Using HMac Sha256 for Message Authentication (MAC) in Java

Secure message authentication using a MAC generated from a secret key with a password.

“There is some good in this world, and it’s worth fighting for.” ― J.R.R. Tolkien, The Two Towers

1. Introduction

A Message Authentication Code or a MAC provides a way to guarantee that a message (a byte array) has not been modified in transit. It is similar to a message digest to calculate a hash, but uses a secret key so that only a person with the secret key can verify the authenticity of the message.

Continue reading “Using HMac Sha256 for Message Authentication (MAC) in Java”

AES Encryption and Decryption Using a Password in Java

Encrypt a file using a password with strong AES security.

“My tastes are simple: I am easily satisfied with the best.”
― Winston S. Churchill

1. Introduction

In a previous article, we have explained how to use AES for encryption and decryption. After encryption, the AES key will need to be communicated to the receiver via a secure channel for decrypting the file.

Continue reading “AES Encryption and Decryption Using a Password in Java”

Encrypt and Sign a File Using RSA in Java

Securely exchange a file with another person using RSA for encryption and digital signature to ensure authentication.

“To acquire knowledge, one must study;
but to acquire wisdom, one must observe.”
― Marilyn Vos Savant

1. Introduction

We have previously covered using RSA for file encryption in java. We have also covered in a separate article the process of generating a digital signature for a file and verification using RSA. Let us now combine the two and develop a procedure for encrypting a file and generating a digital signature for exchange between two parties.

Continue reading “Encrypt and Sign a File Using RSA in Java”

Using AES With RSA for File Encryption and Decryption in Java

AES can be used for encrypting the file and RSA for encrypting the AES key.

“The secret of education lies in respecting the pupil.”
― Ralph Waldo Emerson

1. Introduction

In the previous part of this article, we covered the use of RSA for file encryption and decryption in java. Using RSA directly for file encryption will not work since it can only be used with small buffer sizes. In our particular case, with an RSA key size of 2048 bits, we ran into a limitation of a maximum of 245 bytes for the data size.

Continue reading “Using AES With RSA for File Encryption and Decryption in Java”

File Encryption and Decryption using RSA in Java

Use RSA for File Encryption and Decryption in Java

“If you can’t do anything about it, laugh like hell.”
― David Cook

1. Introduction

RSA (Rivest–Shamir–Adleman) is an asymmetric encryption algorithm widely used in public-key cryptography today. The word asymmetric denotes the use of a pair of keys for encryption – a public key and a private key. When data is encrypted by one key, it can only be decrypted using the other key. The public key is publicized and the private key is kept secret.

Continue reading “File Encryption and Decryption using RSA in Java”

How to Use AES for Encryption and Decryption in Java

Learn how to use AES for encryption and decryption in Java

“There’s as many atoms in a single molecule of your DNA as there are stars in the typical galaxy. We are, each of us, a little universe.” ― Neil deGrasse Tyson, Cosmos

1. Introduction

The Advanced Encryption Standard (AES) is a standard for encryption and decryption that has been approved by the U.S. NIST (National Institute of Standards and Technology) in 2001. It is more secure than the previous encryption standard DES (Data Encryption Standard) and 3DES (Triple-DES). You should be using AES for all symmetric encryption needs in preference to DES and 3DES (which are now deprecated).

Continue reading “How to Use AES for Encryption and Decryption in Java”

Java Math.random Examples

Math.Random

1. Introduction

Let us learn how to generate some random numbers in Java. Random numbers are needed for various purposes; maybe you want to generate a password or a session identifier. Whatever the purpose may be, there are a number of issues to be aware of when generating a random number.

Continue reading “Java Math.random Examples”

How to Generate RSA Keys in Java

Learn how to generate RSA keys and digitally sign files in java.

1. Introduction

Let us learn the basics of generating and using RSA keys in Java.

Java provides classes for the generation of RSA public and private key pairs with the package java.security. You can use RSA keys pairs in public key cryptography.

Public key cryptography uses a pair of keys for encryption. Distribute the public key to whoever needs it but safely secure the private key.

Public key cryptography can be used in two modes:

Encryption: Only the private key can decrypt the data encrypted with the public key.

Authentication: Data encrypted with the private key can only be decrypted with the public key thus proving who the data came from.

2. Generating a Key Pair

First step in creating an RSA Key Pair is to create a KeyPairGenerator from a factory method by specifying the algorithm (“RSA” in this instance):

KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA");

Initialize the KeyPairGenerator with the key size. Use a key size of 1024 or 2048. Currently recommended key size for SSL certificates used in e-commerce is 2048 so that is what we use here.

kpg.initialize(2048);
KeyPair kp = kpg.generateKeyPair();

From the KeyPair object, get the public key using getPublic() and the private key using getPrivate().

Key pub = kp.getPublic();
Key pvt = kp.getPrivate();

3. Saving the Keys in Binary Format

Save the keys to hard disk once they are obtained. This allows re-using the keys for encryption, decryption and authentication.

String outFile = ...;
out = new FileOutputStream(outFile + ".key");
out.write(pvt.getEncoded());
out.close();

out = new FileOutputStream(outFile + ".pub");
out.write(pvt.getEncoded());
out.close();

What is the format of the saved files? The key information is encoded in different formats for different types of keys. Here is how you can find what format the key was saved in. On my machine, the private key was saved in PKCS#8 format and the public key in X.509 format. We need this information below to load the keys.

System.err.println("Private key format: " + pvt.getFormat());
// prints "Private key format: PKCS#8" on my machine

System.err.println("Public key format: " + pub.getFormat());
// prints "Public key format: X.509" on my machine

3.1. Load Private Key from File

After saving the private key to a file (or a database), you might need to load it at a later time. You can do that using the following code. Note that you need to know what format the data was saved in: PKCS#8 in our case.

/* Read all bytes from the private key file */
Path path = Paths.get(keyFile);
byte[] bytes = Files.readAllBytes(path);

/* Generate private key. */
PKCS8EncodedKeySpec ks = new PKCS8EncodedKeySpec(bytes);
KeyFactory kf = KeyFactory.getInstance("RSA");
PrivateKey pvt = kf.generatePrivate(ks);

3.2 Load Public Key from File

Load the public key from a file as follows. The public key has been saved in X.509 format so we use the X509EncodedKeySpec class to convert it.

/* Read all the public key bytes */
Path path = Paths.get(keyFile);
byte[] bytes = Files.readAllBytes(path);

/* Generate public key. */
X509EncodedKeySpec ks = new X509EncodedKeySpec(bytes);
KeyFactory kf = KeyFactory.getInstance("RSA");
PublicKey pub = kf.generatePublic(ks);

4. Use Base64 for Saving Keys as Text

Save the keys in text format by encoding the data in Base64. Java 8 provides a Base64 class which can be used for the purpose. Save the private key with a comment as follows:

Base64.Encoder encoder = Base64.getEncoder();

String outFile = ...;
Writer out = new FileWriter(outFile + ".key");
out.write("-----BEGIN RSA PRIVATE KEY-----\n");
out.write(encoder.encodeToString(pvt.getEncoded()));
out.write("\n-----END RSA PRIVATE KEY-----\n");
out.close();

And the public key too (with a comment):

out = new FileWriter(outFile + ".pub");
out.write("-----BEGIN RSA PUBLIC KEY-----\n");
out.write(encoder.encodeToString(kp.getPublic()));
out.write("\n-----END RSA PUBLIC KEY-----\n");
out.close();

5. Generating a Digital Signature

As mentioned above, one of the purposes of public key cryptography is digital signature i.e. you generate a digital signature from a file contents, sign it with your private key and send the signature along with the file. The recipient can then use your public key to verify that the signature matches the file contents.

Here is how you can do it. Use the signature algorithm “SHA256withRSA” which is guaranteed to be supported on all JVMs. Use the private key (either generated or load from file as shown above) to initialize the Signature object for signing. It is then updated with contents from the data file and the signature is generated and written to the output file. This output file contains the digital signature and must be sent to the recipient for verification.

Signature sign = Signature.getInstance("SHA256withRSA");
sign.initSign(pvt);

InputStream in = null;
try {
    in = new FileInputStream(dataFile);
    byte[] buf = new byte[2048];
    int len;
    while ((len = in.read(buf)) != -1) {
    sign.update(buf, 0, len);
    }
} finally {
    if ( in != null ) in.close();
}

OutputStream out = null;
try {
    out = new FileOutputStream(signFile);
    byte[] signature = sign.sign();
    out.write(signature);
} finally {
    if ( out != null ) out.close();
}

6. Verifying the Digital Signature

The recipient uses the digital signature sent with a data file to verify that the data file has not been tampered with. It requires access to the sender’s public key and can be loaded from a file if necessary as presented above.

The code below updates the Signature object with data from the data file. It then loads the signature from file and uses Signature.verify() to check if the signature is valid.

Signature sign = Signature.getInstance("SHA256withRSA");
sign.initVerify(pub);

InputStream in = null;
try {
    in = new FileInputStream(dataFile);
    byte[] buf = new byte[2048];
    int len;
    while ((len = in.read(buf)) != -1) {
    sign.update(buf, 0, len);
    }
} finally {
    if ( in != null ) in.close();
}

/* Read the signature bytes from file */
path = Paths.get(signFile);
bytes = Files.readAllBytes(path);
System.out.println(dataFile + ": Signature " +
   (sign.verify(bytes) ? "OK" : "Not OK"));

And that in a nutshell is how you can use RSA public and private keys for digital signature and verification.

Source Code

Go here for the source code.