-1

I've recently been trying to make an application that allows you to encrypt and decrypt a text file, but that you can also transfer the keys and text files around. It's only really to further my somewhat limited Java Knowledge, but I cannont for the life of me find any good guides or tutorials.

All I want to do is, Generate an encryption key, Load a texfile, Encrypt the file with the key, Save the key to a seperate file, Email the file and Key to another machine, Load the key, Load the textfile, Decrypt the textfile.

Does this really require the use of Private and Public keys and the like?? I'm not worried about its security, its just an experiment, any help, pointers?

RyanSoper
  • 221
  • 3
  • 4
  • 16
  • What you are trying to do is to learn crypto bottom up. That's not how you should start. You are setting yourself a trap: cryptography is a solution for specific security problems. First read up on security (e.g. the books of Bruce Schneier, or more entry level books) then experiment with cryptography. If you don't do this, you will try to solve everything with crypto, and worse, you will be doing it incorrectly. *Key management* is hard. – Maarten Bodewes May 22 '12 at 22:51

3 Answers3

3

No you don't need to use Private/Public keys, this would by asymmetric cryptography. What i guess you are trying to do is symmetric cryptography, which means that the same key is used for encryption and decryption.

Because of how your question is written, i suspect that you don't have a lot of knowledge regarding cryptography, in which case it may be better, that you do some reading before starting any kind of implementation (e.g. wikipedia articles about Symmetric/Asymmetric cryptography, stream cyphers, block cyphers and the like).

Regarding the implementation, you have to chose an encryption algorithm. I would propose you use AES for example, because it is frequently recommended by people who know what they are talking about (e.g. in the book "Practical Cryptography" which would be also a good read, if you are interested in more details!). If you want to do it this way, there are many examples available online, or just look at quesiton on SO like this one.

Community
  • 1
  • 1
NoUsername
  • 693
  • 6
  • 20
  • Very Very Limited Knowledge, you're correct, i shall do a little reading. Symmetric crypto is exactly what i want to do, is AES the best way to go with that then? – RyanSoper May 22 '12 at 10:20
  • well, "best" is hard to define in these kinds of areas (cryptography), it is the "Andvanced Encryption Standard" so it is widely used and it was chosen in a sort of contest by some of the brightest minds in this field, so it is definitely a fair choice. There is however always a balancing of speed/security/resource requirements, so if you have any particular use case in mind (e.g. extremely fast, security is more of a gimmick) other algorithms may be better. In terms of available example code, i would say you can't go wrong with AES. – NoUsername May 22 '12 at 10:27
1

Public-Key cryptography is currently considered savest. This because here you don't have to transmit a "shared seceret" over a secure channel. People are only able to encrypt data with the public key, but would need the private key to decrypt it. See the Wikipedia page on Public-Key-Cryptography for further imformation.

The easier handling of keys comes with the cost of encryption itself. In general public-key algorithms have a performance disadvantage when compared to symetric approaches.

If you want to avoid public-key cryptography, you can use symetric algroithms like, e.g., AES.

A quick google search showed this link, which should help you get started:

Sirko
  • 72,589
  • 19
  • 149
  • 183
0

Keep in mind one thing when evaluating cryptography APIs: they are designed with security as the top concern (obviously :). That means that they take special care about every byte, anywhere, of sensitive information that gets written. That includes both the password and the plaintext. For example, if a framework accepts a String password, that violates security as the Strincg is then out of control, lying around on the heap. If it accepts a char array, the client can zero out the array after use. Many other examples stemming from the same principle will be encountered in these APIs.

Marko Topolnik
  • 195,646
  • 29
  • 319
  • 436