Question

请在将其标记为重复或投票前阅读完整的问题。我需要在我的项目中添加AES 256加密。所以根据here在我的jre和jdk的lib安全文件夹中添加了安全jar。现在，如果我使用main方法运行代码，它正在工作，但如果我在tomcat中部署它。它让我犯错误

java.security.InvalidKeyException: Illegal key size or default parameters
        at javax.crypto.Cipher.checkCryptoPerm(Cipher.java:1026)
        at javax.crypto.Cipher.implInit(Cipher.java:801)
        at javax.crypto.Cipher.chooseProvider(Cipher.java:864)
        at javax.crypto.Cipher.init(Cipher.java:1249)
        at javax.crypto.Cipher.init(Cipher.java:1186)
        at com.infy.encrypt.Encryption.encrypt(Encryption.java:36)
        at com.infy.service.UserServiceImpl.addUser(UserServiceImpl.java:24)
        at com.infy.controller.UserController.addUser(UserController.java:44)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
        at java.lang.reflect.Method.invoke(Unknown Source)
        at org.springframework.web.method.support.InvocableHandlerMethod.invoke(InvocableHandlerMethod.java:215)
        at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:132)
        at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:104)

我认为我的tomcat没有读取更新的策略文件。我试图杀死jvm proccesses但没有运气。

下面是我的加密代码

 public String encrypt(String word) throws Exception {

        byte[] ivBytes;
        String password="Hello"; 
    /*you can give whatever you want for password. This is for testing purpose*/

        SecureRandom random = new SecureRandom();
        byte bytes[] = new byte[20];
        random.nextBytes(bytes);
        byte[] saltBytes = bytes;

        // Derive the key
       SecretKeyFactory factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1");

        PBEKeySpec spec = new PBEKeySpec(password.toCharArray(),saltBytes,65556,256);

         SecretKey secretKey = factory.generateSecret(spec);
        SecretKeySpec secret = new SecretKeySpec(secretKey.getEncoded(), "AES");

         //encrypting the word

         Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
         cipher.init(Cipher.ENCRYPT_MODE, secret);
         AlgorithmParameters params = cipher.getParameters();
         ivBytes =   params.getParameterSpec(IvParameterSpec.class).getIV();

         byte[] encryptedTextBytes =  cipher.doFinal(word.getBytes("UTF-8"));

         //prepend salt and vi

          byte[] buffer = new byte[saltBytes.length + ivBytes.length + encryptedTextBytes.length];

          System.arraycopy(saltBytes, 0, buffer, 0, saltBytes.length);
          System.arraycopy(ivBytes, 0, buffer, saltBytes.length, ivBytes.length);

           System.arraycopy(encryptedTextBytes, 0, buffer, saltBytes.length + ivBytes.length, encryptedTextBytes.length);

           return new Base64().encodeToString(buffer);

        }

下面的

是测试方法的结果

public static void main(String[] args) throws Exception {

        Encryption en=new Encryption();
        String encryptedWord=en.encrypt("Test"); 
        System.out.println("Encrypted word is : " + encryptedWord);
        Decryption de =new Decryption();
        System.out.println("Decrypted word is : " +    de.decrypt(encryptedWord));  
    }

输出

Encrypted word is : o73KvJpuI/QdJlswEsBqf/Cz0PDdUdX0emADyTMxqVeHDP1QSkH+YR0HlWAMb+dNGDjy3w==

但是，如果我通过在tomcat中部署来达到同样的效果，那就无法正常工作了下面是我的控制器类

@RequestMapping(value = "/register/add", method = RequestMethod.POST,produces=MediaType.APPLICATION_JSON_VALUE,consumes=MediaType.APPLICATION_JSON_VALUE)       
        public @ResponseBody UserMVC addUser(@RequestBody UserMVC p) {
System.out.println("inside controller");
/*          if (p.getId() == 0) {
                // new user, add it
                this.userService.addUser(p);
            } else {
                // existing user, call update
                this.userService.updateUser(p);
            }*/
            User user=new User();
            user.setFirstname(p.getFirstName());
            user.setLastname(p.getLastName());
            user.setPassword(p.getPassword());
            user.setUsername(p.getUserName());
            this.userService.addUser(user);
            return p;

        }

和dao的adduser方法

public void addUser(User p) {
        try {
            Encryption en=new Encryption();
            p.setPassword(en.encrypt(p.getPassword()));
            System.out.println("password:"+p.getPassword());
            this.userDao.addUser(p);
        } catch (Exception e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        }
    }

java.security.invalidkeyexception非法密钥大小或默认参数

0 个答案: