0

For my own understanding of Websphere LTPA keys, I'm running this Java code, which works correctly when using the author's Base64 encoded, SHA1 hashed password:

String ltpa3DESKey = "IpGJOdpSxV3J8yWAuB+UiUlYCK7sAzSfENE5MLT2q+s=";

but fails when using mine:

String ltpa3DESKey = "ExGKSrGQPGN+q0GE1GlFhK7BB8bLB0mEp9ec1Vzxv8A\=";

Error:

Invalid escape sequence (valid ones are  \b  \t  \n  \f  \r  \"  \'  \\ )

But if I escape it:

String ltpa3DESKey = "ExGKSrGQPGN+q0GE1GlFhK7BB8bLB0mEp9ec1Vzxv8A\=";

I get:

 javax.crypto.BadPaddingException: Given final block not properly padded
    at com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java:991)
    at com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java:847)
    at com.sun.crypto.provider.DESedeCipher.engineDoFinal(DESedeCipher.java:294)
    at javax.crypto.Cipher.doFinal(Cipher.java:2165)
    at com.me.ltpa.LtpaToken.decrypt(LtpaToken.java:79)
    at com.me.ltpa.LtpaToken.getSecretKey(LtpaToken.java:62)
    at com.me.ltpa.LtpaToken.decryptLtpaToken(LtpaToken.java:110)
    at com.me.ltpa.LtpaToken.getInstance(LtpaToken.java:118)
    at com.me.ltpa.LtpaToken.main(LtpaToken.java:139)

I've read the basics of the Base64 Wikipedia article, but apparently backslashes aren't part of the Base64 alphabet. Any thoughts on how to proceed?

  • The tool you used to base64 encode the key should not have generated a backslash. Re-encode the key with a better encoder. (see CyberChef for a good all purpose encoding tool.) – John Deters Nov 21 '17 at 19:47
1

There are different variants of base64 encoding; while none I know of should produce a \, you might be better off just to use a URL-compatible version (which is done in java like the first google hit says).

Obiter Dictum:

  • There is usually no good reason to use 3DES and not AES. 3DES has long been deprecated.
  • Sha1 is not a good key derivation function, please use one that is designed for this purpose, like PBKDF2.
  • I never finished this project, but the code I'm testing is old and corresponds to when 3DES was the industry standard, so I'm moving on. Thank you! – mellow-yellow Nov 22 '17 at 3:30
0

Guess Java tries to identify the \ as an commandin the String, like e.g. \n. There's no command like \=, so that's why the exception appears. I would recommand you to put some // instead of \ , otherwise you might not use the \ for your strings.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.