Encryption in Java & Flex

Question

I want tp encrypt and decrypt string, with defined salt. But the result must be same if the code run in java and adobe flex. The main goal is: the app in adobe flex will be generate a string that can be decrypt in server using java.

I use this flex library http://crypto.hurlant.com/demo/

Try to 'Secret Key' Tab. I want to use AES Encryption, 'CBC' or 'PKCS5'.

var k:String = "1234567890123456";
var kdata:ByteArray = Hex.toArray(k);
var txt:String = "hello";
var data:ByteArray = Hex.toArray(Hex.fromString(txt));;
var name:String = "simple-aes-cbc";
var pad:IPad =new PKCS5();
var mode:ICipher = Crypto.getCipher(name, kdata, pad);
pad.setBlockSize(mode.getBlockSize());
mode.encrypt(data);
encrypted.text=Hex.fromArray(data);
trace(Hex.fromArray(data));

And here is the code in java

String plaintext = "hello";
String key = "1234567890123456";

SecretKey keyspec = new SecretKeySpec(key.getBytes(), "AES");       

Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
cipher.init(Cipher.ENCRYPT_MODE,keyspec);
byte[] encrypted = cipher.doFinal(plaintext.getBytes());

BASE64Encoder base64 = new BASE64Encoder();
String encodedString = base64.encode(encrypted);

System.out.println(encodedString);

Why the result is not same? Can you guys provide the sample with the same result both of java and flex (encrypt and decrypt)? And if I want to change the paramater, for example, from cbc to ebc, which line that need to be changed?

Thanks!

Answer 1

"Simple" encryption mode (simple-aes-cbc) uses random initialization vector which is different each time you use it even if your secret key is the same.

If you wish to guarantee the same results when using the same key you should use "aes-cbc". Additionally you have to manually set the IV on the Cipher:

var ivmode:IVMode = mode as IVMode;
ivmode.IV = "some string guaranteed to be constant"

The IV can be made dependent on something like userId, which makes encryption repeatable for the same user.

You should consider how this affects your security scheme.

Answer 2

Seems like I do not convert into hex first in java when pass the key. And so on when get result byteArray at adobe flex, I do not cast again in java.

That's what I got when I see Arcadio code. Thanks.