1
String text = name1.getText().toString();
    // Sending side
    byte[] data = null;
    try {
        data = text.getBytes("UTF-8");
    } catch (UnsupportedEncodingException e1) {
    e1.printStackTrace();
    }
    String base64 = Base64.encodeToString(data, Base64.DEFAULT);

was able to encrypt password and will to decrypt the same password but i have something in mind that im not sure of this is my first time trying to encrypt a password. Is it safe to encrypt the password this way because I tried encrypt a password : zxc and the result is just a four letter password (its result is : enhj) so im wondering if it is a safe way to encrypt the password. Any ideas on how to remake the code to make it safer and not easy to decode and ideas on how to decrypt the encrypted password?

UPDATE: This is a sample of encryption and decryption I found at this site here but I cant make it run.

encryption

String password  = "password";
int iterationCount = 1000;
int keyLength = 256;
int saltLength = keyLength / 8; // same size as key output

SecureRandom random = new SecureRandom();
byte[] salt = new byte[saltLength];
randomb.nextBytes(salt);
KeySpec keySpec = new PBEKeySpec(password.toCharArray(), salt,
                    iterationCount, keyLength);
SecretKeyFactory keyFactory = SecretKeyFactory
                    .getInstance("PBKDF2WithHmacSHA1");
byte[] keyBytes = keyFactory.generateSecret(keySpec).getEncoded();
SecretKey key = new SecretKeySpec(keyBytes, "AES");

Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
byte[] iv = new byte[cipher.getBlockSize());
random.nextBytes(iv);
IvParameterSpec ivParams = new IvParameterSpec(iv);
cipher.init(Cipher.ENCRYPT_MODE, key, ivParams);
byte[] ciphertext = cipher.doFinal(plaintext.getBytes("UTF-8"));

decryption

String[] fields = ciphertext.split("]");
byte[] salt = fromBase64(fields[0]);
byte[] iv = fromBase64(fields[1]);
byte[] cipherBytes = fromBase64(fields[2]);
// as above
SecretKey key = deriveKeyPbkdf2(salt, password);

Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
IvParameterSpec ivParams = new IvParameterSpec(iv);
cipher.init(Cipher.DECRYPT_MODE, key, ivParams);
byte[] plaintext = cipher.doFinal(cipherBytes);
String plainrStr = new String(plaintext , "UTF-8");

2 Answers 2

9

You've tagged this cryptography, passwords, and encryption, so I'll answer it as such.

First, Base64 is not actually encryption, it's merely encoding - essentially changing from 8 bit bytes to 6 bit bytes, and your test is perfect - 3*8 bit characters = 24 bits. 24bits/6bits = 4 Base64 characters. I've also verified that enhj is indeed the Base64 encoding of zxc on my own C implementation of Base64. For further evidence of this, note that you didn't provide any encryption key!

Second, for user authentication (which is what I assume you're doing), do not encrypt passwords - that's a major blunder Adobe just made. For user authentication, you don't ever need to see the user's password again - you merely need to verify that they entered the same thing they did before. Thus, when they enter a password the first time, you salt and hash it. The next time, you retrieve the salt you used the first time, and hash the freshly entered password with the same salt (and # of iterations/work factor) - if the result is the same as you have on record, let them in, since giving the same password will get the same result.

The three canonical answers to How to securely hash passwords? are PBKDF2, Bcrypt, and Scrypt. A quick Google search regarding Android password hashing turned up:

In ALL cases, choose as high an iteration count/work factor as you can stand the delay of (using as fast a library for your chosen algorithm as you can abide by the license of). Your salt should be a cryptographically random series of bytes in the 8 to 16 byte length range.

For PBKDF2 in particular, never use more outputBytes than the native hash size or you give an attacker a comparative advantage - SHA-1's native size is 20 bytes, SHA-256 is 32 bytes, and SHA-512 is 64 bytes natively.

If you really do need encryption rather than authentication, the "Using Cryptography to Store Credentials Safely" link above covers that too, though the better answer is to store the salt and number of iterations/work factor and simply regenerate the key from the password each time - if the data decrypts, it was good. If not, well, bad password.

7
  • Wow you wrote so much. You deserve +1 Commented Mar 15, 2014 at 3:28
  • i will further study your answer so that i can implement it on my program you are right about the authentication thing i thought it would be best to encrypt password and i didn't even realize that this is not an encrypt i just searched it on Google and it gave me this result so i tried it on my sample project.in any case i will give you a + 1 for the effort you showed me on the right things to do.i hope i can make it work and i will come back on you on it since i still have no idea about salt and the things you said on the answer
    – Giant
    Commented Mar 15, 2014 at 3:38
  • 2
    Read at least Thomas Porrin's answer to How to Securely Hash Passwords - that's a very good primer. Commented Mar 15, 2014 at 3:44
  • if you may i want to ask what would you suggest me to do hash the password of the registered user in my sample app or just use the one that i found and just encode the password then when the user logs-in or changepassword i will just encode again the entered password and compare the password to the one in my database to authenticate if the password is the same
    – Giant
    Commented Mar 15, 2014 at 3:49
  • 1
    On a password change/password setting 1) generate a random salt 8-16 bytes, 2) hash with PBKDF2-HMAC-SHA-256 or PBKDF2-HMAC-SHA-1 or BCrypt and as many iterations/work factor as you can spend time for, 3) store the username (plaintext), salt (plaintext), and iterations/work factor and the resultant hash. OPTIONAL: Base64 the results before storage. When a user wants to log in with an existing password, 1) retrieve the salt and iterations/work factor for that username, 2) hash whatever the entered using the same salt and iterations/work factor, 3) compare to has. Adv: constant time compare. Commented Mar 15, 2014 at 14:24
1

You are not encrypting anything. You are converting bytes to base64 encoding. You need to use a ciphering algorithm. See http://examples.javacodegeeks.com/core-java/security/simple-symmetric-key-encrypt-decrypt/

1
  • i wasnt able to check this one but i think you share the same idea with the previous answer so +1 on you mate :)
    – Giant
    Commented Mar 17, 2014 at 2:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.