2

I want to create a encrypted property file that stores information related to licences and some other highly sensitive data.
My Requirement during creation of encrypted Property file

  1. Once created, should not be re-writable.
  2. Once created nobody should be able to read the encrypted data.


After Creation, how I would be able to use the file in my project?

skaffman
  • 398,947
  • 96
  • 818
  • 769
Ashish Agarwal
  • 6,215
  • 12
  • 58
  • 91
  • 1
    When you write: Once created nobody should be able to read the encrypted data. What do you mean exactly? Should be the file encrypted with a key known to someone? Or you just want to do a one way encryption (hashing?). – Luciano Fiandesio Feb 22 '11 at 14:05
  • @Luciano: Yes Exactly the same. One person will be holding a private key. – Ashish Agarwal Feb 23 '11 at 04:52

5 Answers5

3

You can use the javax.crypto.Cipher[Input|Output]Stream for reading/writing your data; however, you will have to enforce the write-once functionality in your code... maybe be comparing the data with a SHA hash or something to ensure that it has not been changed.

I have run across opensource and commercial license managers for Java... you may want to search around so as not to reinvent the wheel.

Also, you will probably want to look into obfuscation tools at least for your sensitive API if you want to keep users from decompiling it.

Hope this helps.

cjstehno
  • 13,468
  • 4
  • 44
  • 56
2

Try: Jasypt library if it covers your usage scenario.

It provides an EncryptableProperties class for transparently managing and decrypting encrypted values in .properties file. It is also possible to integrate it into the configuration system of the Spring Framework.

Ozair Kafray
  • 13,351
  • 8
  • 59
  • 84
1

See the answer to this other question:

Securing a password in a properties file

There, it was recommended the use of jasypt.

Community
  • 1
  • 1
Christian Vielma
  • 15,263
  • 12
  • 53
  • 60
1

Standard encryption in Java is pretty straight forward. I suggest checking out the reference guide for instructions on how to use the javax.crypto package. However I would urge you to reconsider your design if it requires sensitive data, stored on client machines, that you don't trust the users with. The reason I say that is in order for you program to access the information, it would need to have the encryption/decryption key stored internally which would mean that the key would be stored in the archive somewhere. In the best case, it'd be stored as a variable in one of the class files. Examining the binary classfile to determine this key would be trivial. At the very least you should consider obfuscating your encryption code to at least make it slightly more difficult to identify the key simply from examining the binary code or decompiling the class file.

Chris Thompson
  • 35,167
  • 12
  • 80
  • 109
0

A Properties files is a human readable way to store a Map. If you don't want it to be be human readable, it doesn need to be a properties file.

One way to have a proeprties file with encrypted data is to encrypt the values of particular fields and use base 64 to turn them into text.

Peter Lawrey
  • 525,659
  • 79
  • 751
  • 1,130