GZIP and Blowfish!

Hi everybody!

Is there anybody who could help me with this?

One thing I noticed was that this works a little better with JDK 5.0 than with JDK 1.3.1 (which is the version used by the caller of this program).

I would appreciate if somebody could take a look at this and provide some tips on some potential root causes.

Thanks in advance!

coderiyer

coderiyera at 2007-7-14 19:38:41 >

Later .. you definitely need to do the fix above. You also need quite a few more "UTF-8" specifications and there is something asymmetric about your handling of "gh=" - where does this come from? Step 3 is unnecessary. I would also hope that returning null isn't the real way you handle exceptions: all these exceptions should be thrown by the methods concerned, not caught.

I would omit the URLDecoder step altogether - the result of that isn't necessarily a valid URL. And if you do that you should omit step (3) as well, it is redundant.

ejpa at 2007-7-14 19:38:41 >

I've fixed the bad conversion of binary to String and back I mentioned, and eliminated step (3) and the URLDecode. I'm running a test at the moment with random data. I've just got up to 228,000 successful cycles with no failures. The test will keep running to a million but it looks good so far. The only other concern is that I'm using a fixed-length initial URL as I got the impression from your OP that this was the case.

ejpa at 2007-7-14 19:38:41 >

Well just to prove I do post code occasionally here it is. Note that I've deleted the addition of the Sun provider, which doesn't seem to be necessary, and that I'm using DES instead of Blowfish, and probably a different Base64 class than you have, but the principles are clear. The String/binary thing I was worried about was in the decrypt method. Note that I added some stuff about "gh=" including a +3 that you will probably want to delete again. I've also fixed all the exception handling according to my lights.

/*

* GZipURLTest.java

*

* Created on 16 August 2006, 12:27

*/

import java.io.*;

import java.net.*;

import java.security.*;

import java.security.*;

import java.util.*;

import java.util.zip.*;

import javax.crypto.*;

import javax.crypto.spec.*;

import sun.misc.*;

public class GZipURLTest

{

static class BlowFishUtil

{

static

{

//Provider sunJCE = new com.sun.crypto.provider.SunJCE();

//Security.addProvider(sunJCE);

}

// encryptSecretKey - uses javax.crypto.SecretKey to encrypt a java.util.String. It returns

//this string as a byte array.

//

public static byte[] encryptSecretKey(byte[] keyBytes, byte[] unencrypted) throws GeneralSecurityException

{

SecretKeySpec skeySpec = new SecretKeySpec(keyBytes, "DES");

Cipher cipher = Cipher.getInstance("DES");

cipher.init(Cipher.ENCRYPT_MODE, skeySpec);

byte[] myEncrypt = cipher.doFinal(unencrypted);

//System.out.println("encrypt length: "+myEncrypt.length);

return myEncrypt;

}

//

// decryptSecretKey - uses a java.crypto.SecretKey to decrypt a byte array of encrypted characters

//

public static byte[] decryptSecretKey(byte[] keyBytes, byte[] encrypted) throws GeneralSecurityException

{

SecretKeySpec skeySpec = new SecretKeySpec(keyBytes, "DES");

Cipher cipher = javax.crypto.Cipher.getInstance("DES");

cipher.init(javax.crypto.Cipher.DECRYPT_MODE, skeySpec);

byte[] decrypted = cipher.doFinal(encrypted);

return decrypted;

}

}

static class Base64

{

static BASE64Encoder enc = new BASE64Encoder();

static BASE64Decoder dec = new BASE64Decoder();

static String encodeBytes(byte[] bytes)

{

return enc.encode(bytes);

}

static byte[]decodeToBytes(String string) throws IOException

{

byte[]decoded = dec.decodeBuffer(string);

return decoded;

}

static StringdecodeToString(String string) throws IOException

{

byte[]decoded = dec.decodeBuffer(string);

return new String(decoded,0,decoded.length,"UTF-8");// dubious

}

}

static BlowFishUtil bfUtil = new BlowFishUtil();

public static String encryptPayload(String payload, String authKey) throws Exception

{

String sCheckSum= getMD5Checksum(payload);

String encodeBuffer = sCheckSum + "gh="+payload;

//encodeBuffer= URLEncoder.encode(encodeBuffer);// why?

byte[] aryEncodeBuf = zipIt(encodeBuffer);

aryEncodeBuf= bfUtil.encryptSecretKey(authKey.getBytes("UTF-8"),aryEncodeBuf);

encodeBuffer= Base64.encodeBytes(aryEncodeBuf);

encodeBuffer= URLEncoder.encode(encodeBuffer);

return encodeBuffer;

}

public static String decryptPayload(String payload, String authKey) throws Exception

{

String decodeBuffer = "";

BlowFishUtil bfUtil = new BlowFishUtil();

decodeBuffer = URLDecoder.decode(payload);

//decodeBuffer = Base64.decodeToString(decodeBuffer);

//byte[] aryDecodeBuf = bfUtil.decryptSecretKey(authKey.getBytes("UTF-8"), decodeBuffer.getBytes("UTF-8"));

byte[] decodedBytes = Base64.decodeToBytes(decodeBuffer);

byte[] aryDecodeBuf = bfUtil.decryptSecretKey(authKey.getBytes("UTF-8"), decodedBytes);

aryDecodeBuf = unzipIt(aryDecodeBuf);

String sBuf = new String(aryDecodeBuf,0,aryDecodeBuf.length,"UTF-8");

//sBuf = URLDecoder.decode(sBuf);

int iPos = sBuf.indexOf("gh=");

if (iPos>=0)

{

String sURLCheckSum = sBuf.substring(0,iPos);

sBuf= sBuf.substring(iPos+3,sBuf.length());

String sCheckSum= getMD5Checksum(sBuf);

if (!sCheckSum.equals(sURLCheckSum))

{

System.out.println("checksum failure on '"+sBuf+"': "+sCheckSum+"; "+sURLCheckSum);

}

}

return new String(sBuf);

}

private static String getMD5Checksum(String mess)

throwsGeneralSecurityException,

UnsupportedEncodingException

{

String hexHashCode = "";

//String hashCode = "";

MessageDigest md = MessageDigest.getInstance("MD5");

byte[] message = mess.getBytes("UTF-8");

md.update( message );

byte[] hash = md.digest();

for ( int i=0; i < hash.length; i++ )

{

int x = hash[i] & 0xFF;

if (x < 0x10)

{

hexHashCode += "0";

}

hexHashCode += (Integer.toHexString(x));

//hashCode += hash[i]+" _ ";

}

return hexHashCode;

}

private static byte[] zipIt(String parameterString) throws IOException

{

byte[] zipped;

ByteArrayOutputStream catcher = new ByteArrayOutputStream();

GZIPOutputStream gzipOut = new GZIPOutputStream(catcher);

byte[] bytesToZip = parameterString.getBytes("UTF-8");

gzipOut.write( bytesToZip, 0, bytesToZip.length );

gzipOut.close();

return catcher.toByteArray();

}

private static byte[] unzipIt(byte[] buffer) throws IOException

{

ByteArrayOutputStream outBuffer = new ByteArrayOutputStream();

ByteArrayInputStream inBuffer = new ByteArrayInputStream(buffer);

GZIPInputStream gzip = new GZIPInputStream(inBuffer);

byte[] tmpBuffer = new byte[256];

int n;

while ((n = gzip.read(tmpBuffer)) >= 0)

{

outBuffer.write(tmpBuffer, 0, n);

}

return outBuffer.toByteArray();

}

public static voidmain(String[] args) throws Exception

{

Randomrandom = new Random();

intfailures = 0;

byte[]data = new byte[253];

Thread.currentThread().setPriority(Thread.MIN_PRIORITY);

for (int i = 0; i < 1000000; i++)

{

if ((i % 1000) == 0)

System.out.println(i);

try

{

StringurlString = "http://www.telekinesis.com.au/People/Esmond%20Pitt/";

random.nextBytes(data);

urlString += Base64.encodeBytes(data);

urlString += "#1961&arg1=1&arg2=2";

URLurl = new URL(urlString);

Stringkey = "password";

Stringencrypted = encryptPayload(urlString,key);

Stringdecrypted = decryptPayload(encrypted,key);

//System.out.println(urlString+": decrypted to: "+decrypted);

//System.out.println(new URL(decrypted));

Thread.sleep(2);

}

catch (Exception exc)

{

exc.printStackTrace();

failures++;

}

}

System.out.println("1000000 trials "+failures+" failures");

}

}

Some hours later: it's up to 800,000 iterations and no failures.

Message was edited by:

ejp

Later still: 1,000,000 trials, zero failures.

Message was edited by:

ejp

ejpa at 2007-7-14 19:38:41 >

Hi ejp!

I really appreciate your help.

I removed the zip/unzip from the encryptPayload/decryptPayload methods. I am not able to access the page using the encrypted URL after removing the zipping method. Could you briefly outline the steps needed to generate a valid URL both on the encryption/decryption programs?

Thanks again for all your help.

coderiyer

coderiyera at 2007-7-21 9:56:19 >