I've been looking into ways to encrypt an authentication token that I need to pass from one site to another. Things i have learned so far are
- use a high level library.
- don't use ECB
- use a HMAC to provide message integrity.
- encrypt then hash
So in my search for such a easy to use high level open source java library I bumped into jasypt. But i have been digging a bit through the code and it seems not to use any HMAC at all. So i'm wondering if i shouldn't use this library and which alternatives are adequate. I prefer a java-only solution ( no C bindings ).