Secret Password Encryption - Expert Oracle and Java Security - page 86

Listing 6-2. Static Class Members
private static SecureRandom random = new SecureRandom();
private static Cipher cipherRSA;
static {
try {
cipherRSA = Cipher.getInstance( "RSA" );
} catch( Exception x ) {}
}
private static Cipher cipherDES;
private static SecretKey sessionSecretDESKey = null;
private static AlgorithmParameterSpec paramSpec;
private static String sessionSecretDESAlgorithm = "PBEWithSHA1AndDESede";
In addition to the artifacts of the DES password-based encryption key described in the previous
section, we will declare the key itself and the DES Cipher we will be using. We will also build and use an
AlgorithmParameterSpec member for the DES key.
Evaluating the Java 1.5 Password-Based Encryption Bug
We get to select what algorithm we intend to use for our secret password encryption. U.S. (DES) is good,
but Triple DES (3DES or DESede) is stronger, and AES even more so; and SHA1 is a better cryptographic
hash than MD5. So we would like to use the password-based encryption algorithm fully indicated by
PBEWithSHA1AndDESede , and we specify it as shown in Listing 6-2.
But wait, there is a problem. In the Java Runtime Edition version 1.5, there is a bug. It is reported at
this link: http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=6332761 .
The Oracle JVM is based on JRE 1.5, so it manifests that bug. When we generate our secret key
specifying our preferred algorithm, the key generator will return a weaker key of type PBEWithMD5AndDES
instead.
Coding an Automatic Upgrade: Negotiated Algorithm
It is the job of programmers to debug issues like the bug described in the previous section when we run
across them, and to build bridges over the obstacles. We will have a method that shows us the algorithm
in actual use; that will display the bug. Additionally, we will not assume that what we specify is what we
get—we will return the actual algorithm to the client and build the copy of the secret password key using
the actual algorithm.
The benefits of this approach are that we will negotiate a common algorithm and continue to
specify a stronger encryption algorithm. Continuing to specify the stronger algorithm will predispose
our code to use the stronger algorithm whenever it becomes available in the Oracle JVM.
So we will specify PBEWithSHA1AndDESede , but at this time we will be using PBEWithMD5AndDES . When
Oracle next upgrades the Oracle JVM, we are prepared to use the stronger algorithm. Both of these
algorithms use CBC as their mode, so they will work equally well for what we are doing.
Generating the Password Key
Now that we have all the artifacts of our secret password key, let's build the key. In Listing 6-3, we have a
method to create the key, makeSessionSecretDESKey() . The first step in this method checks to see if the