Problem with encrypt and decrypt

[Charles Diskin]

Hello, I am having a problem getting my servlet to decrypt a password. here is what I have so far...

//Function to attempt decryption 

        private String Decrypt(byte[] password){

       char[] charArrayPassword = new char[128];
                       String sPassword = new String(password);
                       
       try{
                      
charArrayPassword = sPassword.toCharArray(); 

                        //Begin Crypto code 
javax.crypto.spec.PBEKeySpec pbeKeySpec;
javax.crypto.spec.PBEParameterSpec pbeParamSpec;
SecretKeyFactory keyFac;

// Create PBE parameter set
pbeParamSpec = new javax.crypto.spec.PBEParameterSpec(salt, count);

pbeKeySpec = new javax.crypto.spec.PBEKeySpec(charArrayPassword);

                        keyFac = SecretKeyFactory.getInstance(PBE_WITH_MD5_AND_DES);

                        SecretKey pbeKey = keyFac.generateSecret(pbeKeySpec);

// Create pbeCipher Cipher
Cipher pbeCipher = Cipher.getInstance(PBE_WITH_MD5_AND_DES);

// Initialize pbeCipher Cipher with key and parameters
pbeCipher.init(Cipher.DECRYPT_MODE, pbeKey, pbeParamSpec);

// Our cleartext
String cleartextString = new String(password);
byte[] cleartext = cleartextString.getBytes();

// Decrypt the cleartext
byte[] deciphertext = pbeCipher.doFinal(cleartext);
return new String(deciphertext); 
        
                       }// end try
catch(Exception e){
exceptionCatcher = e;     
}

The problem appears to be SecretKey,
it will run but it throws an exception in decrypt saying:

java.security.spec.InvalidKeySpecException: Password is not ASCII

Any help would be great, thanks in advance!

[ March 03, 2006: Message edited by: Charles Diskin ]
[Edit by Dave, code tags added]
[ March 03, 2006: Message edited by: David O'Meara ]

[Bear Bibeault]

Welcome to the Ranch.

A tip: few people are going to bother to read a large block of unformatted code. I'd suggest editing your post to restore the formatting by using the UBB code tags. The little CODE button under the entry area can help you out.

[Ben Souther]

I'm guessing that you'll have better luck with this one in the Security forum.
This one really isn't a servlet issue.

[Charles Diskin]

Thanks to the guys who moved my post to the right area and fixed up the code nice. I figured out this problem and now I'm having somet similar happen. the encrypted code is saved inside a microsoft access database column, when I try to pull it back out of the column and decrypt, it comes back as null, when there should be a value.

It works fine while just encrypting and decrypting but either something is going wrong while it's stored in the DB or it maybe it's a problem with the decryption function. If anyone has any ideas please post. PS: I can repost my decryption function code, I just wanted to know if anyone has had a similar problem before. This is the exception it throws:

javax.crypto.IllegalBlockSizeException: Input length must be multiple of 8 when decrypting with padded cipher

Any help, advice, etc; Thanks in advance!

[Charles Diskin]

    private String Decrypt(byte[] password){

//       int count = 1;
       char[] charArrayPassword = new char[128];
                    //   String sPassword = new String(password);
                       
       try{
                         
//char d = 
charArrayPassword = passPhrase.toCharArray(); 

                        //Begin Crypto code from <a href="http://java.sun.com/j2se/1.4.2/docs/guide/security/jce/JCERefGuide.html#PBEEx" target="_blank" rel="nofollow">http://java.sun.com/j2se/1.4.2/docs/guide/security/jce/JCERefGuide.html#PBEEx</a>
javax.crypto.spec.PBEKeySpec pbeKeySpec;
javax.crypto.spec.PBEParameterSpec pbeParamSpec;
SecretKeyFactory keyFac;

// Create PBE parameter set
pbeParamSpec = new javax.crypto.spec.PBEParameterSpec(salt, count);

System.out.flush();
        
pbeKeySpec = new javax.crypto.spec.PBEKeySpec(charArrayPassword);

                        keyFac = SecretKeyFactory.getInstance(PBE_WITH_MD5_AND_DES);

                        SecretKey pbeKey = keyFac.generateSecret(pbeKeySpec);

// Create pbeCipher Cipher
Cipher pbeCipher = Cipher.getInstance(PBE_WITH_MD5_AND_DES);

// Initialize pbeCipher Cipher with key and parameters
pbeCipher.init(Cipher.DECRYPT_MODE, pbeKey, pbeParamSpec);

                       
// Our cleartext
String cleartextString = new String(password);
byte[] cleartext = cleartextString.getBytes();
                        
// Decrypt the cleartext - [B]RIGHT HERE IS WHERE IT IS KICKING TO EXCEPTION[/B]
byte[] deciphertext = pbeCipher.doFinal(password);
//String dec = 
                       return new String(deciphertext);
            
                       }// end try
catch(Exception e){
exceptionCatcher = e;     
}
String s = "Not Working";
   return s; 
}

[Ulf Dittmer]

Is the data you get out of the DB the same data you stuffed into it? If it's not, then this is really a DB issue, not a security issue.

[Charles Diskin]

Thanks for the reply, we narrowed it down to a DB problem, encrypted number going into the database, and on return it is decrypted to a null. We were using an Access database and now we are going to create a whole new system in MySQL. Maybe I can try a Database board and see if they have a solution for the MS Access decrypt problem. Once again thanks for the feedback!

[Ulf Dittmer]

"a database board" ??? What are you talking about? We have a JDBC forum right here! Don't you dare go someplace else

[Charles Diskin]

Sorry didn't mean offense, that is in fact where I went. Don't know what I was thinking it was getting late at work yesterday when I posted that Thanks for the help