Java Development

[jlfrias]

Hi Guys, I need any suggestion about the following case.

Notes:

1. I have an application developed on BB JE 4.6.1 that work with a Web Services. The web service was developed on ASP.NET, C# and SQL Server.

2. My application have a screen of configuration, in this screen, the user can enter your username and password. This data are send to web services across of https connection.

3. The web service received a URL with this values (username and password).

I need send the password encrypted to the Web Services and web services should decryption password.

Which is the method or function for encrypt/decrypt en two diferent technologies? (encrypt on BB JDE 4.6.1, Decrypt the same passowrd on ASP.NET C#.

Please help me.

thanks.

Jorge Luis

[jlfrias]

Hi team, any suggestions?

Best Regards

Jorge Luis Frias.

[BBDeveloper]

If you are using the common encryption and decryption algorithm example like MD5 on device and on web side then should not be any problem.

[jlfrias]

Thanks for yout help.

I am new with topics aboit encryption/decryption.

I have the following code for test the TRIPLEDESKey. I am use the Key Static, the same key is used on Web Side, this is correct or you have any siggestion or example.

Thanks for your valious help.

/**
 * CryptoDemo.java
 * A simple crypto example
 *
 * Copyright © 1998-2008 Research In Motion Ltd.
 * 
 * Note: For the sake of simplicity, this sample application may not leverage
 * resource bundles and resource strings.  However, it is STRONGLY recommended
 * that application developers make use of the localization features available
 * within the BlackBerry development platform to ensure a seamless application
 * experience across a variety of languages and geographies.  For more information
 * on localizing your application, please refer to the BlackBerry Java Development
 * Environment Development Guide associated with this release.
 */

package com.rim.samples.device.cryptodemo;

import java.io.*;
import net.rim.device.api.crypto.*;
import net.rim.device.api.util.*;
import net.rim.device.api.ui.*;
import net.rim.device.api.ui.component.*;
import net.rim.device.api.ui.container.*;

/**
 * This class provides demonstrates basic functionality of the crypto library with
 * a very basic compilation of cypto code.  For more information on how to write 
 * crypto code please see the javadocs and check out our tutorial in the Developers
 * Knowledge Base. The javadocs contain additional sample code to assist you.
 */
class CryptoDemo extends UiApplication
{
    
    private RichTextField _status;

    /**
     * Entry point for Application.
     */
    public static void main( String[] args )
    {
        CryptoDemo theApp = new CryptoDemo();
        theApp.enterEventDispatcher();
    }

    /**
     * Constructor
     */
    private CryptoDemo()
    {
        MainScreen screen = new MainScreen();
        screen.setTitle(new LabelField("Crypto Demo", LabelField.ELLIPSIS | LabelField.USE_ALL_WIDTH));

        _status = new RichTextField("Select 'Go' from the menu to perform the test.");
        screen.add(_status);
        
        // Add the menu item.
        screen.addMenuItem(new MenuItem("Go" , 100, 10)
        {
            public void run()
            {
                go();
            }
        });

        pushScreen(screen);
    }

    /**
     * <p> The test method containing the sample code.
     * <p> We want to create a sample that will encrypt and decrypt
     * test data to demonstrate how a simple crypto example can be
     * implemented.
     */
    private void go()
    {
        try 
        {
            // We are going to use TripleDES as the algorithm for encrypting and decrypting 
            // the data. It is a very common algorithm and was chosen for this reason.

            // Here is the data that we are going to encrypt.
            String message = "jorge";

            byte[] ba = "70789198PABLOHERBASCAMPOS".getBytes();
                        
            // Create a new random TripleDESKey.
            TripleDESKey key = new TripleDESKey(ba);
              
                       
            // Create the encryption engine for encrypting the data.
            TripleDESEncryptorEngine encryptionEngine = new TripleDESEncryptorEngine( key );

            // Due to the fact that in most cases the data that we are going to encrypt will
            // not fit perfectly into the block length of a cipher, we want to use a padding
            // algorithm to pad out the last block (if necessary). We are going to use PKCS5 
            // to do the padding for us.
            PKCS5FormatterEngine formatterEngine = new PKCS5FormatterEngine( encryptionEngine );

            // Use the byte array output stream to catch the encrypted information.
            ByteArrayOutputStream outputStream = new ByteArrayOutputStream();

            // Create a block encryptor which will help us use the triple des engine.
            BlockEncryptor encryptor = new BlockEncryptor( formatterEngine, outputStream );

            // Encrypt the actual data.
            encryptor.write( message.getBytes() );

            // Close the stream. This forces the extra bytes to be padded out if there were
            // not enough bytes to fill all of the blocks.
            encryptor.close();

            // Get the actual encrypted data.
            byte[] encryptedData = outputStream.toByteArray();

            // End of Encryption.
            //-----------------------------------------------------------------------------------------------
            // Beginning of Decryption.

            // We are now going to perform the decryption.  We want to ensure that the 
            // message we get back is same as the original. Note that since this is a 
            // symmetric algorithm we want to use the same key as before.
            TripleDESDecryptorEngine decryptorEngine = new TripleDESDecryptorEngine( key );

            // Create the unformatter engine that will remove any of the padding bytes.
            PKCS5UnformatterEngine unformatterEngine = new PKCS5UnformatterEngine( decryptorEngine );

            // Set up an input stream to hand the encrypted data to the block decryptor.
            ByteArrayInputStream inputStream = new ByteArrayInputStream( encryptedData );

            // Create the block decryptor passing in the unformatter engine and the 
            // encrypted data.
            BlockDecryptor decryptor = new BlockDecryptor( unformatterEngine, inputStream );

            // Now we want to read from the stream. We are going to read the data 10 bytes 
            // at a time and then add that new data to the decryptedData array.  It is 
            // important to note that for efficiency one would most likely want to use a 
            // larger value than 10.  We use a small value so that we can demonstrate 
            // several iterations through the loop.
            byte[] temp = new byte[10];
            DataBuffer db = new DataBuffer();
            
            for( ;; ) 
            {
                int bytesRead = decryptor.read( temp );
                
                if( bytesRead <= 0 )
                {
                    // We have run out of information to read, bail out of loop.
                    break;
                }
                
                db.write(temp, 0, bytesRead);
            }

            // Now we want to ensure that the decrypted data is the same as the data we 
            // passed into the encryptor.
            byte[] decryptedData = db.toArray();
            
            if( Arrays.equals( message.getBytes(), decryptedData ) ) 
            {
                // They are the same.
                _status.setText("Test Passed.  The message is identical. \n\n Text: " + message + "\n\n Text Encrypt: " + message.getBytes());
                
            } 
            else 
            {
                // They differ.
                _status.setText("Test Failed.  The messages are different. ");
            }
        } 
        catch( CryptoTokenException e ) 
        {
            System.out.println(e.toString());
        } 
        catch (CryptoUnsupportedOperationException e) 
        {
            System.out.println(e.toString());
        } 
        catch( IOException e ) 
        {
            System.out.println(e.toString());
        }
   }
}

 

[jlfrias]

Any Suggestions?

[peter_strange]

Sorry I have not looked closely at your code.  Just wanted to say that we have code that encrypts on the BB and decrypts on the Server, and it all works OK.  We in fact use AES which i think is a better encryption than tripleDES, and slightly easier to use I think. 

However everytime I have done encryption in this way there has a a problem. typically NOT with the encryption, but with something outside it, like the padding, 'code book' (ECB CBC)m the key and the initialization Vector.  So I would recommend that you write matching code on the BB and the device, which will encrypt and then decrypt the same string and get back the same value, then make sure the interleaving steps all content the same data.  Start with one Block (16 bytes for AES), then try the second.  When you both ends encrypting and decrypting through the same internal bytes arrays, then you can have confidence that it will work.

Also if you are sending encrypted data, you are probably best Base 64 encoding it, so that it can be processed as text data.  But note that base 64 encoding uses a character that is not allowed in a URL, / I think, so you then might have to URL Encode the Base64 encoded String.  All this gets to be a real pain.

Of course this is entirely unnecessary if you are doing work for corporate Blackberry devices, because the communication from the BB to the BES (which is inside the firewall) is already encrypted.

[jlfrias]

 I do not working with BES, I am working with BIS services. Beacause the final users are on diffrente countrues with differents carriens and this is a environment approved.

So, I need encrypt password before the send the data acrross the url via https connection. I am using a connection https, it is secure, but i need increment the security.

I need implement the MD5 method in JDE BB 4.6.1 for encrypt password. This password will send across url to the web services.The web servicesdecrypt the passwordreceived.

I have reviewed that the method MD5Digest it is more common, because, this method is common in other technologies.

Please, Do you have any examples implement about this method.

I have the following code for testing:

package com.rim.samples.device.cryptodemo;

import java.io.*;
import net.rim.device.api.crypto.*;
import net.rim.device.api.util.*;
import net.rim.device.api.ui.*;
import net.rim.device.api.ui.component.*;
import net.rim.device.api.ui.container.*;

class CryptoDemo extends UiApplication
{
    
    private RichTextField _status;

    
    public static void main( String[] args )
    {
        CryptoDemo theApp = new CryptoDemo();
        theApp.enterEventDispatcher();
    }

    private CryptoDemo()
    {
        
       
        MainScreen screen = new MainScreen();
        screen.setTitle(new LabelField("Crypto Demo", LabelField.ELLIPSIS | LabelField.USE_ALL_WIDTH));

        _status = new RichTextField("Select 'Go' from the menu to perform the test.");
        screen.add(_status);
        
        // Add the menu item.
        screen.addMenuItem(new MenuItem("Go MD5" , 100, 10)
        {
            public void run()
            {
                go();
            }
        });
        
      
        pushScreen(screen);
    }

    
    private int go()
    {
                   
            String plainText  = "hello world 1243";         
        
            MD5Digest digest = new MD5Digest();

            digest.update(plainText) ;                     
          
            _status.setText("Result encrypted: " + plainText);
          
        
      
        
   }
}

 Thanks for you help.

Jorge Luis

[peter_strange]

Sorry, I may be being really stupid here, but AFAIK, MD5 is a checksum calculation, not an encryption method.  What that means, is that you normally uses MD5 to check you have got all the data, not to encrypt the data.  So typically you send the data and the MD5 digest and the other end will receive the data, generate the MD5 and then check that it got the same one that you calculated.  If there is a difference, then there has been some corruption in the transmission.  I think that is what you are doing, so we just need to clarify that this is not encryption. 

That said, what is wrong with your code?

[jlfrias]

Thanks for your observation.

- I have an application that need send a value of password.

- This application running over BIS not BES server for comunication.

- This password can not be sent without encrypt.

I need encrypt the password on application develop JDE 4.6.1 and decrypt in the web service development (ASP.NEt and c#).

I have reviewed all methods for encrypt/decrypt, but, i do not have solution for this special case.

How can found solution for my problem?

So, I test with MD5Digest that MD5Digest class implements the Message Digest 5 (MD5) hash algorithm. This is a option for my problem?

Please any suggestions?

thanks 

Jorge Luis.

[adwiv]

I am sorry to ask you the basic question but why do you want to encrypt the password? You say you are already sending data over HTTPS.

You are worried that someone may decrypt your https channel and sniff the password? ;-)