Develop Reference

Encrypt and save in external storage the String response of Json as a textfile

I am new in Text file Encryption in Android. And tried so many example of text encryption but i am so confused how to apply.
I have 5 string records from json response and i want to save them in a text file(in External Storage) and in "Encrypted format" . I've tried code of cipher_text_encoding but really confused with lots of classes in it.
Please suggest me either good tutorial for text encryption or give me hint how to encode.
Thanks in advance.

Encryption and Decryption using AES Secret Key Algorithm
Generate AES Secret Key:
public static byte[] generateAesSecretKey(){
String SALT2 = "strong_salt_value";
String username = "user_name";
String password = "strong_password";
byte[] key = (SALT2 + username + password).getBytes();
SecretKey secretKeySpec = null;
try {
MessageDigest sha = MessageDigest.getInstance("SHA-1");
key = sha.digest(key);
key = Arrays.copyOf(key, 16);
secretKeySpec = new SecretKeySpec(key, "AES");
} catch (Exception e) {
e.printStackTrace();
}
return secretKeySpec.getEncoded();
}
Encryption:
public static byte[] encodeFile(byte[] secretKey, byte[] fileData) {
SecretKeySpec skeySpec = new SecretKeySpec(secretKey, "AES");
byte[] encrypted = null;
try {
Cipher cipher = Cipher.getInstance("AES");
cipher.init(Cipher.ENCRYPT_MODE, skeySpec);
encrypted = cipher.doFinal(fileData);
// Now write your logic to save encrypted data to sdcard here
} catch (NoSuchAlgorithmException e) {
e.printStackTrace();
} catch (NoSuchPaddingException e) {
e.printStackTrace();
} catch (InvalidKeyException e) {
e.printStackTrace();
} catch (IllegalBlockSizeException e) {
e.printStackTrace();
} catch (BadPaddingException e) {
e.printStackTrace();
} catch (Exception e){
e.printStackTrace();
}
return encrypted;
}
Decryption:
public static byte[] decodeFile(byte[] key, byte[] fileData) {
SecretKeySpec skeySpec = new SecretKeySpec(key, "AES");
byte[] decrypted = null;
try {
Cipher cipher = Cipher.getInstance("AES");
cipher.init(Cipher.DECRYPT_MODE, skeySpec);
decrypted = cipher.doFinal(fileData);
} catch (NoSuchAlgorithmException | NoSuchPaddingException e) {
// TODO Auto-generated catch block
e.printStackTrace();
} catch (InvalidKeyException e) {
// TODO Auto-generated catch block
e.printStackTrace();
} catch (IllegalBlockSizeException | BadPaddingException e) {
// TODO Auto-generated catch block
e.printStackTrace();
} catch(Exception e){
// for all other exception
e.printStackTrace();
}
return decrypted;
}
Hope above methods are useful for you!

AS with every beginner it is normal to get confused, instead of do it yourself everything learn to leverage on code reuse or written shared libraries. This will leverage on code abstraction as you are only interested in say Encryption and Decryption of JSON/Sting.
For a Full Document:
https://docs.oracle.com/javase/8/docs/technotes/guides/security/crypto/CryptoSpec.html
For a reusable (Java/Android) library:
https://github.com/alkathirikhalid/security
Simple Usage:
String plainText = "Your String";
String encryptionKey = "Your Encryption Key";
String IV = "Your Initial Vector";
// To Encrypt
String cipherText = AES.encrypt(plainText, encryptionKey, IV);
// To Decrypt returned value same as plainText
String originalText = AES.decrypt(cipherText, encryptionKey, IV);
Cheers.

How to truncated tag with AES GCM?

I'm using AES/GCM encryption and I'm trying to reduce tag from 128 bits to 32 bits.
I've found some documentation about GCMParameterSpec method which is supposed to do this work.
You can see my code bellow:
Cipher cipher = null;
try {
byte[] input = Utils.hexStringToByteArray("d9313225f88406e5a55909c5aff5269a");
byte[] keyByte = Utils.hexStringToByteArray("cfa2b0719afe65b60b1461cdc6a7f7e3");
SecretKeySpec key = new SecretKeySpec(keyByte, "AES");
cipher = Cipher.getInstance("AES/GCM/NoPadding");
GCMParameterSpec spec = new GCMParameterSpec(32, Utils.hexStringToByteArray("000000000000000000000000"));
cipher.init(Cipher.ENCRYPT_MODE, key, spec);
/*byte[] aad = Utils.hexStringToByteArray("000000");
cipher.updateAAD(aad);*/
final byte[] encrypted = new byte[cipher.getOutputSize(0)];
cipher.update(input, 0, input.length, encrypted, 0); //Not being updated for current data.
//Tag output
byte[] tag = new byte[cipher.getOutputSize(0)];
cipher.doFinal(tag, 0);
cipher.init(Cipher.DECRYPT_MODE, key, spec);
//cipher.updateAAD(aad);
final byte[] data1 = new byte[16];
int offset = cipher.update(encrypted, 0, encrypted.length, data1, 0);
cipher.update(tag, 0, tag.length, data1, offset);
cipher.doFinal(data1,offset);
}
catch (NoSuchAlgorithmException e) {
e.printStackTrace();
} catch (NoSuchPaddingException e) {
e.printStackTrace();
} catch (BadPaddingException e) {
e.printStackTrace();
} catch (InvalidKeyException e) {
e.printStackTrace();
} catch (IllegalBlockSizeException e) {
e.printStackTrace();
} catch (InvalidAlgorithmParameterException e) {
e.printStackTrace();
} catch (ShortBufferException e) {
e.printStackTrace();
}
}
It sends me this exception:
java security invalidkeyexception: Invalid value for MAC size: 32
Do you have some issue or can you explain me why it doesn't work?
Thanks.

Simple AES encryption and decryption not returning original text

I am using the following simple encrypt and decrypt functions just to see that it works before using more complicated security features like padding and hashing. For some reason the returned clear text is not similar to the original message. Here is the code:
public static byte[] encrypt(SecretKey secret, byte[] buffer) throws NoSuchAlgorithmException, NoSuchPaddingException, InvalidKeyException, InvalidParameterSpecException, IllegalBlockSizeException, BadPaddingException, UnsupportedEncodingException
{
/* Encrypt the message. */
cipher = Cipher.getInstance("AES/CTR/NoPadding");
cipher.init(Cipher.ENCRYPT_MODE, secret);
byte[] ciphertext = cipher.doFinal(buffer);
return ciphertext;
}
public static byte[] decrypt(SecretKey secret, byte[] buffer) throws NoSuchAlgorithmException, NoSuchPaddingException, InvalidKeyException, InvalidParameterSpecException, IllegalBlockSizeException, BadPaddingException, UnsupportedEncodingException
{
/* Decrypt the message. - use cipher instance created at encrypt */
cipher.init(Cipher.DECRYPT_MODE, secret);
byte[] clear = cipher.doFinal(buffer);
return clear;
}
and the calling code:
SecretKey secret1 = null;
byte[] ciphertext = null;
byte[] message = "Hello, World!".getBytes();
byte[] clear = null;
try {
// aSecret is a shared secret generated with ECDH
secret1 = Crypto.createAESKey(aSecret);
ciphertext = Crypto.encrypt(secret1, message);
clear = Crypto.decrypt(secret1, ciphertext);
String s = new String(clear);//clear.toString();
keyAText.setText(new String(message));
keyBText.setText(s);
return;
} catch (InvalidKeySpecException e) {
// TODO Auto-generated catch block
e.printStackTrace();
} catch (NoSuchAlgorithmException e) {
// TODO Auto-generated catch block
e.printStackTrace();
} catch (InvalidKeyException e) {
// TODO Auto-generated catch block
e.printStackTrace();
} catch (NoSuchPaddingException e) {
// TODO Auto-generated catch block
e.printStackTrace();
} catch (InvalidParameterSpecException e) {
// TODO Auto-generated catch block
e.printStackTrace();
} catch (IllegalBlockSizeException e) {
// TODO Auto-generated catch block
e.printStackTrace();
} catch (BadPaddingException e) {
// TODO Auto-generated catch block
e.printStackTrace();
} catch (UnsupportedEncodingException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}

This is almost certainly due to the fact that you don't provide an IV using IvParameterSpec during initialization. On Java SE, your code won't even run due to the fact that CTR requires this parameter to be set. Other providers may however implement things differently, e.g. they may provide a random IV instead.
Of course, if you use a different random IV during encryption and decryption, your decryption result will likely not match your plaintext.
Try the following amended methods:
public static byte[] encrypt(SecretKey secret, byte[] buffer) throws GeneralSecurityException
{
/* Encrypt the message. */
Cipher cipher = Cipher.getInstance("AES/CTR/NoPadding");
SecureRandom rng = new SecureRandom();
byte[] ivData = new byte[cipher.getBlockSize()];
rng.nextBytes(ivData);
cipher.init(Cipher.ENCRYPT_MODE, secret, new IvParameterSpec(ivData));
byte[] ciphertext = cipher.doFinal(buffer);
return Arrays.concatenate(ivData, ciphertext);
}
public static byte[] decrypt(SecretKey secret, byte[] buffer) throws GeneralSecurityException
{
/* Decrypt the message. - use cipher instance created at encrypt */
Cipher cipher = Cipher.getInstance("AES/CTR/NoPadding");
int n = cipher.getBlockSize();
byte[] ivData = Arrays.copyOf(buffer, n);
cipher.init(Cipher.DECRYPT_MODE, secret, new IvParameterSpec(ivData));
byte[] clear = cipher.doFinal(buffer, n, buffer.length - n);
return clear;
}

Clarification about Android public key?

I am confused by this bit of advice from http://developer.android.com/guide/google/play/billing/billing_integrate.html#billing-signatures
To keep your public key safe from malicious users and hackers, do not
embed your public key as an entire literal string. Instead, construct
the string at runtime from pieces or use bit manipulation (for
example, XOR with some other string) to hide the actual key. The key
itself is not secret information, but you do not want to make it easy
for a hacker or malicious user to replace the public key with another
key.
Does this mean that
String one = "thisIs";
String two = "MyKey";
String base64EncodedPublicKey = one + two;
PublicKey key = Security.generatePublicKey(base64EncodedPublicKey);
verified = Security.verify(key, signedData, signature);
is safer than
String base64EncodedPublicKey = "thisIsMyKey";
PublicKey key = Security.generatePublicKey(base64EncodedPublicKey);
verified = Security.verify(key, signedData, signature);
? If not, could you please give me an example in code of how to do this?

Something that involves some serious change of the key is best. Personally, I prefer using encryption, something like this would work. For the key, string together a few parts, and it should help to getting it together. Use encryptKey to get your key encrypted, then delete the real key from the source code, and you should be fairly secure. Better is to somehow get the key from a secure server, but that isn't always an option.
String encryptKey(String input)
{
byte[] inBytes=input.getBytes();
String finalString=null;
try {
Cipher cipher=Cipher.getInstance("AES/CBC/PKCS5Padding");
MessageDigest md = MessageDigest.getInstance("SHA-1");
byte[] keyBytes=md.digest((KeyPart1+KeyPart2).getBytes());
keyBytes = Arrays.copyOf(keyBytes, 16);
SecretKey key= new SecretKeySpec(keyBytes,"AES");
IvParameterSpec ivSpec = new IvParameterSpec(new byte[] {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0});
cipher.init(Cipher.ENCRYPT_MODE,key,ivSpec);
byte[] outBytes = new byte[cipher.getOutputSize(inBytes.length)];
//cipher.update(encrypted, 0, encrypted.length, decrypted, 0);
outBytes=cipher.doFinal(inBytes);
finalString=new String(Base64.encode(outBytes,0));
Log.v(TAG,"Encrypted="+finalString);
} catch (NoSuchAlgorithmException e) {
Log.e(TAG,"No Such Algorithm",e);
} catch (NoSuchPaddingException e) {
Log.e(TAG,"No Such Padding",e);
} catch (InvalidKeyException e) {
Log.e(TAG,"Invalid Key",e);
} catch (InvalidAlgorithmParameterException e) {
Log.e(TAG,"Invalid Algorithm Parameter",e);
} catch (IllegalBlockSizeException e) {
} catch (BadPaddingException e) {}
return finalString;
}
String decryptKey(String base64Text)
{
byte[] encrypted=Base64.decode(base64Text,0);
//encrypted=base64Text.getBytes();
String decryptedString=null;
try {
Cipher cipher=Cipher.getInstance("AES/CBC/PKCS5Padding");
MessageDigest md = MessageDigest.getInstance("SHA-1");
byte[] keyBytes=md.digest((KeyPart1+KeyPart2).getBytes());
keyBytes = Arrays.copyOf(keyBytes, 16);
SecretKey key= new SecretKeySpec(keyBytes,"AES");
IvParameterSpec ivSpec = new IvParameterSpec(new byte[] {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0});
cipher.init(Cipher.DECRYPT_MODE,key,ivSpec);
byte[] decrypted = new byte[cipher.getOutputSize(encrypted.length)];
//cipher.update(encrypted, 0, encrypted.length, decrypted, 0);
decrypted=cipher.doFinal(encrypted);
decryptedString=new String(decrypted);
} catch (NoSuchAlgorithmException e) {
logStackTrace(e);
} catch (NoSuchPaddingException e) {
logStackTrace(e);
} catch (InvalidKeyException e) {
logStackTrace(e);
} catch (InvalidAlgorithmParameterException e) {
logStackTrace(e);
} catch (IllegalBlockSizeException e) {
logStackTrace(e);
} catch (BadPaddingException e) {
logStackTrace(e);
}
return decryptedString;
}

Yes. Although in this case you're just concatenating strings which is not much better. The reason for this is that somebody could easily disassemble your code and access your public key. If you have to reassemble the key, it makes it much more challenging to grab the key out of the disassembled code.

Encryption JSON String

I want to encrypt JSON string and then send it to web server. For encryption I am using AES algorithm.
my JSON string is like :
String pJSON = "{\"UserName\":\"abc\",\"Password\":\"123456789\"}";
any idea ??

If you want to protect the password and other personal details whilst they are in transit, it is MUCH better to use HTTPS (secure HTTP) than to do your own encryption because:
If you do your own encryption/decryption then your app contains everything a hacker needs to decrypt the password, they just need to reverse-engineer it (you can make this harder, but not impossible, using a tool like Proguard)
HTTPS is designed for this type of scenario, and is much easier to implement. You just buy a secure web server cert (usually less than $100) and install it on the web server.
So I am suggesting that rather than doing your own encryption which is time-consuming and prone to attack, use the existing web infrastructure to do it for you.

Actually this is a JSON object.
You can do something like this:
JSONObject JObject=new JSONObject();
JObject.put("UserName", "abc");
JObject.put("Password", "123456789");
This will create a similar string then you can send it to server using PUT or POST method.

Please check this out. I have gone of this encryption just few day before.
public class AES_ECB {
//final static String AES_V1_KEY = "D0QgiY8JYvx8qzKx0iaN8kwEJgwpEqAJ";
final static String AES_V1_KEY = "BH&625%$#kOhrtxx";
private static final String KEY_ALGORITHM = "AES";
private static final String CIPHER_ALGORITHM = "AES/ECB/NoPadding";
// private static final String CIPHER_ALGORITHM = "AES/CFB/NoPadding";
// private static SecretKeySpec secretKeySpec = new
// SecretKeySpec(AES_V1_KEY.getBytes(), "AES");
// private static byte[] iv = "Htw%$42u&8o*pqxzV#C!33Zq29&bSq2#".getBytes();
// private static byte[] iv = new byte[] { 0x0, 0x1, 0x2, 0x3, 0x4, 0x5,
// 0x6,
// 0x7, 0x8, 0x9, 0xA, 0xB, 0xC, 0xD, 0xE, 0xF };
// private static IvParameterSpec ivParameterSpec = new IvParameterSpec(iv);
private static final String PROVIDER = "BC";
static String nullPadString(String original) {
String output = original;
int remain = output.length() % 16;
if (remain != 0) {
remain = 16 - remain;
for (int i = 0; i < remain; i++)
output += (char) 0;
}
return output;
}
static String encryptString(final String RAWDATA, boolean ENCODE) {
String encrypted = null;
byte[] encryptedBytes = null;
byte[] key;
key = AES_V1_KEY.getBytes();
// SecretKeySpec skeySpec = new SecretKeySpec(key, "AES");
// Instantiate the cipher
Cipher cipher = null;
try {
String input = RAWDATA;
// KeyGenerator kgen = KeyGenerator.getInstance(KEY_ALGORITHM);
// SecureRandom sr = SecureRandom.getInstance("SHA1PRNG");
// sr.setSeed(key);
// kgen.init(128, sr); //192 and 256 bits may not be available
// SecretKey skey = kgen.generateKey();
// byte[] raw1 = skey.getEncoded();
SecretKeySpec skeySpec = new SecretKeySpec(key, KEY_ALGORITHM);
cipher = Cipher.getInstance(CIPHER_ALGORITHM);
cipher.init(Cipher.ENCRYPT_MODE, skeySpec);
// cipher.init(Cipher.ENCRYPT_MODE,
// AES_ECB.secretKeySpec,AES_ECB.ivParameterSpec);
// encryptedBytes = cipher.doFinal(nullPadString(input).getBytes());
encryptedBytes = cipher.doFinal(nullPadString(input).getBytes());
} catch (NoSuchAlgorithmException e) {
Log.d("ERROR", e.toString());
} catch (NoSuchPaddingException e) {
Log.d("ERROR", e.toString());
} catch (InvalidKeyException e) {
// TODO Auto-generated catch block
Log.d("ERROR", e.toString());
} catch (IllegalBlockSizeException e) {
Log.d("ERROR", e.toString());
} catch (BadPaddingException e) {
Log.d("ERROR", e.toString());
}
encrypted = new String(encryptedBytes);
if (ENCODE)
encrypted = new String(Base64.encodeBytes(encryptedBytes));
else
encrypted = new String(encryptedBytes);
return encrypted;
// /return encrypted;
}// method end
static String decryptString(final String ENCRYPTEDDATA, final boolean DECODE) {
String raw = null;
byte[] rawBytes = null;
byte[] encryptedBytes = null;
if (DECODE)
try {
encryptedBytes = Base64.decode(ENCRYPTEDDATA.getBytes());
} catch (IOException e1) {
// TODO Auto-generated catch block
e1.printStackTrace();
}
else
encryptedBytes = ENCRYPTEDDATA.getBytes();
// encryptedBytes = ENCRYPTEDDATA.getBytes();
byte[] key;
key = AES_V1_KEY.getBytes();
// SecretKeySpec skeySpec = new SecretKeySpec(key, "AES");
Cipher cipher = null;
try {
// KeyGenerator kgen = KeyGenerator.getInstance(KEY_ALGORITHM);
// SecureRandom sr = SecureRandom.getInstance("SHA1PRNG");
// sr.setSeed(key);
// kgen.init(128, sr); // 192 and 256 bits may not be available
// SecretKey skey = kgen.generateKey();
// byte[] raw1 = skey.getEncoded();
SecretKeySpec skeySpec = new SecretKeySpec(key, KEY_ALGORITHM);
cipher = Cipher.getInstance(CIPHER_ALGORITHM);
cipher.init(Cipher.DECRYPT_MODE, skeySpec);
rawBytes = cipher.doFinal(encryptedBytes);
} catch (NoSuchAlgorithmException e) {
// TODO Auto-generated catch block
e.printStackTrace();
} catch (NoSuchPaddingException e) {
// TODO Auto-generated catch block
e.printStackTrace();
} catch (InvalidKeyException e) {
} catch (IllegalBlockSizeException e) {
// TODO Auto-generated catch block
e.printStackTrace();
} catch (BadPaddingException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
if(rawBytes==null)
return "";
else{
return raw = new String(rawBytes);
}
// raw = new String(rawBytes);
// int delimiter = raw.indexOf('|');
// int length = Integer.valueOf(raw.substring(0, delimiter));
// raw = raw.substring(delimiter + 1, length + delimiter + 1);
// return raw;
}
}