Decrypting a hardcoded file as byte[]

Question

Well this is actually a two-parter...

First I need to

1. read the contents of the file
2. crypt them into a byte[]
3. write the byte[] in a file or whatever...

Then the result from #2 or #3 will go into another project. I'm trying to protect our PEM/DER keys.

For decryption, I need to

1. read the contents of the crypted file as a byte[]
2. decrypt them into a byte[]
3. write the decrypted data to a file OR use it instead of a file

Now, I have some basic crypting code

        KeyGenerator keyGenerator = KeyGenerator.getInstance("AES");
    keyGenerator.init(128); // 192 and 256 bits may not be available

    SecretKey secretKey = keyGenerator.generateKey();

    Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");


    // By initializing the cipher in CBC mode, an "initialization vector" has been randomly
    // generated. This initialization vector will be necessary to decrypt the encrypted data.
    // It is safe to store the initialization vector in plain text for later use. You can obtain
    // it's bytes by calling iv.getIV().
    cipher.init(Cipher.ENCRYPT_MODE, secretKey);
    IvParameterSpec iv = cipher.getParameters().getParameterSpec(IvParameterSpec.class);
        //      IvParameterSpec iv = new IvParameterSpec(IV); //used for the hardcoded one

        byte[] encryptedData = cipher.doFinal(data);

and decrypting one as well

    cipher.init(Cipher.DECRYPT_MODE, secretKey, iv);
    byte[] decryptedData = cipher.doFinal(encryptedData);
    System.out.println("decrypted: " + new String(decryptedData));

and the question is:

Given a use-case scenario where one would rarely encrypt something and would distribute crypted keys that are to be decrypted at runtime, what do I need to save apart from the cyphertext?

I know I need to save the IV, but when I did decryption wasn't quite good - which leads me to believe that I need to save the secretKey as well.

Could anyone give me any tips, pointers or general security hints to a better solution? If I need to save the key, the IV and the encrypted data, where should I store them? Maybe hardcode the key and store the IV along the encrypted data? Maybe hardcode both the IV and the key and just store encrypted data in the files?

This isn't about theoretical safety, think of this as the biggest nuissance and inconvenience you can cause to someone that is trying to steal your keys. We all know there's no way I can perfectly hide them.

I pretty much need what this guy started with Decrypting an encrypted file and executing in Java

However if there's a better way of feeding secure data into a PemKeyReader, i'm all ears.

Answer 1

Sharing the key and encrypting something are two completely different things. How to share keys

Having said this, AES with 128bit is fairly strong encryption algorithm than 3DES So what you can do is keep PKI infrastructure in place to exchange AES keys and then Encrypt and Decrypt using them.

Why not RSA? RSA needs to be minimum 512 bit to consider it as strongest and if you increase more bits then it increases time required for encryption and decryption.

SO AES is fast and safe.

Use SecretKeySpec to create key from byte[]

public static void main(String[] args) throws Exception
{
    // Initialise secret key with predefined byte array [] like below. I
    // have used simple string to array method to generate 16 byte array.
    // AES Key must be minimum 16 bytes.
    // Now you can put this byte array some where is .SO file.
    // Generate new Key using this byte []
    // Then you can generate a key using device specific information at
    // first boot up.
    // Use second key to encrypt data and first key to encrypt the second
    // key
    // I Hope it clears all the doubts
    SecretKey key = new SecretKeySpec("ABCDEFGHIJKLMNOP".getBytes(), "AES");
    System.out.println(Arrays.toString(key.getEncoded()));
    // Initialise Cipher with AES Algorithm
    Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
    // Set The Encrypt Mode
    cipher.init(Cipher.ENCRYPT_MODE, key);
    // Encrypt some bytes
    byte[] encrypted = cipher.doFinal("ABCDEFGH".getBytes());
    // Print it to vefiry
    System.out.println(Arrays.toString(encrypted));

    // Get The IV
    byte[] iv = cipher.getIV();
    System.out.println(iv.length);
    // Now why storing you can create structure like [16 IV][Encrypted Data]
    // And while decrypting you can read first [16] bytes IV and then
    // decrypt remaining bytes

    //byte[] iv = new byte[16];
    // System.arraycopy(encrypted, 0, iv, 0, 16)
    //Copy remaining bytes to decrypt


    // set cipher to decrypt mode

    cipher.init(Cipher.DECRYPT_MODE, key,new IvParameterSpec(iv));

    // decrypt it
    byte[] decrypted = cipher.doFinal(encrypted);
    System.out.println(new String(decrypted));

}

Now write an algorithm which will generate byte[] from some random data like device name, user name, random seed etc.

You can add more protection to algorithm source code by writing that algorithm in C and create.SO file and get byte [] using Native calls.

What are the advantages of doing all this?

1. Event if your so is hacked it will need real time environment to run create key out of it.
2. Even if some one does crack it the damage will be limited i.e. 1 device
3. Hacker will have to repeat same with each device which is highly impossible to do.

Answer 2

The I/O aspect of your question is best addressed by reading the "Byte Streams" and "Buffered Streams" sections of the Oracle Java tutorial. You can accumulate the bytes in memory by writing them to a ByteArrayOutputStream, and then using the toByteArray() method to get the bytes as a byte[].