Re: SSL encrypting to file

• Subject: Re: SSL encrypting to file
• From: Ben Spink <email@hidden>
• Date: Wed, 23 Apr 2008 22:57:42 -0500
• Delivered-to: email@hidden
• Delivered-to: email@hidden

Thanks,
Ben

On Apr 22, 2008, at 12:23 AM, Jason Proctor wrote:

i'm jumping into the middle of this thread, and i hope i have the scenario straight here...

your description & code seem to confuse public-key encryption and symmetric-key encryption. usually, public key encryption (aka PKI) is not used to crypt content directly, as the maths is very CPU intensive. usually the content is crypted using a symmetric "session" key, and this key is then crypted for transit using PKI. (this is how PKI apps such as SSL conventionally work.)

in the code, your method getPrivateKey() seems to return a KeyPair rather than a private key, but i'll assume that's a typo or the method changed purpose at some point. in any case, if that routine does return a PKI keypair or private key, it's unlikely to be a DESede key as your next lines assume. DES is a symmetric algorithm. PKI key algorithms are usually RSA, DSA, or El-Gamal, etc.

your code also assumes that encrypt & decrypt use the same key, which is definitely not true of PKI. if you were doing everything with the PKI keys in the keystore, you'd have to get the public key and use that to encrypt, then the corresponding private key to decrypt -- or vice versa, naturally.

my product is built on JCE-based PKI, i can provide further help if necessary.

hope this helps
j

The requirements on this task are vague, but I will try and fill in as much as I understand it.

They want me to "use SSL Certificates to encrypt data files on the disk, and use SSL certificates to decrypt the data files when needed."

This is something I have never done before, nor have I found any references searching google on how to do this. With your additional tips, I may be able to get the right hits on google now.

It will be X509 certificates. The same cert they would be using from a keystore for handling HTTPS and a SSLSocket. The key will be retrieved from a webservice call.

They do not want to do PGP (I suggested it), and I would prefer to use the built in Java JCE and not use bouncy or cryptix.

This is the example code I have come up with...but it doesn't work.

public void testCert(String KEYSTORE, String keystorepass, String keypass) throws Exception
{
Security.addProvider(new com.sun.net.ssl.internal.ssl.Provider());
KeyStore keystore = KeyStore.getInstance("JKS");
keystore.load(new FileInputStream(KEYSTORE), keystorepass.toCharArray());
KeyPair kp = getPrivateKey(keystore, "mykey", keypass.toCharArray ());

		Cipher ecipher = Cipher.getInstance("DESede");
		Cipher dcipher = Cipher.getInstance("DESede");
		ecipher.init(Cipher.PRIVATE_KEY, kp.getPrivate());
		dcipher.init(Cipher.PRIVATE_KEY, kp.getPrivate());

		FileOutputStream out = new FileOutputStream("encrypted.txt");
		FileInputStream in = new FileInputStream("clear.txt");

		CipherOutputStream cos = new CipherOutputStream(out, ecipher);
		byte[] buffer = new byte[2048];
		int bytesRead = 0;
		while ((bytesRead = in.read(buffer)) != -1) {
			cos.write(buffer, 0, bytesRead);
		}
		cos.close();
		in.close();

		out = new FileOutputStream("decrypted.txt");
		in = new FileInputStream("encrypted.txt");

		CipherInputStream cis = new CipherInputStream(in, dcipher);
		buffer = new byte[2048];
		bytesRead = 0;
		while ((bytesRead = in.read(buffer)) != -1) {
			out.write(buffer, 0, bytesRead);
		}
		cis.close();
		out.close();
	}

_______________________________________________
Do not post admin requests to the list. They will be ignored.
Java-dev mailing list      (email@hidden)
Help/Unsubscribe/Update your Subscription:
http://lists.apple.com/mailman/options/java-dev/email@hidden

• Prev by Date: Re: OS X Style Menus - The Right Solution?
• Next by Date: Re: SSL encrypting to file
• Previous by thread: Re: SSL encrypting to file
• Next by thread: Re: SSL encrypting to file
• Index(es):
  • Date
  • Thread