0

A company I work for wants to make a small utility to allow their employees to share information with each other. I need a simple AES library that allows the user to enter a message and password and spit out the encrypted text. When they copy and paste that into a standard messaging software like email or SMS, the user on the other end puts in the same password and the text is decrypted.

I've been able to find libraries that work on Javascript, but we also need one that works on Java. I was not able to get a library for Java that encrypted the same as the Javascript library. Meaning, I could not encrypt using the Java app and then decrypt using the Javascript app.

Are there any libraries that are secure and have a Javascript and Java cross code compatible AES encryption?

closed as off-topic by ThoriumBR, Steffen Ullrich, AndrolGenhald, DKNUCKLES, schroeder Aug 23 '18 at 13:19

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Steffen Ullrich, AndrolGenhald, DKNUCKLES, schroeder
If this question can be reworded to fit the rules in the help center, please edit the question.

  • So you are asking if there is one Libary/Code that works the same under the Javascript Engine inside the Browser and the Java Virtual Machine?. I ask because the JRE brings it owns implementation of AES. So you already have a "Libary" to make use of AES inside of Java. And because AES is a Standard, encryption and decryption is not bound to the Programming Language,Platform or hardware – Serverfrog Aug 22 '18 at 13:48
  • 1
    Those this is asking about security library , this is not a security question, perhaps more adequate to move to stackoverflow SE. – mootmoot Aug 22 '18 at 14:15
  • 4
    "... I was not able to get a library for Java that encrypted the same as the Javascript library..." - AES is standardized and different implementations should create the same output for the same input. My guess is that you instead used the implementations in the wrong way. But since you did not show any code I cannot say what you did wrong. I recommend to ask again at stackoverflow, but this time show the actual code you were using so that others can point out what you did wrong. – Steffen Ullrich Aug 22 '18 at 15:18
1

As long as you are performing encryption/decryption using the same cipher, mode, IV, and other parameters (which can depend on the mode, e.g., padding, associated data, tag-length) then any two libraries should be compatible.

You should test both the JavaScript and the Java libraries on known test-vectors to confirm both are working properly and to confirm that you know that all parameters are set correctly.

Here is a specific example of two crypto libraries that should be mutually consistent: The Stanford Javascript Crypto Library (https://crypto.stanford.edu/sjcl/) and the BouncyCastle Java library (https://www.bouncycastle.org/java.html).

I checked that the above libraries give consistent results for AES in CCM mode.


Update:

Below is an example of a test vector you could try. For this test I used the AES cipher and the CCM mode. I also used a "tag length" parameter of 64 bits and I used no "associated data."

Using the key:

b058d2931f46abb2a6062abcddf61d75

Using the Initialization Vector:

ed77b0e43daccec06c41f472

The plain text:

849c27d7333fe9fb769725b0f29a6b0d977e504976d709b8b6ef542e455504a20243e9ff2ea72da8ab709f983f85349f0ccb63a3c3d70225b8c06305592487193b8599c4aeeecc513d9f71bce28fa0f3a9ba5b310fed302a360b73e7a546793f1dd7b17c1dfcb6348c1f2dfe86dab6

Encrypts to the cipher text:

9f14fa396445bf0e206b123e090edf1c41c6ee6b85ec9963721075b9261006b83a68c3179e2824d45ad4a10e0cd44a66b9c4c12c57424a2dff701eac89d968a64b3b221864a163cc9425ee687bdb283c0b9931b5abde531a6e43737ddea7f715779a8ec15ff06808eb54f0e538c5ef4b4f224418c69b9b

Not the answer you're looking for? Browse other questions tagged or ask your own question.