I had to use asymmetric keys in order to finish a university assignment, and to my amazement Sun could not publish any examples of using RSA keys in Java, because they were restricted by one of the stupidest laws in existence: US Cryptographic Export Laws. After playing with the API for a little while, I’ve managed to figure it out, eventually.
So I’m writing this post for those who want a simple example on how the key generation and encryption process works using RSA asymmetric keys.
Just for introduction, RSA is an algorithm for public-key cryptography. It was the first algorithm known to be suitable for signing as well as encryption, and one of the first great advances in public key cryptography. RSA is widely used in electronic commerce protocols, and is believed to be secure given sufficiently long keys and the use of up-to-date implementations. For more information on how RSA works, please take a look at the relevant Wikipedia article.
In order to start using RSA cryptography in Java, you will need to generate a key-pair: a public and a private key. The public key will be used to encrypt the data, and the private key will be used to decrypt the data. Without the private key, the data can not be decrypted, therefore it is suitable in cases where the clients want to send the server a shared-secret key or authentication information, in order to use for a session (kinda like SSL/TLS does). Java, starting version 1.5.0, provides a tool in the API for generating RSA key pairs.
The following code demonstrates how to use KeyPairGenerator to generate an RSA key-pair in Java:
// Get an instance of the RSA key generator
KeyPairGenerator kpg = KeyPairGenerator.getInstance(”RSA”);
// Generate the keys — might take sometime on slow computers
KeyPair myPair = kpg.generateKeyPair();
This will give you a KeyPair object, which holds two keys: a private and a public. In order to make use of these keys, you will need to create a Cipher object, which will be used in combination with SealedObject to encrypt the data that you are going to end over the network. Here’s how you do that:
// Get an instance of the Cipher for RSA encryption/decryption
Cipher c = Cipher.getInstance(”RSA”);
// Initiate the Cipher, telling it that it is going to Encrypt, giving it the public key
c.init(Cipher.ENCRYPT_MODE, myPair.getPublic());
After initializing the Cipher, we’re ready to encrypt the data. Since after encryption the resulting data will not make much sense if you see them “naked”, we have to encapsulate them in another Object. Java provides this, by the SealedObject class. SealedObjects are containers for encrypted objects, which encrypt and decrypt their contents with the help of a Cipher object.
The following example shows how to create and encrypt the contents of a SealedObject:
// Create a secret message
String myMessage = new String(”Secret Message”);
// Encrypt that message using a new SealedObject and the Cipher we created before
SealedObject myEncyptedMessage = new SealedObject( myMessage, c);
The resulting object can be sent over the network without fear, since it is encrypted. The only one who can decrypt and get the data, is the one who holds the private key. Normally, this should be the server. In order to decrypt the message, we’ll need to re-initialize the Cipher object, but this time with a different mode, decrypt, and use the private key instead of the public key.
This is how you do this in Java:
// Get an instance of the Cipher for RSA encryption/decryption
Cipher dec = Cipher.getInstance(”RSA”);
// Initiate the Cipher, telling it that it is going to Decrypt, giving it the private key
dec.init(Cipher.DECRYPT_MODE, myPair.getPrivate());
Now that the Cipher is ready to decrypt, we must tell the SealedObject to decrypt the held data.
// Tell the SealedObject we created before to decrypt the data and return it
String message = (String)test.getObject(myEncyptedMessage);
System.out.println(”foo = “+message);
Beware when using the getObject method, since it returns an instance of an Object (even if it is actually an instance of String), and not an instance of the Class that it was before encryption, so you’ll have to cast it to its prior form.
This is a small introductory example on how to generate RSA keys in Java and use them to encrypt objects. I’ll follow up with a tutorial on how to use asymmetric and symmetric keys in order to have secure network communication in Java.
