1

I have an encryption/decryption code similar to this question. The difference is that I'm just decrypting a key I have previously encrypted and store it as String in my Constants class.

It's working fine but today I just found out that the code dies with this error:

javax.crypto.BadPaddingException: pad block corrupted
at com.android.org.bouncycastle.jcajce.provider.symmetric.util.BaseBlockCipher.engineDoFinal(BaseBlockCipher.java:709)
at javax.crypto.Cipher.doFinal(Cipher.java:1111)

This error only occurs when using galaxy nexus Android 4.2.2. I have tested my code in other devices including tablets and other Android versions from 2.3 to 4.0.3. I have not tested this in other 4.2.2 devices since I only got this one device that has Android 4.2.2.

Does anyone has any idea how to fix this problem?

private static byte[] decrypt(byte[] raw, byte[] encrypted) throws Exception {
    SecretKeySpec skeySpec = new SecretKeySpec(raw, "AES");
    Cipher cipher = Cipher.getInstance("AES");
    cipher.init(Cipher.DECRYPT_MODE, skeySpec);
    byte[] decrypted = cipher.doFinal(encrypted);
    return decrypted;
}  

private static byte[] getRawKey(byte[] seed) throws Exception {
    KeyGenerator kgen = KeyGenerator.getInstance("AES");
    SecureRandom sr = SecureRandom.getInstance("SHA1PRNG");
    sr.setSeed(seed);
    kgen.init(KEY_SIZE, sr);
    SecretKey skey = kgen.generateKey();
    byte[] raw = skey.getEncoded();
    return raw;
}  

public static byte[] toByte(String hexString) {
    int len = hexString.length() / 2;
    byte[] result = new byte[len];

    for (int i = 0; i < len; i++) {
            result[i] = Integer.valueOf(hexString.substring(2 * i, 2 * i + 2), END_POSITION).byteValue();
    }

    return result;
}

public static void generateKey() {
    try {
        byte[] seed = SEED_STRING.getBytes("UTF-8");
        byte[] rawKey = getRawKey(seed);           
        byte[] toDecrypt = toByte(Constants.ENCRYPTED);

        mKey = new String(decrypt(rawKey, toDecrypt), "UTF-8");      

    } catch (Exception e) {
        if (BuildConfig.DEBUG) {
            Log.e(TAG, "encryption: ", e);
        }
    }   
}

Edit: I just found out that when I execute the key encryption on the problem device it generates a different key every time my application launch. Unlike the other devices I tested before that only generated the same key every time.

public static String toHex(byte[] buf) {
    if (buf == null)
            return "";
    StringBuffer result = new StringBuffer(2*buf.length);
    for (int i = 0; i < buf.length; i++) {
            appendHex(result, buf[i]);
    }
    return result.toString();
}

private static void appendHex(StringBuffer sb, byte b) {
    sb.append(HEX.charAt((b>>4)&0x0f)).append(HEX.charAt(b&0x0f));
}

private final static String HEX = "0123456789ABCDEF";

public static String encrypt(String seed, String cleartext) throws Exception {
    byte[] rawKey = getRawKey(seed.getBytes());
    byte[] result = encrypt(rawKey, cleartext.getBytes());
    return toHex(result);
}    

private static byte[] encrypt(byte[] raw, byte[] clear) throws Exception {
    SecretKeySpec skeySpec = new SecretKeySpec(raw, "AES");
        Cipher cipher = Cipher.getInstance("AES");
    cipher.init(Cipher.ENCRYPT_MODE, skeySpec);
    byte[] encrypted = cipher.doFinal(clear);
        return encrypted;
}

code source: http://www.androidsnippets.com/encryptdecrypt-strings

Community
  • 1
  • 1
Jace
  • 439
  • 1
  • 7
  • 19
  • That key generation doesn't look very secure... – Antimony Jul 09 '13 at 05:02
  • I'm still learning the ropes when it comes to security but the security requirement for this code is on the simple side. They only required me to not place the keys as is inside the constants file. – Jace Jul 09 '13 at 05:08
  • 1
    If it's seeded with a constant then it's just as broken as if the key were hardcoded. What are you trying to protect against? – Antimony Jul 09 '13 at 05:10
  • I see what you mean. I'll keep that in mind if I ever need to make this more secure. Thank you for your input :) – Jace Jul 09 '13 at 05:12
  • 1
    I had the same feedback from my colleague, a few minutes ago, when I asked him if he has any idea about this problem. This can be marked as duplicate to the other question. Thank you. – Jace Jul 09 '13 at 08:10
  • Please have your managers read this: http://blogs.msdn.com/b/ericlippert/archive/2011/09/27/keep-it-secret-keep-it-safe.aspx – ntoskrnl Jul 09 '13 at 19:48

0 Answers0