AES String Encryption/Decryption

Question

I'm new to Encryptions. I'm finding codes about encryption and i'm trying to know how it is working because it's interesting and I like to code it in the future.

Then I found this code:

  System.out.print("Enter text: ");
      String text = dataIn.readLine();
      String key = "Bar12345Bar12345"; // 128 bit key

       // Create key and cipher
     Key aesKey = new SecretKeySpec(key.getBytes(), "AES");
     Cipher cipher = Cipher.getInstance("AES");
 ...

Before I start working on it. I don't know how String = Bar12345Bar12345 works. It says that it is 128 bit key. Is the String constant? Is it okay to change it?

The string is 18 ASCII characters long, so the bit length is 18*8 bit = 128 bit. It's the secret key to encrypt/decrypt, so you should keep it secret. — SubOptimal
– SubOptimal, Commented Jan 19, 2015 at 11:49
This is only simple example - you should use some hash function to generate key from password (not key.getBytes()). The hash will give you the key with correct length. — Quark
– Quark, Commented Jan 19, 2015 at 11:54
What do you mean by hash function? Sorry i'm beginner in Encryption. — Yodism
– Yodism, Commented Jan 19, 2015 at 11:56

Artjom B. · Accepted Answer · 2015-01-19 13:12:00Z

3

To be precise, the string is not your key, but the bytes you get from key.getBytes(). While it may work for this sample, this is not something you should do in production code:

getBytes() may convert the string to different bytes if a different charset is used (unlikely for your specifc string, since it is ASCII only, but something you have to be aware of).
You need a string of correct length.
The quality of the generated key will be quite poor. For production code you should use a key derivation function like pbkdf2 to derive a key from something like a password.

There is another issue: Instead of just using "AES" you should also specify the mode of operation and padding when constructing your Cipher object (e.g. "AES/CBC/PKCS5Padding"). Otherwise the second and third parameter are provider dependent.

edited Jan 19, 2015 at 13:12

Artjom B.

62k26 gold badges137 silver badges236 bronze badges

answered Jan 19, 2015 at 11:54

Drunix

3,3438 gold badges31 silver badges50 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

AES String Encryption/Decryption

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related