Light Security Local-Machine Password Encryption

Question

I have a program that makes a call to an SQL database. I cannot use SSH to connect to it (as far as I am aware) or any other more secure method, so Java's SQL connector was used. As the connection requires a username/password, and I want to store the user/pass for ease of making the connection. I knew I was not going to store the password in plain text, but I couldn't find a method of doing so in a secure manner in a platform-independent way in core Java, so I rolled my own (not advised in crypto, I know).

Below is the code that encrypts a message of any length with a key of any length.

private static String xor(String message, String key){
    if(message.isEmpty())
        return "";
    byte[] xorBlob=new byte[message.length()];
    long seed=0;
    for(char c: key.toCharArray())
        seed+=c;
    new Random(seed).nextBytes(xorBlob);
    char[] mArr=message.toCharArray();
    for(int i=0;i<mArr.length;i++)
        mArr[i]=(char)(mArr[i]^xorBlob[i]);
    return new String(mArr);
}

To put the above code into words: It sums up all the char values of the given key into an int. That int is then used as the seed for the Random function, which then spits out an array of bytes the length of the message. The message and that byte array are then xor'd together.

It's rudimentary, but I figured for opt-in local storage of a password for the current user, it should suffice.

Is this a good method of doing so? Is there a way I can improve this code, for either more security or just better code to more fit industry standards?

EDIT: Here's the code that calls the above function:

FileWriter writer=new FileWriter(config);
writer.write(String.format("username=%s%n", username));
writer.write(String.format("password=%s%n", xor(password, username)));

Answer 1

I'd suggest using built-in libraries, especially if you're looking to solve something for production/industry. Quick search shows that there are two to consider that should be available within JDK, the JCA (Java Cryptography Architecture) for local storage of secrets, and JSSE (Java Secure Socket Extension) for comunicating with the remote service.

The JCA is a major piece of the platform, and contains a "provider" architecture and a set of APIs for digital signatures, message digests (hashes), certificates and certificate validation, encryption (symmetric/asymmetric block/stream ciphers), key generation and management, and secure random number generation, to name a few...

The Java Secure Socket Extension (JSSE) enables secure Internet communications. It provides a framework and an implementation for a Java version of the SSL, TLS, and DTLS protocols and includes functionality for data encryption, server authentication, message integrity, and optional client authentication...

Utilizing the documentation for local encryption, and examples scattered about, may cause one to write code similar to...

//  Helpful resources
// https://docs.oracle.com/javase/8/docs%2Ftechnotes%2Fguides%2Fsecurity%2Fcrypto%2FCryptoSpec.html#PBEEx
// https://stackoverflow.com/questions/4644415/java-how-to-get-input-from-system-console
// https://www.tutorialspoint.com/check-if-a-string-is-empty-or-null-in-java
// https://stackoverflow.com/questions/18142745/how-do-i-generate-a-salt-in-java-for-salted-hash


import javax.crypto.spec.PBEKeySpec;
import javax.crypto.spec.PBEParameterSpec;
import javax.crypto.SecretKeyFactory;
import javax.crypto.Cipher;
import javax.crypto.SecretKey;

import java.security.SecureRandom;

import java.io.Console;


class pass_enc {

  public static void main(String[] args) throws Exception {
    Console console = System.console();
    if (console == null) {
      System.out.println("Unable to fetch console!");
      return;
    }

    PBEKeySpec pbeKeySpec;
    PBEParameterSpec pbeParamSpec;
    SecretKeyFactory keyFac;

    // Salt
    byte[] salt = new SecureRandom().nextBytes(salt);

    // Iteration count
    int count = 1000;

    // Create PBE parameter set
    pbeParamSpec = new PBEParameterSpec(salt, count);

    // Prompt for encryption password
    // Use char array because String objects are immutable
    // Convert to SecretKey object using PBE key factory
    char[] password = console.readPassword("Enter a passphrase: ");
    // char[] password = System.console.readPassword("Enter a passphrase: ");
    pbeKeySpec = new PBEKeySpec(password);
    keyFac = SecretKeyFactory.getInstance("PBEWithHmacSHA256AndAES_256");
    SecretKey pbeKey = keyFac.generateSecret(pbeKeySpec);

    // Create PBE Cipher
    Cipher pbeCipher = Cipher.getInstance("PBEWithHmacSHA256AndAES_256");

    // Initalize PBE Cipher with key and parameters
    pbeCipher.init(Cipher.ENCRYPT_MODE, pbeKey, pbeParamSpec);

    // Cleartext to be encrypted
    byte[] cleartext = "This is an example".getBytes();

    // Encrypt cleartext
    byte[] ciphertext = pbeCipher.doFinal(cleartext);

  }

}

... though the compiler will complain about salt being void; Java isn't a language that I write a whole lot in but perhaps the above code will get ya a little closer to something that preforms the necessary steps more securely. Edits and comments are certainly welcomed if someone does figure out how to get Oracle's example code working as intended.

Answer 2

As you stated, you probably shouldn't roll your own. Have you considered using a key vault?

https://www.vaultproject.io/