5

I am encryption and decryption using following code, while decryption I am getting a error while running. error message is 'Illegal base64 character 20'

Encryption code:

String secretValue = "sazhwsxplokmeroo";
keyValue = secretValue.getBytes();
Key generatedKey = generateKey();
Cipher c = Cipher.getInstance(ALGO);
c.init(Cipher.ENCRYPT_MODE, generatedKey);
byte[] encValue = c.doFinal(userEmail.getBytes());
String encryptedValue = Base64.getEncoder().encodeToString(encValue);

secretKey:

 private Key generateKey() {
     Key secretKey = new SecretKeySpec(keyValue, ALGO);
     return secretKey;
}

Decryption code:

String secretValue = "sazhwsxplokmeroo";
keyValue = secretValue.getBytes();
Key generatedKey = generateKey();
Cipher c = Cipher.getInstance(ALGO);
c.init(Cipher.DECRYPT_MODE, generatedKey);
byte[] decodedValue = Base64.getDecoder().decode(encryptEmail.getBytes()); //error throws from this line as illegal base64 character 20
byte[] decValue = c.doFinal(decodedValue);
String decryptedValue = decValue.toString();

how can I decrypt the encrypted value without error

encrypted value = 3aW0qv4pN+y3Tj8raXDHtos95ChpLu2JzEnfW+KfgEE=

this value appears in the spring controller as = 3aW0qv4pN y3Tj8raXDHtos95ChpLu2JzEnfW KfgEE=

it shows two spaces "+" get converted to "(space)"

Now I have changed my secret key as 'sa278asabmnbmnbm'

I am getting encrypt value as 40SRNEe9PgaxEeprPyqlyeP08hBHq00Ow9WWBgP6ZTM=

While decrypt I am getting [B@75141845 as decrypted Value

expected : shamith@alraislabs.in

Shamith S Kumar
  • 97
  • 1
  • 1
  • 7
  • What is value of `encryptEmail`? Does it by any chance have a space in it? – Andreas Mar 21 '17 at 03:23
  • yes, the "+" appears in the encrypted code get converted to space from spring controller – Shamith S Kumar Mar 21 '17 at 03:40
  • 1
    Because you forgot to URL Encode the Base64 string, so the `+` would have been `%2B`. – Andreas Mar 21 '17 at 03:45
  • any suggestion to resolve the issue/ – Shamith S Kumar Mar 21 '17 at 03:59
  • 4
    Yes, **URL Encode the Base64 string** *(I already told you that you forgot to do that)* before sending it to the web server, aka Spring controller. – Andreas Mar 21 '17 at 04:39
  • The other issue is that `decValue.toString()` should be `new String(decValue)`. But this can lead to wrong results, because you're not specifying the charset during encryption and decryption. It will use the platform default and it might be different during encryption and decryption. – Artjom B. Mar 21 '17 at 06:30
  • **Never use [ECB mode](http://crypto.stackexchange.com/q/14487/13022)**. It's deterministic and therefore not semantically secure. You should at the very least use a randomized mode like [CBC](http://crypto.stackexchange.com/q/22260/13022) or [CTR](http://crypto.stackexchange.com/a/2378/13022). It is better to authenticate your ciphertexts so that attacks like a [padding oracle attack](http://crypto.stackexchange.com/q/18185/13022) are not possible. This can be done with authenticated modes like GCM or EAX, or with an [encrypt-then-MAC](http://crypto.stackexchange.com/q/202/13022) scheme. – Artjom B. Mar 21 '17 at 06:30
  • Does this answer your question? [What's the simplest way to print a Java array?](https://stackoverflow.com/questions/409784/whats-the-simplest-way-to-print-a-java-array) – Karl Knechtel Mar 05 '23 at 02:09

0 Answers0