IllegalBlockSizeException while using DES encryption

Hi,

Can anyone help me to resolve IllegalBlockSizeException

Below here is the code i am using

***************************************************************

import com.opensymphony.webwork.ServletActionContext;

import sun.misc.BASE64Decoder;

import sun.misc.BASE64Encoder;

import javax.crypto.Cipher;

import javax.crypto.SecretKey;

import javax.crypto.spec.IvParameterSpec;

import javax.servlet.http.HttpSession;

import java.net.URLDecoder;

import java.net.URLEncoder;

import java.util.StringTokenizer;

public class SecurityHelper {

private static byte[] iv = {0x0a, 0x01, 0x02, 0x03, 0x04, 0x0b, 0x0c, 0x0d};

private static SecretKey secretKey;

private static final String usedAlgo = "DES/CBC/PKCS5Padding";

private static BASE64Encoder base64Encoder = new BASE64Encoder();

private static BASE64Decoder base64Decoder = new BASE64Decoder();

public static String encrypt(String encBytes) {

try {

HttpSession session = ServletActionContext.getRequest().getSession(false);

SecretKey secretKey = (SecretKey) session.getAttribute("SeceretReference");

Cipher cipher = Cipher.getInstance(usedAlgo);

IvParameterSpec ivParameterSpec = new IvParameterSpec(iv);

cipher.init(Cipher.ENCRYPT_MODE, secretKey, ivParameterSpec);

byte[] encryptedBytes = cipher.doFinal(encBytes.getBytes());

return URLEncoder.encode(base64Encoder.encode(encryptedBytes).replace('+','$') + "@", "UTF-8");

} catch (Exception e) {

e.printStackTrace(); //ToDO : Anurag

return null;

}

}

public static String decrypt(String decString) {

if(null != decString){

try {

StringTokenizer stringTokenizer = new StringTokenizer(decString,",");

while(stringTokenizer.hasMoreTokens()) {

decString = stringTokenizer.nextToken().trim();

}

String characterEncoding = "ASCII";

HttpSession session = ServletActionContext.getRequest().getSession(false);

SecretKey secretKey = (SecretKey) session.getAttribute("SeceretReference");

Cipher cipher = Cipher.getInstance(usedAlgo);

IvParameterSpec ivParameterSpec = new IvParameterSpec(iv);

cipher.init(Cipher.DECRYPT_MODE, secretKey, ivParameterSpec);

if (decString.indexOf("%") != -1) {

decString = URLDecoder.decode(decString, "UTF-8");

}

decString = decString.replace('$','+');

decString = decString.substring(0, decString.length() - 1);

byte[] decryptedBytes = base64Decoder.decodeBuffer(decString);

byte[] resultBytes = cipher.doFinal(decryptedBytes);

return new String(resultBytes, characterEncoding);

} catch (Exception e) {

e.printStackTrace();

return null;

}

}

return null;

}

}

****************************************************************

the exception is

16/05/07 12:38:03:011 BST] 0000003c SystemErrR javax.crypto.IllegalBlockSizeException: Input length (with padding) not multiple of 8 bytes

[16/05/07 12:38:03:027 BST] 0000003c SystemErrR at com.ibm.crypto.provider.DESCipher.a(Unknown Source)

[16/05/07 12:38:03:027 BST] 0000003c SystemErrR at com.ibm.crypto.provider.DESCipher.engineDoFinal(Unknown Source)

[16/05/07 12:38:03:027 BST] 0000003c SystemErrR at com.ibm.crypto.provider.DESCipher.engineDoFinal(Unknown Source)

[16/05/07 12:38:03:027 BST] 0000003c SystemErrR at javax.crypto.Cipher.doFinal(Unknown Source)

[3556 byte] By [vishal2007a] at [2007-11-27 5:13:03]
# 1
I don't know the conditions under which you get the IllegalBlockSizeException problem but you will have problems because BASE64Encoder and BASE64Decoder are probably not thread safe and your code assumes they are.
sabre150a at 2007-7-12 10:34:27 > top of Java-index,Security,Cryptography...
# 2
sabreCan you please explain in detail thanksvishal
vishal2007a at 2007-7-12 10:34:27 > top of Java-index,Security,Cryptography...
# 3

> sabre

>

> Can you please explain in detail

I thought I had done! The BASE64 classes are probably not thread safe and you assume they are since the instances you create are static and will be shared by ALL threads using that particular servlet. It may not be the cause of your problem but since you don't say under what conditions you get the problem I can't really make any further comment.

P.S. You should move the code to extract the key out of the encrypt and decrypt methods then you will be able to test the metheds without carrying around the baggage associated with the Servlet.

sabre150a at 2007-7-12 10:34:27 > top of Java-index,Security,Cryptography...
# 4
sabrebase64 class does not contain any class level variables, from this object we call a function encode(), if 2 threads invoke encode() on the same object, then they will definitely run in separate scope. So probably that might not be the case, thats my thoght.
vishal2007a at 2007-7-12 10:34:27 > top of Java-index,Security,Cryptography...
# 5
> sabre> > base64 class does not contain any class level> variables,How do you know - they are Sun private classes?Edit : I have just checked and the BASE64 decoder is not thread safe.Message was edited by: sabre150
sabre150a at 2007-7-12 10:34:27 > top of Java-index,Security,Cryptography...
# 6

If one moves the Servlet stuff out of the encrypt() and decrypt() methods then your code seems to work (at least in single thread mode). I do have some other reservations -

1) On encryption you use the platform default character encoding to convert the String to bytes but on decryption you force the encoding to ASCII.

2) I don't seen why you need to change the '+' chars in the Base64 encoded data to '$' chars since you URL encode the result anyway.

3) I don't see why you need to test for % to decide whether or not to URL decode because by appending '@' the last character is ALWAYS converted to %40 so you always have a % char in the string.

4) I don't see why the StringTokenizer is used in the decrypt() method. I would expect this preprocessing to be performed outside of the decrypt() method since it has nothing to do with encrypting the data.

5) You have an unused static SecretKey variable.

Message was edited by:

sabre150

sabre150a at 2007-7-12 10:34:27 > top of Java-index,Security,Cryptography...
# 7
Once more - why do I bother?
sabre150a at 2007-7-12 10:34:27 > top of Java-index,Security,Cryptography...