Page History

...

This compliant solution uses the Advanced Encryption Standard (AES) algorithm in Galois/Counter Mode (GCM) to perform the encryption.  GCM has the benefit of providing authenticity (integrity) in addition to confidentiality.  GCM is available by default in Java 8, but not Java 7.  The same secret key can be used to encrypt multiple messages in GCM mode, but it is very important that a different initialization vector (IV) be used for each message.  The below encrypt_gcm method uses SecureRandom to generate a unique (with very high probability) IV for each message encrypted.  Logically, the encrypt_gcm method produces a pair of (IV, ciphertext), which the decrypt_gcm method consumes.  However, at the Java level, the encrypt_gcm method returns a single byte array that consists of the IV followed by the ciphertext, since in practice this is often easier to handle than a pair of byte arrays.

import java.util.Arrays;
import javax.crypto.*;
import javax.crypto.spec.*;
import java.security.SecureRandom;
import java.security.GeneralSecurityException*;

class Msc61 {
    public static final int GCM_TAG_LENGTH = 16;
    public static final int GCM_IV_LENGTH = 12;

    public static SecretKey generateKey() throws GeneralSecurityException{
        try {
            KeyGenerator kgen = KeyGenerator.getInstance("AES");
            kgen.init(128);
            return kgen.generateKey();
    }

    public} static byte[] encrypt_gcm(SecretKey skey, String plaintext) throws GeneralSecurityException catch (NoSuchAlgorithmException e) {
        byte[] ciphertext = null;
 throw       Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");new IllegalStateException(e.toString());
        }
    }

    public   static byte[] initVector = new byte[GCM_IV_LENGTH];encrypt_gcm(SecretKey skey, String plaintext)  {
        (new SecureRandom()).nextBytes(initVector);
        GCMParameterSpec spec = new GCMParameterSpec(GCM_TAG_LENGTH * java.lang.Byte.SIZE, initVector);
        cipher.init(Cipher.ENCRYPT_MODE, skey, spec);
/* Precond: skey is valid and GCM mode is available in the JRE;
         * otherwise IllegalStateException will be thrown. */
        try byte[]{
 encoded = plaintext.getBytes(java.nio.charset.StandardCharsets.UTF_8);
        ciphertext = new byte[initVector.length + cipher.getOutputSize(encoded.length)]] ciphertext = null;
        for (int i=0; i < initVector.length; i++) {Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");            
            ciphertextbyte[i] initVector = new initVector[ibyte[GCM_IV_LENGTH];
        }
        // Perform encryption
(new SecureRandom()).nextBytes(initVector);
            GCMParameterSpec spec = new cipher.doFinal(encoded, 0, encoded.length, ciphertext, initVector.lengthGCMParameterSpec(GCM_TAG_LENGTH * java.lang.Byte.SIZE, initVector);
        return ciphertext;
    }

cipher.init(Cipher.ENCRYPT_MODE, skey, spec);
       public static String decrypt_gcm(SecretKey skey, byte[] ciphertext) throws GeneralSecurityException {
 encoded = plaintext.getBytes(java.nio.charset.StandardCharsets.UTF_8);
           Cipher cipherciphertext = Cipher.getInstance("AES/GCM/NoPadding"); new byte[initVector.length + cipher.getOutputSize(encoded.length)];
            
    for (int i=0; i < initVector.length; i++) {
    byte[] initVector = Arrays.copyOfRange(ciphertext, 0, GCM_IV_LENGTH)          ciphertext[i] = initVector[i];
        GCMParameterSpec  spec = new GCMParameterSpec(GCM_TAG_LENGTH * java.lang.Byte.SIZE, initVector);
}
            cipher.init(Cipher.DECRYPT_MODE, skey, spec);// Perform encryption
        byte[]  plaintext = cipher.doFinal(ciphertextencoded, GCM_IV_LENGTH0, ciphertextencoded.length, - GCM_IV_LENGTHciphertext, initVector.length);
            return new String(plaintext)ciphertext;
        }
} 

Compliant Solution

This compliant solution uses the Advanced Encryption Standard (AES) algorithm in Cipher Block Chaining (CBC) mode to perform the encryption.  It uses the "AES/CBC/PKCS5Padding" transformation, which the Java documentation guarantees to be available on all conforming implementations of the Java platform.  However, CBC mode does not incorporate any authentication checks.  Therefore, a separate message authentication code (MAC) should be generated by the sender after encryption and verified by the receiver before decryption.  (Note that verifying the MAC after decryption, rather than before decryption, can introduce a "padding oracle" vulnerability.)

import java.util.Arrays;
import javax.crypto.*;
import javax.crypto.spec.*;
import java.security.SecureRandom;
import java.security.GeneralSecurityException;

class Msc61 {
    public static SecretKey generateKey() throws GeneralSecurityException {
        KeyGenerator kgen = KeyGenerator.getInstance("AES");
        kgen.init(128); catch (NoSuchPaddingException | InvalidAlgorithmParameterException | ShortBufferException |
            BadPaddingException | IllegalBlockSizeException | InvalidKeyException | NoSuchAlgorithmException e) 
        {
            /* None of these exceptions should be possible if precond is met. */
            throw new IllegalStateException(e.toString());
        }
    }

    public static String decrypt_gcm(SecretKey skey, byte[] ciphertext) 
        return kgen.generateKey();
    }

    public static byte[] encrypt_cbc(SecretKey skey, String plaintext) throws GeneralSecurityException {
        byte[] ciphertext = null;
        Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");            
throws BadPaddingException, IllegalBlockSizeException /* these indicate corrupt or malicious ciphertext */
        /* Note that AEADBadTagException may be thrown in GCM mode; this is a subclass of BadPaddingException */
    {
        /* Precond: skey is valid and GCM mode is available in the JRE;
         * finalotherwise intIllegalStateException blockSizewill =be cipher.getBlockSize();thrown. */
        byte[] initVector = new byte[blockSize];
try {
            Cipher cipher (new SecureRandom()).nextBytes(initVector);
= Cipher.getInstance("AES/GCM/NoPadding");        IvParameterSpec ivSpec = new IvParameterSpec(initVector);

            cipher.init(Cipher.ENCRYPT_MODE, skey, ivSpecbyte[] initVector = Arrays.copyOfRange(ciphertext, 0, GCM_IV_LENGTH);
        byte[] encoded = plaintext.getBytes(java.nio.charset.StandardCharsets.UTF_8);
        ciphertext  GCMParameterSpec spec = new byte[initVector.length + cipher.getOutputSize(encoded.length)]GCMParameterSpec(GCM_TAG_LENGTH * java.lang.Byte.SIZE, initVector);
        for (int i=0; i < initVector.length; i++) {
    cipher.init(Cipher.DECRYPT_MODE, skey, spec);
            byte[] plaintext =    ciphertext[i] = initVector[i]cipher.doFinal(ciphertext, GCM_IV_LENGTH, ciphertext.length - GCM_IV_LENGTH);
        }
    return new String(plaintext);
  // Perform encryption
    } catch (NoSuchPaddingException  cipher.doFinal(encoded, 0, encoded.length, ciphertext, initVector.length);
| InvalidAlgorithmParameterException |
           return ciphertext;
InvalidKeyException | NoSuchAlgorithmException e) }
    public static String decrypt_cbc(SecretKey skey, byte[] ciphertext) throws GeneralSecurityException {
 {
            /* CipherNone cipherof = Cipher.getInstance("AES/CBC/PKCS5Padding");        these exceptions should be possible if precond is met. */
    
        finalthrow int blockSize = cipher.getBlockSizenew IllegalStateException(e.toString());
        }
 byte[] initVector = Arrays.copyOfRange(ciphertext, 0, blockSize);
        IvParameterSpec ivSpec = new IvParameterSpec(initVector);
        cipher.init(Cipher.DECRYPT_MODE, skey, ivSpec);
        byte[] plaintext = cipher.doFinal(ciphertext, blockSize, ciphertext.length - blockSize);
        return new String(plaintext);
    }
} 

Both of the above compliant solutions use 128-bit AES keys.  Longer keys (192-bit and 256-bit) may be available if the "Unlimited Strength Jurisdiction Policy" files are installed and available to the Java runtime environment.  A brute-force attack against 128-bit AES keys would take billions of years with current computational resources, so absent a cryptographic weakness in AES, 128-bit keys are likely suitable for secure encryption.

Applicability

Use of mathematically and computationally insecure cryptographic algorithms can result in the disclosure of sensitive information.

Weak cryptographic algorithms can be disabled in Java SE 7; see the Java PKI Programmer's Guide, Appendix D: Disabling Cryptographic Algorithms [Oracle 2011a].

 }
} 

Compliant Solution

This compliant solution uses the Advanced Encryption Standard (AES) algorithm in Cipher Block Chaining (CBC) mode to perform the encryption.  It uses the "AES/CBC/PKCS5Padding" transformation, which the Java documentation guarantees to be available on all conforming implementations of the Java platform.  However, CBC mode does not incorporate any authentication checks.  Therefore, a separate message authentication code (MAC) should be generated by the sender after encryption and verified by the receiver before decryption.  (Note that verifying the MAC after decryption, rather than before decryption, can introduce a "padding oracle" vulnerability.)

import java.util.Arrays;
import javax.crypto.*;
import javax.crypto.spec.*;
import java.security.*;

class Msc61 {
    public static SecretKey generateKey() {
        try {
            KeyGenerator kgen = KeyGenerator.getInstance("AES");
            kgen.init(128);
            return kgen.generateKey();
        } catch (NoSuchAlgorithmException e) {
            throw new IllegalStateException(e.toString());
        }
    }

    public static byte[] encrypt_cbc(SecretKey skey, String plaintext) {
        /* Precond: skey is valid; otherwise IllegalStateException will be thrown. */
        try {
            byte[] ciphertext = null;
            Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");            
            final int blockSize = cipher.getBlockSize();
            byte[] initVector = new byte[blockSize];
            (new SecureRandom()).nextBytes(initVector);
            IvParameterSpec ivSpec = new IvParameterSpec(initVector);
            cipher.init(Cipher.ENCRYPT_MODE, skey, ivSpec);
            byte[] encoded = plaintext.getBytes(java.nio.charset.StandardCharsets.UTF_8);
            ciphertext = new byte[initVector.length + cipher.getOutputSize(encoded.length)];
            for (int i=0; i < initVector.length; i++) {
                ciphertext[i] = initVector[i];
            }
            // Perform encryption
            cipher.doFinal(encoded, 0, encoded.length, ciphertext, initVector.length);
            return ciphertext;
        } catch (NoSuchPaddingException | InvalidAlgorithmParameterException | ShortBufferException |
            BadPaddingException | IllegalBlockSizeException | InvalidKeyException | NoSuchAlgorithmException e) 
        {
            /* None of these exceptions should be possible if precond is met. */
            throw new IllegalStateException(e.toString());
        }
    }

    public static String decrypt_cbc(SecretKey skey, byte[] ciphertext)
        throws BadPaddingException, IllegalBlockSizeException /* these indicate corrupt or malicious ciphertext */
    {
        try {
            Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");            
            final int blockSize = cipher.getBlockSize();
            byte[] initVector = Arrays.copyOfRange(ciphertext, 0, blockSize);
            IvParameterSpec ivSpec = new IvParameterSpec(initVector);
            cipher.init(Cipher.DECRYPT_MODE, skey, ivSpec);
            byte[] plaintext = cipher.doFinal(ciphertext, blockSize, ciphertext.length - blockSize);
            return new String(plaintext);
        } catch (NoSuchPaddingException | InvalidAlgorithmParameterException |
            InvalidKeyException | NoSuchAlgorithmException e) 
        {
            /* None of these exceptions should be possible if precond is met. */
            throw new IllegalStateException(e.toString());
        }
    }
} 

Both of the above compliant solutions use 128-bit AES keys.  Longer keys (192-bit and 256-bit) may be available if the "Unlimited Strength Jurisdiction Policy" files are installed and available to the Java runtime environment.  A brute-force attack against 128-bit AES keys would take billions of years with current computational resources, so absent a cryptographic weakness in AES, 128-bit keys are likely suitable for secure encryption.

Applicability

Use of mathematically and computationally insecure cryptographic algorithms can result in the disclosure of sensitive information.

Weak cryptographic algorithms can be disabled in Java SE 7; see the Java PKI Programmer's Guide, Appendix D: Disabling Cryptographic Algorithms [Oracle 2011a].

Automated Detection

Related Guidelines

Bibliography

...

...

Image Modified Image Modified Image Modified