ByteArrayOuputStream to String conversion problems.

[christian leclerc]

Hello guy's,

I've got a problems of conversion that Im pretty sure it is a problems of encoding but I wonder if somebody can help me with that !
Well .. the situation is that Iv'e got an crypted data that I dont know what kind of encoding its used to create my ByteArrayOutputStream.
So I've got an ByteArrayOutputStream that I want to put as string and store it in the database, after I want to get the object back from the database, and decrypt the data for the user.
Its encoded with an X509Certificate.

When I want to decrypt my data I have a problems of padding because the bytes when converting -127,-99,-112,-113 and -115 to String they are flipped to byte 63 and the encryption algorythm is scrapped.

So ... Im able to reproduce the problem with a simple example :

 public static void main (String[] args)
    {
        byte[] array = new byte[]{-127,-99,-112,-113,-115};
        byte[] toCompare = new String(array).getBytes();
        for(int i=0;i<array.length;i++)
        {   
            if(array[i] != toCompare[i])
            {
                System.out.println(array[i]+" -> "+toCompare[i]);
            }
        }
    }

result :

-127 -> 63
-99 -> 63
-112 -> 63
-113 -> 63
-115 -> 63

As I said, im pretty sure that its an encoding thing but I can't be able to found how to make the bytes equals.

If anybody can help me, it will be nice because im stock here !

Thanks,

Chris.

[Jeff Verdegan]

You can't create a String out of any old arbitrary bytes. And I'm not sure why you want a String in the first place. If you really need one, try base64 encoding the bytes.

[christian leclerc]

Hello Jeff.
First I want to thank you for taking the time to reply at my post.

Well the context is :

I crypt something and receive a ByteArrayOuputStream.

I take this ByteArrayOuputStream, put it to String, convert that String in base64 and put it in the database. (for the transfert between web & ejb, its better if its base64 encoded ny ways)
Receive the string from the database, base64 decode it and after I want to decrypt the value.


When i want to decrypt the value, its where I've got the problems.

I will try to put the ByteArrayOuputStream to base64 and after put it to a String then maybe it will solve my problem.

[Paul Clapham]

Why do you insist on a String? Your data is completely unsuitable for a String. Just put the array of bytes into the database as is and forget about the Strings.

Hint: look at the setBytes() method of PreparedStatement.

[Jeff Verdegan]

christian leclerc wrote:
I take this ByteArrayOuputStream, put it to String, convert that String in base64

As Paul and I have said: Don't put it into a String.

Additionally, if for some reason you absolutely have to put it into a String, then base64 encode the original byte array. That will give you a String.

[christian leclerc]

OK I will try to put it directly as byte.
Thanks guys !

[christian leclerc]

It works with this method :

Encode + Crypt + Encode

byte[] base64Encoded = base64Encode(aDecryptedValue);
byte[] cryptedData = cryptX500(base64Encoded, aProperties);
byte[] cryptedBase64Encoded = base64Encode(cryptedData);
return new String(cryptedBase64Encoded);

Decode + Decrypt + Decode.

byte[] base64Decoded = base64Decode(aCryptedValue.getBytes());
byte[] decrypted = decryptX500(base64Decoded, aProperties);
byte[] decryptedAndDecoded = base64Decode(decrypted);
return decryptedAndDecoded;

Thanks guy's for the hint, here I needed an String absolutely so ... with base64 first, crypt and base64 again .. its ok for storing and for transporting.
Not the best way to do it for performance tough but it should do the job's.

Cheers,

[Paul Clapham]

So you were stuck with a database column which expected text? Go over and pour a can of soda on that DBA's head.

But really I wouldn't worry about the performance hit from converting the bytes to base-64. The time to do that is trivial compared to the time to send the converted bytes over the network and write them into the database.

[Jeff Verdegan]

christian leclerc wrote:It works with this method :

Encode + Crypt + Encode

Why not just encrypt the original bytes and then base-64 encode the results? Why encode first? Are you using come crypto library that can only handle Strings?

[christian leclerc]

Hello Jeff,
The data that I crypt is some information that is already crypted for a user ( but with symetric key ) , I want to be shure that nobody will be able to bruteforce this data by retreive it from the database.
I crypt the data with the application certificate to mitigate that risk so if the database is accessed via someone the data wont be able to decrypt .. Its security issue.

Maybe im a little parano with this but ... well ... nobody will access my data directly hehe ;)