Using Crypto in Servlet?

[jamescpp]

I posted this same message to Sun's forum but have yet toget a response and I'm stuck right now. Sorry to post to the same message to two forums.

I have the following sample code that compiles fine:

import java.io.*;
import java.security.*;
import javax.crypto.*;
import javax.crypto.spec.*;
import sun.misc.*;

public class EncryptPasswordStaticKey
{

	public static void main(String args[]) throws Exception
	{

		if(args.length<1)
		{
			System.out.println(&quot;Usage : EncryptPassword text&quot;);
			return;
		}

		Security.addProvider(new com.sun.crypto.provider.SunJCE());

		SecretKeyFactory kf = SecretKeyFactory.getInstance (&quot;DES&quot;);
		Cipher cipher = Cipher.getInstance(&quot;DES&quot;);

		DESKeySpec ks = new DESKeySpec(new byte[] { 0x10, 0x23, 0x54, 0x67, 0x01, 0x23, 0x45, 0x67 });
		SecretKey k = kf.generateSecret(ks);
		cipher.init(Cipher.ENCRYPT_MODE, k);

		String amalgam=args[0];
		for(int i=2;i<args.length;i++)
		amalgam+=&quot; &quot;+args;

		byte[] stringBytes=amalgam.getBytes(&quot;UTF8&quot;);
		byte[] raw=cipher.doFinal(stringBytes);
		BASE64Encoder encoder = new BASE64Encoder();
		String base64 = encoder.encode(raw);
		System.out.println(base64);
	}
}

I would like to use very similar code in a servlet to encrypt some data but I get the following errors when I try to compile.
C:\Temp\Java>javac StoneURLLoginSetup.java
StoneURLLoginSetup.java:41: unreported exception java.security.NoSuchAlgorithmException; must be cau
ght or declared to be thrown
SecretKeyFactory kf = SecretKeyFactory.getInstance ("DES"
^
StoneURLLoginSetup.java:42: unreported exception java.security.NoSuchAlgorithmException; must be cau
ght or declared to be thrown
Cipher cipher = Cipher.getInstance("DES"
^
StoneURLLoginSetup.java:44: unreported exception java.security.InvalidKeyException; must be caught o
r declared to be thrown
DESKeySpec ks = new DESKeySpec(new byte[] { 0x01, 0x23, 0x45, 0x67, 0x01, 0x23, 0x45
, 0x67 });
^
StoneURLLoginSetup.java:45: unreported exception java.security.spec.InvalidKeySpecException; must be
caught or declared to be thrown
SecretKey k = kf.generateSecret(ks);
^
StoneURLLoginSetup.java:46: unreported exception java.security.InvalidKeyException; must be caught o
r declared to be thrown
cipher.init(Cipher.ENCRYPT_MODE, k);
^
StoneURLLoginSetup.java:53: unreported exception javax.crypto.IllegalBlockSizeException; must be cau
ght or declared to be thrown
byte[] raw=cipher.doFinal(stringBytes);
^
6 errors

The Servlet code is:

import java.util.*;
import java.io.*;
import java.text.*;
import java.net.*;

import javax.servlet.*;
import javax.servlet.http.*;

import java.io.*;
import java.security.*;
import javax.crypto.*;
import javax.crypto.spec.*;
import sun.misc.*;


public class StoneURLLoginSetup extends HttpServlet {

 	public void service( HttpServletRequest request, HttpServletResponse response ) throws ServletException, IOException {

 		String username = request.getParameter("username");
 		String password = request.getParameter("password");
 		String args[] = null;
 		args[0] = username;
 		args[1] = password;

		//encrypt username and password
		Security.addProvider(new com.sun.crypto.provider.SunJCE());

		SecretKeyFactory kf = SecretKeyFactory.getInstance ("DES");
		Cipher cipher = Cipher.getInstance("DES");

		DESKeySpec ks = new DESKeySpec(new byte[] { 0x01, 0x23, 0x45, 0x67, 0x01, 0x23, 0x45, 0x67 });
		SecretKey k = kf.generateSecret(ks);
		cipher.init(Cipher.ENCRYPT_MODE, k);

		String amalgam = username;
		for(int i=2;i<args.length;i++)
		amalgam+=&quot; &quot;+args;

		byte[] stringBytes=amalgam.getBytes(&quot;UTF8&quot;);
		byte[] raw=cipher.doFinal(stringBytes);
		BASE64Encoder encoder = new BASE64Encoder();
		String base64 = encoder.encode(raw);
		System.out.println(base64);
	}
}

Can anyone see what the problem is? Is there another way the exception should be declared?

I appreciate any and all help!
James

 

[cap68]

yeah...include the crypto exception in your throws clause.

 

[idarke]

The first one has the "throws Exception" clause on the method, which will catch and throw all those crypto exceptions. The servlet method throws only ServletException and IOException, so the cryto exceptions are not being handled. You should either add all those crypto exceptions to the throws list, or put the crypto lines in a try/catch block of their own and catch Exception.