Question

我在下面粘贴的所有代码，请看一下

（1）在那段代码中，我想了解这一行

private static final String password = "test";// I want to remove this line

当我在servlet中调用此文件时，此密码的作用是什么

"test"

玩

d.encrypt("Hello")??

以下是代码：

    AESDemo d = new AESDemo();      
    System.out.println("Encrypted string:" + d.encrypt("Hello"));           
    String encryptedText = d.encrypt("Hello");
    System.out.println("Decrypted string:" + d.decrypt(encryptedText));

当用户登录他们的密码时，其他任何东西都不能“测试”，那么如何从java代码中删除此行，在此处收到错误

     spec = new PBEKeySpec(
            // password.toCharArray(),
            saltBytes, // byte[] cannot be converted into char[] I am getting error here 
            pswdIterations,
            keySize
    );

（2）当我运行程序时，我加密了24个字符，但是当我增加

时

new byte[20] to new byte[40]

仍然有24个字符的长度，是否有可能获得更多加密字符，如40或50个加密字符，以便攻击者无法猜测

public String generateSalt() {
SecureRandom random = new SecureRandom();
byte bytes[] = new byte[20];
random.nextBytes(bytes);
String s = new String(bytes);
return s;
}

整个代码在这里：

public class AESDemo {

private static final String password = "test";
private static String salt;
private static int pswdIterations = 65536  ;
private static int keySize = 256;
private byte[] ivBytes;

public String encrypt(String plainText) throws Exception {   

    //get salt
    salt = generateSalt();      
    byte[] saltBytes = salt.getBytes("UTF-8");

    // Derive the key
    SecretKeyFactory factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1");
    PBEKeySpec spec = new PBEKeySpec(
            password.toCharArray(), 
            saltBytes, 
            pswdIterations, 
            keySize
            );

    SecretKey secretKey = factory.generateSecret(spec);
    SecretKeySpec secret = new SecretKeySpec(secretKey.getEncoded(), "AES");

    //encrypt the message
    Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
    cipher.init(Cipher.ENCRYPT_MODE, secret);
    AlgorithmParameters params = cipher.getParameters();
    ivBytes = params.getParameterSpec(IvParameterSpec.class).getIV();
    byte[] encryptedTextBytes = cipher.doFinal(plainText.getBytes("UTF-8"));
    return new Base64().encodeAsString(encryptedTextBytes);
}

@SuppressWarnings("static-access")
public String decrypt(String encryptedText) throws Exception {

    byte[] saltBytes = salt.getBytes("UTF-8");
    byte[] encryptedTextBytes = new Base64().decodeBase64(encryptedText);

    // Derive the key
    SecretKeyFactory factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1");
    PBEKeySpec spec = new PBEKeySpec(
            password.toCharArray(), 
            saltBytes, 
            pswdIterations, 
            keySize
            );

    SecretKey secretKey = factory.generateSecret(spec);
    SecretKeySpec secret = new SecretKeySpec(secretKey.getEncoded(), "AES");

    // Decrypt the message
    Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
    cipher.init(Cipher.DECRYPT_MODE, secret, new IvParameterSpec(ivBytes));


    byte[] decryptedTextBytes = null;
    try {
        decryptedTextBytes = cipher.doFinal(encryptedTextBytes);
    } catch (IllegalBlockSizeException e) {
        e.printStackTrace();
    } catch (BadPaddingException e) {
        e.printStackTrace();
    }

    return new String(decryptedTextBytes);
}

public String generateSalt() {
    SecureRandom random = new SecureRandom();
    byte bytes[] = new byte[20];
    random.nextBytes(bytes);
    String s = new String(bytes);
    return s;
}
}

在不使用密码“test”的情况下获取AESDemo（）类的对象

0 个答案: