Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been looking into ways to encrypt an authentication token that I need to pass from one site to another. Things i have learned so far are

  • use a high level library.
  • don't use ECB
  • use a HMAC to provide message integrity.
  • encrypt then hash

So in my search for such a easy to use high level open source java library I bumped into jasypt. But i have been digging a bit through the code and it seems not to use any HMAC at all. So i'm wondering if i shouldn't use this library and which alternatives are adequate. I prefer a java-only solution ( no C bindings ).

share|improve this question

I would suggest Keyczar. This is a cryptography toolkit which once was developed by Google. It has Java, Python and C++ implementations. As far as I'm aware Keyczar was thoroughly tested. During that testing one timing attack was found and fixed. However this was the only case so far and I would consider it a fairly good bet.

The PDF file in chapter 8 provides some better information about HMAC. And if you look at the question »Should we MAC-then-encrypt or encrypt-then-MAC?« at crypto.SE you get a deeper answer to the Encrypt-then-MAC case.

share|improve this answer

I think bouncy castle would be an option that you can look into. I have personally used it and has lot of options.

share|improve this answer

I would recommend just using an authenticated encryption mode (e.g., GCM, EAX) instead of worrying about when you should compute your HMAC. BouncyCastle includes several options:

(You might not have any associated data in your case; that's OK.)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.