wierd error

am doin this application that has a n applet ... the applet sends a few info. to the servlert....servelet encrypts the ino on its side and sends the encrypted info back to the client......the client side applet is able to print the encrypted variable from the servlet......but when it decrypts it on the client side i seem to get null as the answer.......i have included my code..........

could plz anyone help me outta this......am stuck

merci

my code for encryption n decryption

import javax.crypto.Cipher;

import javax.crypto.SecretKey;

import javax.crypto.SecretKeyFactory;

import javax.crypto.IllegalBlockSizeException;

import javax.crypto.spec.PBEKeySpec;

import javax.crypto.spec.PBEParameterSpec;

import java.security.spec.KeySpec;

import java.security.spec.AlgorithmParameterSpec;

import java.io.UnsupportedEncodingException;

/**

* Created by IntelliJ IDEA.

* User: Administrator

* Date: Mar 10, 2005

* Time: 4:07:24 PM

* To change this template use File | Settings | File Templates.

*/

public class EncryptDecryptDes {

// 8-byte Salt

static byte[] salt = {

(byte)0xc7, (byte)0x73, (byte)0x21, (byte)0x8c,

(byte)0x7e, (byte)0xc8, (byte)0xee, (byte)0x99

};

// Iteration count

static int count = 20;

public String encrypt(String toEncrypt,String passPhrase) {

try {

PBEParameterSpec pbeParamSpec = new PBEParameterSpec(salt, count);

PBEKeySpec pbeKeySpec = new PBEKeySpec(passPhrase.toCharArray());

SecretKeyFactory keyFac = SecretKeyFactory.getInstance("PBEWithMD5AndDES");

SecretKey pbeKey = keyFac.generateSecret(pbeKeySpec);

Cipher pbeCipher = Cipher.getInstance("PBEWithMD5AndDES");

pbeCipher.init(Cipher.ENCRYPT_MODE, pbeKey, pbeParamSpec);

// encrypt

byte[] output = pbeCipher.doFinal(toEncrypt.getBytes());

// write encrypted output

System.out.println("encrypted stuff : " + new String(output));

} catch (javax.crypto.BadPaddingException e) {

} catch (IllegalBlockSizeException e) {

} catch (java.security.InvalidAlgorithmParameterException e) {

} catch (java.security.spec.InvalidKeySpecException e) {

} catch (javax.crypto.NoSuchPaddingException e) {

} catch (java.security.NoSuchAlgorithmException e) {

} catch (java.security.InvalidKeyException e) {

}

return null;

}

public String decrypt(String toDecrypt,String passPhrase) {

try {

PBEParameterSpec pbeParamSpec = new PBEParameterSpec(salt, count);

PBEKeySpec pbeKeySpec = new PBEKeySpec(passPhrase.toCharArray());

SecretKeyFactory keyFac = SecretKeyFactory.getInstance("PBEWithMD5AndDES");

SecretKey pbeKey = keyFac.generateSecret(pbeKeySpec);

Cipher pbeCipher = Cipher.getInstance("PBEWithMD5AndDES");

pbeCipher.init(Cipher.DECRYPT_MODE, pbeKey, pbeParamSpec);

byte[] decr = pbeCipher.doFinal(toDecrypt.getBytes());

System.out.println("decrypted stuff : " + new String(decr));

} catch (javax.crypto.BadPaddingException e) {

} catch (IllegalBlockSizeException e) {

} catch (java.security.InvalidAlgorithmParameterException e) {

} catch (java.security.spec.InvalidKeySpecException e) {

} catch (javax.crypto.NoSuchPaddingException e) {

} catch (java.security.NoSuchAlgorithmException e) {

} catch (java.security.InvalidKeyException e) {

}

return null;

}

}

this would be my client applet

import java.sql.Connection;

import java.util.*;

import java.awt.event.*;

import java.awt.*;

import javax.swing.*;

import java.awt.*;

import java.awt.event.*;

import java.net.*;

import java.io.*;

import java.applet.*;

public class client2 extends Applet implements ActionListener {

String us;

TextField userName, seqNum;

TextField password, session;

Button login;

packet1 clientPacket;

public void init() {

setLayout(new BorderLayout());

Panel west = new Panel();

west.add(new Label("user name:"));

add("West", west);

Panel center = new Panel();

userName = new TextField(20);

center.add(userName);

add("Center", center);

password = new TextField(20);

center.add(password);

add("Center", center);

session = new TextField(20);

center.add(session);

add("Center", center);

seqNum = new TextField(20);

center.add(seqNum);

add("Center", center);

Panel south = new Panel();

login = new Button("login");

login.addActionListener(this);

south.add(login);

add("South", south);

}

public void actionPerformed(ActionEvent event) {

try {

getAppletContext().showStatus(userName.getText());

String user = userName.getText();

Random r = new Random();

String seqNo = String.valueOf(r.nextInt());

String strToServlet = user + ":" + seqNo;

URL url = new URL("http://localhost:80/servlet/server2?s=" + strToServlet);

URLConnection con1 = url.openConnection();

con1.setDoInput(true);

con1.setDoOutput(true);

con1.setRequestProperty("Content-Type", "application/x-java-serialized-object");

InputStream in = con1.getInputStream();

BufferedReader br = new BufferedReader(new InputStreamReader(in));

String encUser = br.readLine();

password.setText(encUser);

String seqNoCopy = br.readLine();

session.setText(seqNoCopy);

// seqNum.setText(decUser);

EncryptDecryptDes dec = new EncryptDecryptDes();

//String toDec=password.getText();

String decUser = dec.decrypt(encUser, "123");

System.out.println("dec username" +decUser);

br.close();

} catch (Exception ex) {

ex.printStackTrace();

}

}

}

sorry for such a long code

[6012 byte] By [avaj_rocksa] at [2007-10-1 10:40:33]
# 1

>

> } catch (javax.crypto.BadPaddingException

> ngException e) {

>} catch (IllegalBlockSizeException e) {

> } catch

> } catch

> ch (java.security.InvalidAlgorithmParameterException

> e) {

> } catch

> } catch

> tch (java.security.spec.InvalidKeySpecException e) {

> } catch

>} catch (javax.crypto.NoSuchPaddingException e) {

> } catch

> } catch (java.security.NoSuchAlgorithmException e)

> e) {

> } catch (java.security.InvalidKeyException

> eyException e) {

>}

>return null;

>}

Ask yourself what will be the result for the decryption if you get one of the exceptions that you silently ignore.

In some countries, exception handling like this is punished by castration!

sabre150a at 2007-7-10 3:08:18 > top of Java-index,Security,Signed Applets...
# 2

Wow, it gets better! Your encyption method declares that it returns a String yet the only return statement returns null!

>

> public String encrypt(String toEncrypt,String

...

>return null;

>}

And similarly with the decrypt() method.

Also, I see nothing to convert you encrypted data to a String. There is an implied convertion using new String(encrypted bytes) but if you search the 'cryptography' forum you will find that this is very close to being the number 1 source of encryption/decryption problems.

Why not concentrate on a simple stand alone example of encryption and decryption rather than trying to 'big bang' your whole solution.

sabre150a at 2007-7-10 3:08:18 > top of Java-index,Security,Signed Applets...