verify values from the console with the encrypted values saved in the systems file

Question

Since yesterday when I posted the frist time I learned a lot. So what I am trying to do now is to implement user console input instead of the given values, written in bold, encrypt, save them in the file and then keep verifying next user input with the encrypted values saved in the file until correct or up to 10 times.

 String openPwd = "my password is datasecurity";
 String openUser = "a user is ME";

The first question is: can I implement second user input and verification in the same main method of the class?

Moreover I encrypt values with two way encryption AES (Now I know that is not the safest way to encrypt) and one way encryption with hash and salt would be the safest option due to the number of reasons. Also I save password and key in the system file, since setting up database would be too time consuming for the task.

The second question is: can I use PBKDF2 and salt instead of encryption with AES if I do not save password and user name in dbms, but in system file instead? How will verification process in encryption case and PBKDF2 with salt differ?

public class PasswordEncryption {

    public static final String AES = "AES";

    public static String encrypt(String value, File keyFile)
            throws GeneralSecurityException, IOException {
        if (!keyFile.exists()) {
            KeyGenerator keyGen = KeyGenerator
                    .getInstance(PasswordEncryption.AES);

            keyGen.init(128);
            SecretKey sk = keyGen.generateKey();
            FileWriter fw = new FileWriter(keyFile);
            fw.write(byteArrayToHexString(sk.getEncoded()));
            fw.flush();
            fw.close();
        }

        SecretKeySpec sks = getSecretKeySpec(keyFile);
        Cipher cipher = Cipher.getInstance(PasswordEncryption.AES);
        cipher.init(Cipher.ENCRYPT_MODE, sks, cipher.getParameters());
        byte[] encrypted = cipher.doFinal(value.getBytes());
        return byteArrayToHexString(encrypted);
    }

    public static String decrypt(String message, File keyFile)
            throws GeneralSecurityException, IOException {
        SecretKeySpec sks = getSecretKeySpec(keyFile);
        Cipher cipher = Cipher.getInstance(PasswordEncryption.AES);
        cipher.init(Cipher.DECRYPT_MODE, sks);
        byte[] decrypted = cipher.doFinal(hexStringToByteArray(message));
        return new String(decrypted);
    }

    private static SecretKeySpec getSecretKeySpec(File keyFile)
            throws NoSuchAlgorithmException, IOException {
        byte[] key = readKeyFile(keyFile);
        SecretKeySpec sks = new SecretKeySpec(key, PasswordEncryption.AES);
        return sks;
    }

    private static byte[] readKeyFile(File keyFile)
            throws FileNotFoundException {
        @SuppressWarnings("resource")
        Scanner scanner = new Scanner(keyFile).useDelimiter("\\Z");
        String keyValue = scanner.next();
        scanner.close();
        return hexStringToByteArray(keyValue);
    }

    private static String byteArrayToHexString(byte[] b) {
        StringBuffer sb = new StringBuffer(b.length * 2);
        for (int i = 0; i < b.length; i++) {
            int v = b[i] & 0xff;
            if (v < 16) {
                sb.append('0');
            }
            sb.append(Integer.toHexString(v));
        }
        return sb.toString().toUpperCase();
    }

    private static byte[] hexStringToByteArray(String s) {
        byte[] b = new byte[s.length() / 2];
        for (int i = 0; i < b.length; i++) {
            int index = i * 2;
            int v = Integer.parseInt(s.substring(index, index + 2), 16);
            b[i] = (byte) v;
        }
        return b;
    }

    public static void main(String[] args) throws Exception {
        final String KEY_FILE = "/Users/xxx/key";
        final String PASSWORD_FILE = "/Users/xxx/properties";

        String openPwd = "my password is datasecurity";
        String openUser = "a user is ME";

        Properties p1 = new Properties();

        String encryptedPwd = PasswordEncryption.encrypt(openPwd, new File(
                KEY_FILE));
        String encryptedUser = PasswordEncryption.encrypt(openUser, new File(
                KEY_FILE));
        p1.put("password",encryptedPwd);
        p1.put("user",encryptedUser);
        p1.store(new FileWriter(PASSWORD_FILE),"");

        // ==================
        Properties p2 = new Properties();

        p2.load(new FileReader(PASSWORD_FILE));
        encryptedPwd = p2.getProperty("password");
        encryptedUser = p2.getProperty("user");
        System.out.println(encryptedPwd);
        System.out.println(encryptedUser);
        System.out.println(PasswordEncryption.decrypt(encryptedPwd, new File(
                KEY_FILE)));
        System.out.println(PasswordEncryption.decrypt(encryptedUser, new File(
                KEY_FILE)));
    }
}

Answer 1

There are two simple ways of doing this. The first would be to create a static class level variable in your first class that contains the value of the encryptedPwd. To make a class level variable you would define it like this:

public class FirstClass {

    public static String encryptedPwd = "";

    public static void main(String[] args){
        ...
        FirstClass.encryptedPwd = encryptedPwd; //Set the class level variable equal to the encrypted password
        ...
    }

}

Then you could access it from your Authenticate class using:

if (FirstClass.encryptedPwd.equals(inputHash)) //Getting the password variable in Authenticate class

or you could create a static method to access it as well which would allow you to keep the variable private.

public static String getPassword(){ //Static Method inside your first class that returns the encrypted password
    return encryptedPwd;
}

if(FirstClass.getPassword().equals(inputHash)) //Method call in Authenticate class

There are other options too, but it depends on what your doing and the design you want for your project