StandardPBEStringEncryptor encryptor = new StandardPBEStringEncryptor();
encryptor.setPassword("jasypt");                        // we HAVE TO set a password
encryptor.setAlgorithm("PBEWithHMACSHA512AndAES_256");  // optionally set the algorithm
encryptor.setIvGenerator(new RandomIvGenerator());      // for PBE-AES-based algorithms, the IV generator is MANDATORY
String encryptedText = encryptor.encrypt(myText);
String plainText = encryptor.decrypt(encryptedText);  // myText.equals(plainText)

I intend to use Jasypt PBE for text encryption and decryption and based on the above code snippet I will be storing the key that is used in encryptor.setPassword("jasypt") as an environment variable or properties.

So, my concern here is, will it be ok to store this key as plaintext or it needs to be Base64 encoded or encrypted because if we talk about encryption then again there will be another key which will be used to encrypt the key.

Jasypt Reference

  • What problem are you trying to solve (what is your use case)? For some situations, there's nowhere you can safely store the key so encryption is, at best, a speed bump. In other situations, you never store the key at all; it's entered by the user (or derived from user input). Sometimes there's a middle ground, like storing the key in an external key store that has its own security (like Windows' Credential Vault or Apple's Keychain). – CBHacking Oct 30 '19 at 19:06
  • As a side note, if you're asking this question (and especially if encryptor.setPassword("jasypt"); is anything other than a placeholder line), it is very unlikely you will manage to do this correctly. For example, if you're storing either the key or the password, you shouldn't be using PBE; anything password-based is only for use when the secret needs to be stored in a human brain. – CBHacking Oct 30 '19 at 19:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.