base64 encoding js issue

Question

I am using AES for encrypting and decrypting my password. What I am trying to implement is that that I need to store the encrypted password at the client side in the form of a cookie and then when the client logs in again into my website I need to get that encrypted password from the client side and decrypt it to check it against the unencrypted password provided by the client. The problem I am facing is that while encryption I convert byte array of the encrypted password to string using BASE64.encodeString() in java so that it could be passed to the client side. But when I get the same string from the client side, i.e from the cookie and try to decrypt it, it gives me padding error, i.e. javax.crypto.illegalBlockSizeException : Input length must be multiple of 16 when decrypting with padded cipher .

Why is it happening?

Code for encryption :

  Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
            cipher.init(Cipher.ENCRYPT_MODE, skeySpec, ivspec);
            byte[] plainBytes = Data.getBytes(UNICODE_FORMAT);
            byte[] encrypted = cipher.doFinal(plainBytes);
            String encryption = Base64.encodeBase64String(encrypted);
            return encryption;

Code for decryption :

Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
        cipher.init(Cipher.DECRYPT_MODE, skeySpec, ivspec);
        byte[] decryptval = Base64.decodeBase64(encryptedData);
        byte[] decrypted = cipher.doFinal(decryptval);
        return new String(decrypted);

Is the error coming because I am passing the encrypted string to the js to be stored in cookie.?? does JS fiddle with the base64encoded string?

What if a hacker reads that base64 string and connect to your application pretend to be the real user? — DiogoSantana
– DiogoSantana, Commented Mar 28, 2013 at 6:24
I am assigning a different token for every run of the encryption algorithm.. also a series identifier is there is to check whether there has been a breach of security or not.. — Mitaksh Gupta
– Mitaksh Gupta, Commented Mar 28, 2013 at 6:38

DoubleFission · Accepted Answer · 2013-03-28 06:50:41Z

1

I STRONGLY advise against using a cipher to store/transmit passwords.

A Hash function is a much safer idea. The difference between a Cipher and a Hash is that a Cipher is reversible, whilst a Hash is one way (Plaintext -> Hashtext). Storing your users passwords on the server in a)plaintext or b)encrypted is a big no-no in terms of security.

A Hash on the other hand cannot be reversed; (Theoretically at least)

A simple hash can be done just as easily using the MessageDigest class

Getting a Hash can be pretty simple:

Message Digest md = MessageDigest.getInstance("MD5");
md.digest(input.getBytes());

The client side can then hash the plaintext password to send across to the Server. Then the server can compare hashes to authenticate and return a session token to the user which they can use for the rest of the session without having to transmit passwords all around the place.

answered Mar 28, 2013 at 6:50

DoubleFission

1111 bronze badge

Sign up to request clarification or add additional context in comments.

1 Comment

Sudhanshu Umalkar Over a year ago

Hash is good when you only want to check for password validity. But in some scenarios you may be required to decrypt the stored password - like if you are storing a db password (encrypted) in the file and want to decrypt and use it for connecting.

Sudhanshu Umalkar · Accepted Answer · 2013-03-28 06:21:36Z

0

Try using the following method to convert bytes to string while encryption -

public static String bytesToString(byte[] bytes) {
    HexBinaryAdapter adapter = new HexBinaryAdapter();
    String s = adapter.marshal(bytes);
    return s;
}

So instead of -

String encryption = Base64.encodeBase64String(encrypted);

Use

String encryption = bytesToString(encrypted);

Similarly, during decryption use this method -

public static byte[] hexToBytes(String hexString) {
    HexBinaryAdapter adapter = new HexBinaryAdapter();
    byte[] bytes = adapter.unmarshal(hexString);
    return bytes;
}

That is -

byte[] decryptval = hexToBytes(encryptedData);

answered Mar 28, 2013 at 6:21

Sudhanshu Umalkar

4,2021 gold badge26 silver badges33 bronze badges

5 Comments

Mitaksh Gupta Over a year ago

it is giving an illegalArgumentExeption : hexBinary needs to be of even length.. I checked that the value being passed to js and received from it are the same.

Sudhanshu Umalkar Over a year ago

What's the length of the encryption key - should be 16.

Mitaksh Gupta Over a year ago

I am using key generator which generates the key as a byte array.. if I print that byte array it is 11 characters in length. Also am using SecretKeySpec which is used while initializing the cipher as you can see in my encryption code for that I need my key to be in the form a byte array.

Sudhanshu Umalkar Over a year ago

Key key = new SecretKeySpec("abcdefghijklmnop".getBytes("UTF-8"), algorithm); // can you try something like this, check the key string, it is 16 characters in length

Mitaksh Gupta Over a year ago

It worked fine @sudhanshu.. There was the issue with the data I was sending through JS too.. I fixed that and then this solution worked fine.. Thanks!

Collectives™ on Stack Overflow

base64 encoding js issue

2 Answers 2

1 Comment

5 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

5 Comments

Your Answer

Sign up or log in

Post as a guest

Related