3

I have a web application and I am trying to send encrypted data into the database. The web application is in Java and database is in MySQL. My table fields are normal stuff like varchar for String, int for integer and so on.

I have to say I am new to Cryptography so I was looking for easy to implement API for now until I fully study cryptography. Then I came across Jasypt.

I tested this API and the good thing is it is converting binary to Base64 String. However I have the following questions.

  1. Does Jasypt support Authenticated Encryption? If so, for what algorithm?

  2. Jasypt last publish date is 25 Feb 2014. Does this mean its encryption methods are now "out dated" ? (I guess probably now)

  3. If we use a String encryption algorithm in Jasypt, is it sufficient enough to protect sensitive information like credit card numbers and health records? (I know no protection is "best" and will be "unbreakable" forever, that's why I used the word "sufficient enough")

3

You are probably best off just using the Java Cryptographic Extensions yourselves - as you say, Jasypt is fairly stale and is, itself, a wrapper around various JCE implementations.

OWASP (if you don't know OWASP, get to know them - awesome non-profit with tons of security advice) has a nice page on using JCE directly - check out the AES examples : https://www.owasp.org/index.php/Using_the_Java_Cryptographic_Extensions#AES_Encryption_and_Decryption

That is probably sufficient for what you are doing. AES-128 is considered secure short of quantum computing.

  • Still I can convert the output to String? Asking because I have seen some places where this conversion break lot of stuff – PeakGen Sep 12 '16 at 19:17
  • @PeakGen The sample code does a base64 conversion before/after encryption/decryption. That should help any issues that way. If you are using a non-default locale, you'll want to change the getBytes() and the new String() to provide an appropriate locale. – crovers Sep 12 '16 at 20:24
  • Thank you. Reading the article, I am not 100% sure whether it is using authenticated encryption (please note I am a beginner to this subject). Can you please confirm? – PeakGen Sep 13 '16 at 3:47
  • hello? Reading the article, I am not 100% sure whether it is using authenticated encryption (please note I am a beginner to this subject). Can you please confirm? – PeakGen Sep 14 '16 at 5:18
  • Sorry - you will want to add a HMAC on top of AES with JCE if you need authenticated encryption - en.wikipedia.org/wiki/Hash-based_message_authentication_code - SHA256 should be sufficient as the hash algorithm. Basically, you combine the message with the encryption key, hash that, append that to the message, re-verify the hash when decrypting to detect tampering. There are some subtleties, though - read the article. At this point, you may want to look at bouncycastle.org - they know what they are doing, but I find their documentation rough. Look for their sample code. – crovers Sep 14 '16 at 12:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.