt(s.charAt(inCursor++), alphaToInt);
                              result[outCursor++] = (byte) ((ch0 << 2) | (ch1 >> 4));
                              
                              if (missingBytesInLastGroup == 1)
                              {
                                  int ch2 = base64toInt(s.charAt(inCursor++), alphaToInt);
                                  result[outCursor++] = (byte) ((ch1 << 4) | (ch2 >> 2));
                              }
                          }
                          // assert inCursor == s.length()-missingBytesInLastGroup;
                          // assert outCursor == result.length;
                          return result;
                      }
                      
                      /**
                       * Translates the specified character, which is assumed to be in the
                       * "Base 64 Alphabet" into its equivalent 6-bit positive integer.
                       *
                       * @throw IllegalArgumentException or ArrayOutOfBoundsException if
                       *        c is not in the Base64 Alphabet.
                       */
                      private static int base64toInt(char c, byte[] alphaToInt)
                      {
                          int result = alphaToInt[c];
                          if (result < 0)
                              throw new IllegalArgumentException("Illegal character " + c);
                          return result;
                      }
                      
                      /**
                       * This array is a lookup table that translates unicode characters
                       * drawn from the "Base64 Alphabet" (as specified in Table 1 of RFC 2045)
                       * into their 6-bit positive integer equivalents.  Characters that
                       * are not in the Base64 alphabet but fall within the bounds of the
                       * array are translated to -1.
                       */
                      private static final byte base64ToInt[] =
                      {
                          -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
                          -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
                          -1, -1, -1, -1, -1, -1, -1, -1, -1, 62, -1, -1, -1, 63, 52, 53, 54,
                          55, 56, 57, 58, 59, 60, 61, -1, -1, -1, -1, -1, -1, -1, 0, 1, 2, 3, 4,
                          5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23,
                          24, 25, -1, -1, -1, -1, -1, -1, 26, 27, 28, 29, 30, 31, 32, 33, 34,
                          35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51
                      };
                      
                      /**
                       * This array is the analogue of base64ToInt, but for the nonstandard
                       * variant that avoids the use of uppercase alphabetic characters.
                       */
                      private static final byte altBase64ToInt[] =
                      {
                          -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
                          -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 0, 1,
                          2, 3, 4, 5, 6, 7, 8, -1, 62, 9, 10, 11, -1 , 52, 53, 54, 55, 56, 57,
                          58, 59, 60, 61, 12, 13, 14, -1, 15, 63, 16, -1, -1, -1, -1, -1, -1,
                          -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
                          -1, -1, -1, 17, -1, 18, 19, 21, 20, 26, 27, 28, 29, 30, 31, 32, 33,
                          34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50,
                          51, 22, 23, 24, 25
                      };
                      
                      public static void main(String args[])
                      {
                          int numRuns  = Integer.parseInt(args[0]);
                          int numBytes = Integer.parseInt(args[1]);
                          java.util.Random rnd = new java.util.Random();
                          for (int i=0; i<numRuns; i++)
                          {
                              for (int j=0; j<numBytes; j++)
                              {
                                  byte[] arr = new byte[j];
                                  for (int k=0; k<j; k++)
                                      arr[k] = (byte)rnd.nextInt();
                                  
                                  String s = byteArrayToBase64(arr);
                                  byte [] b = base64ToByteArray(s);
                                  if (!java.util.Arrays.equals(arr, b))
                                      System.out.println("Dismal failure!");
                                  
                                  s = byteArrayToAltBase64(arr);
                                  b = altBase64ToByteArray(s);
                                  if (!java.util.Arrays.equals(arr, b))
                                      System.out.println("Alternate dismal failure!");
                              }
                          }
                      }
                  }
                  
              }
              • 19. Re: 3DES algorithm
                843853
                THANKS for that, ill give it a try and get back to you ASAP
                1 2 Previous Next