7/2/07

3DES/Base64 encryption in java

Last week I need to post data in xml format to one server. For security reason one node[xml] require 3DES encryption and encode to Base64 before send. It's a good idea to encrypt sensitive data before store in database or transfer over internet but I'm not even know what 3DES is. After some search, I found that it's not too hard.

This post is about how i encrypt data in java. 3DES algorithm use symetric key[secret key] to encrypt or decrypt data. So..

First define a key [ length must be 24 bytes ]. I do this by getBytes() from random string.

byte [] seed_key = (new String("er48nsjhwlG593mjhgdb20ih")).getBytes()

create Cipher object
SecretKeySpec keySpec = new SecretKeySpec(seed_key,"TripleDES");
Cipher nCipher=Cipher.getInstance("TripleDES");
nCipher.init( Cipher.ENCRYPT_MODE, keySpec );

Cipher class provides the functionality of a cryptographic cipher for encryption and decryption. To create cipher object, pass transformation to getInstance method.
Transformation can be in form like "algorithm/mode/padding" or only "algorithm".
for 3DES, algorithm can be "DESede" or "TripleDES". In experiment both give me the same result so I specify only algorithm as "TripleDES".

Now encrypt plaintext and get our cipher bytes by
String plaintxt="My SECRET WORD";
byte[] cipherbyte = cipher.doFinal(plaintxt.getBytes());

From cipher bytes. Our text is encrypted. To be easy to manage[send over internet or store in db] I will transform it with Base64[package from commons codec]
String encodeTxt = new String(Base64.encodeBase64(rawbyte));

Now decryption is just reverse the things we do for encryption, getBytes() from encodeTxt, decode with Base64 class, and doFinal() will give you decrypt text.
Note that for decryption, cipher object will init in DECRYPT_MODE.
nCipher.init( Cipher.DECRYPT_MODE, keySpec );
byte [] encData = Base64.decodeBase64(encodeTxt.getBytes());
decryptedtxt = nCipher.doFinal(encData);

6 comments:

tuonghuynh said...

Thanks. I will your tip for doing my homework.

Anonymous said...

thanks for the tip, well done

OrrendiNinnoli said...

Hi ! Many thanks for your post. It helped me to understand many things, but I still need some hints and maybe you could help me. How can I decrypt 3des/base64 data stored on a database ? I've two byte[] keys, an IV and the Key but I don't know how to use in my code...I'm really new to java and I'm using Netbeans to interface a simple form to database.
Do you have any tip, link, suggestion for me ? Thank you really much !

Michele

pnix said...

Hi OrrendiNinnoli, first sorry for late reply just too busy. i know not much about this too :( . Anyway [i think] to do your job, first you should understand about symmetric and asymmetric cryptography
http://en.wikipedia.org/wiki/Symmetric-key_algorithm
http://en.wikipedia.org/wiki/Public-key_cryptography

then see how to implement it in java
http://java.sun.com/javase/6/docs/technotes/guides/se
curity/certpath/CertPathProgGuide.html

Michele said...

Hi pnix ! Thanks for your reply, I'm going to read better JCE documentation and examples I found on the web. Maybe your piece of code could work if I change "String EncodeTxt" from your example pointing to a db string value...maybe, not sure, but I'm going to try ! Bye and thanks again !

Bajjuri said...

Hi!!

I am actully new java encryption and decryption, My requirement is like URL will have a parameter of base-64 encoded string using 3des encryption. How can i write a code in java to decrypt that to get my required values. They told me we will have a common key to encrypt and decrypt that parameter.

Please help me!!!