I have a big problem, I developed an app which uses encryption for send message to another device.
Here cipher class, I "steal" that but I don't remember where:
public class AesCipher {
public static String encrypt(String seed, String cleartext) throws Exception {
byte[] rawKey = getRawKey(seed.getBytes());
byte[] result = encrypt(rawKey, cleartext.getBytes());
return toHex(result);
}
public static String decrypt(String seed, String encrypted) throws Exception {
byte[] rawKey = getRawKey(seed.getBytes());
byte[] enc = toByte(encrypted);
byte[] result = decrypt(rawKey, enc);
return new String(result);
}
private static byte[] getRawKey(byte[] seed) throws Exception {
KeyGenerator kgen = KeyGenerator.getInstance("AES");
SecureRandom sr = SecureRandom.getInstance("SHA1PRNG");
sr.setSeed(seed);
kgen.init(256,sr); // 192 and 256 bits may not be available
SecretKey skey = kgen.generateKey();
byte[] raw = skey.getEncoded();
return raw;
}
private static byte[] encrypt(byte[] raw, byte[] clear) throws Exception {
SecretKeySpec skeySpec = new SecretKeySpec(raw, "AES");
Cipher cipher = Cipher.getInstance("AES");
cipher.init(Cipher.ENCRYPT_MODE, skeySpec);
byte[] encrypted = cipher.doFinal(clear);
return encrypted;
}
private static byte[] decrypt(byte[] raw, byte[] encrypted) throws Exception {
try{
SecretKeySpec skeySpec = new SecretKeySpec(raw, "AES");
Cipher cipher = Cipher.getInstance("AES");
cipher.init(Cipher.DECRYPT_MODE, skeySpec);
byte[] decrypted = cipher.doFinal(encrypted);
return decrypted;
}
catch (Exception e) {return encrypted;}
}
public static String toHex(String txt) {
return toHex(txt.getBytes());
}
public static String fromHex(String hex) {
return new String(toByte(hex));
}
public static byte[] toByte(String hexString) {
int len = hexString.length()/2;
byte[] result = new byte[len];
for (int i = 0; i < len; i++)
result[i] = Integer.valueOf(hexString.substring(2*i, 2*i+2), 16).byteValue();
return result;
}
public static String toHex(byte[] buf) {
if (buf == null)
return "";
StringBuffer result = new StringBuffer(2*buf.length);
for (int i = 0; i < buf.length; i++) {
appendHex(result, buf[i]);
}
return result.toString();
}
private final static String HEX = "0123456789ABCDEF";
private static void appendHex(StringBuffer sb, byte b) {
sb.append(HEX.charAt((b>>4)&0x0f)).append(HEX.charAt(b&0x0f));
}
}
so, if i send a message to same device, my app work fine, but if i use different device versions (andorid2.3 vs android4.0), receiver cannot decrypt message..
searching around I found that the problem is SecureRandom which cannot garantees compatibility over different implementation. how I can resolve it?
Sorry for my english...
Yes, I've tried to get that terrible example removed, but to no avail.
You should try and to retrieve the bytes from a 2.3 device and use the resulting raw[] byte array to create a SecretKeySpec. You can use this SecretKeySpec directly as key to decrypt anything that you've encrypted on a 2.3 device.
Unfortunately if you've encrypted anything using a 4 device and "thrown away" the raw[] then your only option is to break "AES/ECB/PKCS5Padding" (the default when you use "AES"). You may be able to get a tiny bit of information from ECB mode as this is insecure as well, but otherwise it would come down to breaking AES ciphertext security - and nobody in this world is - as far as we know - able to do that.
If you start off with a password yourself when creating code then you should first call a Password Based Key Derivation Function to create a key from a password. Java has PBKDF2 build in.