I have a program that makes a call to an SQL database. I cannot use SSH to connect to it (as far as I am aware) or any other more secure method, so Java's SQL connector was used. As the connection requires a username/password, and I want to store the user/pass for ease of making the connection. I knew I was not going to store the password in plain text, but I couldn't find a method of doing so in a secure manner in a platform-independent way in core Java, so I rolled my own (not advised in crypto, I know).
Below is the code that encrypts a message of any length with a key of any length.
private static String xor(String message, String key){
if(message.isEmpty())
return "";
byte[] xorBlob=new byte[message.length()];
long seed=0;
for(char c: key.toCharArray())
seed+=c;
new Random(seed).nextBytes(xorBlob);
char[] mArr=message.toCharArray();
for(int i=0;i<mArr.length;i++)
mArr[i]=(char)(mArr[i]^xorBlob[i]);
return new String(mArr);
}
To put the above code into words: It sums up all the char values of the given key into an int. That int is then used as the seed for the Random function, which then spits out an array of bytes the length of the message. The message and that byte array are then xor'd together.
It's rudimentary, but I figured for opt-in local storage of a password for the current user, it should suffice.
Is this a good method of doing so? Is there a way I can improve this code, for either more security or just better code to more fit industry standards?
EDIT: Here's the code that calls the above function:
FileWriter writer=new FileWriter(config);
writer.write(String.format("username=%s%n", username));
writer.write(String.format("password=%s%n", xor(password, username)));