SoFunction
Updated on 2025-04-11

Share common encryption solutions for java

1. Introduction

In an information society, data security has become a key issue in our daily life and work. Data protection not only protects data from illegal access, but also includes ensuring the integrity and privacy of the data. This is where the encryption and decryption technology comes into play.

1.1 The importance of encryption and decryption

Encryption and decryption, that is, encryption and decryption, are important means of data security. Encryption is the conversion of data into a form that is not easily understood to prevent unauthorized access. Decryption is to restore the encrypted data to its original form. These two processes usually require one or more secret keys.

Through encryption and decryption, we can protect data from illegal access, ensure data integrity, prevent data from being tampered with, and verify the source of the data. This is very important in many scenarios, such as online payment, data transmission, password storage, etc.

1.2 Java's advantages in encryption and decryption

As a widely used programming language, Java provides a complete set of encryption and decryption frameworks - Java Cryptography Architecture (JCA). JCA not only includes a series of APIs for data encryption and decryption, but also provides a scalable architecture that allows developers to add their own encryption and decryption implementations.

The advantages of Java's encryption and decryption are mainly reflected in the following aspects:

  1. Rich encryption and decryption algorithm support: Java supports a variety of encryption and decryption algorithms, including but not limited to AES, DES, RSA, SHA, etc., which can meet different business needs.
  2. Easy to use: Java's encryption and decryption API is designed very friendly, allowing developers to easily implement encryption and decryption functions in their applications.
  3. Cross-platform: Due to the cross-platform nature of Java, the encryption and decryption functions implemented using Java can run on different operating systems and hardware platforms, which greatly increases its scope of application.
  4. Security: Java's security has been widely recognized by the industry, and its own security mechanism and strict code review ensure the security of encryption and decryption operations.

In the following chapters, we will introduce in detail several commonly used encryption and decryption solutions in Java and give corresponding code examples.

2. Hash function

A hash function is a special function that converts inputs of any length (also known as messages) into fixed-length outputs. The output result is often referred to as a hash value or summary.

2.1 What is a hash function

The hash function has the following characteristics:

  1. Deterministic: For the same input, the hash function always produces the same output.
  2. Quick calculation: For any given input, the time to calculate its hash value is very short.
  3. Pre-map resistance: The original input cannot be deduced from the hash value, which is a one-way nature.
  4. Collision resistance: It is very difficult to find two different inputs so that their hash values ​​are the same.

In the field of information security, hash functions are mainly used for data integrity checking and password storage.

2.2 How to use hash function in Java

Java providesclass, used to generate hash values. This class supports a variety of hashing algorithms, including MD5, SHA-1, SHA-256, etc.

Here is a simple example showing how to use itMessageDigestClass generates hash:

import ;
import ;

public class HashExample {
    public static void main(String[] args) throws Exception {
        String originalString = "Hello, World!";
        MessageDigest digest = ("SHA-256");
        byte[] encodedhash = ((StandardCharsets.UTF_8));
        (bytesToHex(encodedhash));
    }

    private static String bytesToHex(byte[] hash) {
        StringBuilder hexString = new StringBuilder(2 * );
        for (int i = 0; i < ; i++) {
            String hex = (0xff & hash[i]);
            if(() == 1) {
                ('0');
            }
            (hex);
        }
        return ();
    }
}

In this example, we first create aMessageDigestobject and specify the hashing algorithm we want to use (SHA-256 in this example). Then, we calldigestMethod calculates the hash value of the input string. Finally, we convert the hash value (byte array) into a hexadecimal string.

2.3 Examples: MD5 and SHA-1

MD5 (Message Digest Algorithm 5) and SHA-1 (Secure Hash Algorithm 1) are two widely used hashing algorithms.

MD5 converts input of any length into a 128-bit hash value, while SHA-1 converts input of any length into a 160-bit hash value. Although both algorithms have been found to have security vulnerabilities, they are still safe enough in many scenarios.

Here is an example using MD5 and SHA-1:

import ;
import ;

public class HashExample {
    public static void main(String[] args) throws Exception {
        String originalString = "Hello, World!";
        
        // MD5
        MessageDigest md5Digest = ("MD5");
        byte[] md5Hash = ((StandardCharsets.UTF_8));
        ("MD5 Hash: " + bytesToHex(md5Hash));
        
        // SHA-1
        MessageDigest sha1Digest = ("SHA-1");
        byte[] sha1Hash = ((StandardCharsets.UTF_8));
        ("SHA-1 Hash: " + bytesToHex(sha1Hash));
    }

    private static String bytesToHex(byte[] hash) {
        StringBuilder hexString = new StringBuilder(2 * );
        for (int i = 0; i < ; i++) {
            String hex = (0xff & hash[i]);
            if(() == 1) {
                ('0');
            }
            (hex);
        }
        return ();
    }
}

In this example, we calculated the hash value of the input string using the MD5 and SHA-1 algorithms, respectively, and output the result.

3. Symmetric encryption

Symmetric encryption is a common encryption method that uses the same key for encryption and decryption. The advantage of this method is that it is fast and suitable for encryption of large amounts of data. The disadvantage is that key management can be more complicated because both parties in each pair of communication need to share the same key.

3.1 What is symmetric encryption

Symmetric encryption algorithms are a common encryption technology that uses the same key for encryption and decryption. This means that encryption and decryption use the same algorithm, but in different directions.

The advantages of symmetric encryption algorithms are fast speed, high efficiency, and are suitable for encryption of large amounts of data. However, its disadvantage is that key management can be more complicated. Because both parties in each pair of communication need to share the same key, if the key is leaked, the encrypted data may be cracked. Therefore, the confidentiality and secure transmission of keys are the keys to symmetric encryption.

Common symmetric encryption algorithms include DES (Data Encryption Standard), 3DES (Triple DES), AES (Advanced Encryption Standard), RC4, RC5, RC6, etc.

3.2 How to use symmetric encryption in Java

Java providesClass, used to implement symmetric encryption and decryption. This class supports a variety of encryption algorithms, including AES, DES, etc.

Here is a simple example showing how to use itCipherClasses perform AES encryption and decryption:

import ;
import ;
import ;
import ;
import .Base64;

public class SymmetricEncryptionExample {
    public static void main(String[] args) throws Exception {
        // Generate a key
        KeyGenerator keyGenerator = ("AES");
        (128);
        SecretKey secretKey = ();

        // Create a Cipher instance and initialize it to the AES algorithm
        Cipher cipher = ("AES");

        // Encrypt the message
        String originalMessage = "Hello, World!";
        (Cipher.ENCRYPT_MODE, secretKey);
        byte[] encryptedMessage = ((StandardCharsets.UTF_8));
        ("Encrypted Message: " + ().encodeToString(encryptedMessage));

        // Decrypt the message
        (Cipher.DECRYPT_MODE, secretKey);
        byte[] decryptedMessage = (encryptedMessage);
        ("Decrypted Message: " + new String(decryptedMessage, StandardCharsets.UTF_8));
    }
}

In this example, we first generate an AES key and then create aCipherobject and initialize it to AES algorithm. Next, we use thisCipherThe object encrypts a message and then uses the sameCipherThe object decrypts the message.

3.3 Examples: AES and DES

AES (Advanced Encryption Standard) and DES (Data Encryption Standard) are two widely used symmetric encryption algorithms.

AES is a powerful encryption algorithm that supports 128, 192 and 256-bit key lengths. The security of AES is widely recognized and is one of the most commonly used symmetric encryption algorithms.

DES is an older encryption algorithm that supports only 56-bit key lengths. Due to its short key length, the security of DES has been cracked, so it is not recommended to use in scenarios where high security is required. However, in some older systems, DES is still in use.

In Java, we can useCipherClass to implement encryption and decryption of AES and DES. For specific code examples, you can refer to the AES example above. You only need to change the parameter of "" from "AES" to "DES".

4. Asymmetric encryption

Asymmetric encryption, also known as public key encryption, uses a pair of keys for encryption and decryption: one public key is used for encryption and one private key is used for decryption. The advantage of this approach is that it is high security and does not require a secure transmission of keys. The disadvantage is that compared with symmetric encryption, the calculation volume is large and the speed is slow.

4.1 What is asymmetric encryption

Asymmetric encryption is an encryption technology that uses a pair of keys to encrypt and decrypt. One of the pair of keys is called a public key and can be publicly used by anyone; the other is called a private key and must be kept confidential. Public keys are used to encrypt data, and only the corresponding private keys can decrypt this data.

The advantage of asymmetric encryption is that it is high security because even if the public key is obtained by others, they cannot decrypt the encrypted data unless they also have the corresponding private key. Furthermore, since the public key can be disclosed, it is not necessary to transmit the key securely.

The disadvantage of asymmetric encryption is that it is large in computing and slow in speed. Therefore, it is not usually used to encrypt large amounts of data directly, but rather to encrypt symmetric keys for data encryption, or for digital signatures.

Common asymmetric encryption algorithms include RSA, DSA (Digital Signature Algorithm), ECC (Elliptic Curve Cryptography), etc.

4.2 How to use asymmetric encryption in Java

Java providesclass, used to generate a pair of public and private keys, andClass, used to implement asymmetric encryption and decryption.

Here is a simple example showing how to use itKeyPairGeneratorandCipherClasses perform RSA encryption and decryption:

import ;
import ;
import ;
import ;
import .Base64;

public class AsymmetricEncryptionExample {
    public static void main(String[] args) throws Exception {
        // Generate a key pair
        KeyPairGenerator keyPairGenerator = ("RSA");
        (2048);
        KeyPair keyPair = ();

        // Create a Cipher instance and initialize it to the RSA algorithm
        Cipher cipher = ("RSA");

        // Encrypt the message
        String originalMessage = "Hello, World!";
        (Cipher.ENCRYPT_MODE, ());
        byte[] encryptedMessage = ((StandardCharsets.UTF_8));
        ("Encrypted Message: " + ().encodeToString(encryptedMessage));

        // Decrypt the message
        (Cipher.DECRYPT_MODE, ());
        byte[] decryptedMessage = (encryptedMessage);
        ("Decrypted Message: " + new String(decryptedMessage, StandardCharsets.UTF_8));
    }
}

In this example, we first generate an RSA key pair and then create aCipherobject and initialize it to RSA algorithm. Next, we use thisCipherThe object and the public key encrypt a message and then use the sameCipherThe object and private key decrypt the message.

4.3 Example: RSA

RSA is a widely used asymmetric encryption algorithm. Its name comes from the first letters of the last names of its three inventors (Rivest, Shamir and Adleman).

The security of RSA algorithm is based on the difficulty of large-number decomposition. It supports a variety of key lengths, the common ones are 1024 bits, 2048 bits and 4096 bits. Generally speaking, the longer the key length, the higher the security, but the greater the calculation amount.

In Java, we can useKeyPairGeneratorandCipherClass to implement encryption and decryption of RSA. For specific code examples, please refer to the RSA example above.

5. Message Authentication Code (MAC)

Message Authentication Code (MAC) is a technology used to confirm the integrity and authenticity of messages. It combines the key and the content of the message to generate a unique value that can be used to verify that the message has been tampered with during transmission.

5.1 What is message authentication code

Message Authentication Code (MAC) is an encryption technology used to verify the integrity and authenticity of messages. A MAC is a short fixed-size bit group that is generated by the key and message content through a specific algorithm. When the recipient receives the message and the MAC, they can use the same key and algorithm to generate a new MAC and compare it with the received MAC. If the two MACs are the same, the message is considered true and has not been tampered with.

An important feature of MAC is that the correct MAC cannot be generated without a key. This means that even if the attacker knows the algorithm and message content, they cannot generate the correct MAC unless they also know the key.

Common MAC algorithms include HMAC (Hash-based Message Authentication Code), CMAC (Cipher-based Message Authentication Code), etc.

5.2 How to use message authentication code in Java

Java providesClass, used to implement message authentication code. This class supports a variety of MAC algorithms, including HMAC.

Here is a simple example showing how to use itMacClasses generate and verify HMAC:

import ;
import ;
import ;
import .Base64;

public class MacExample {
    public static void main(String[] args) throws Exception {
        // Create a secret key
        byte[] secretKey = "my secret key".getBytes(StandardCharsets.UTF_8);

        // Create a Mac instance and initialize it to the HMACSHA256 algorithm
        Mac mac = ("HmacSHA256");
        SecretKeySpec secretKeySpec = new SecretKeySpec(secretKey, "HmacSHA256");
        (secretKeySpec);

        // Generate a MAC for the message
        String originalMessage = "Hello, World!";
        byte[] macBytes = ((StandardCharsets.UTF_8));
        ("MAC: " + ().encodeToString(macBytes));

        // To verify the MAC, you would generate a new MAC for the received message
        // using the same key and algorithm, and check that the two MACs are equal.
    }
}

In this example, we first create a key and then create aMacobject and initialize it to the HMACSHA256 algorithm. Next, we use thisMacThe object and key generate a MAC for a message.

5.3 Example: HMAC

HMAC (Hash-based Message Authentication Code) is a commonly used MAC algorithm that combines a hash function and a key to generate MAC.

The advantage of HMAC is that it can use any hash function, such as MD5, SHA-1, SHA-256, etc., which means that its security is the same as the security of the hash function. In addition, HMAC has some other security properties that make it safer than simply using hash functions.

In Java, we can useMacClass to implement the generation and verification of HMAC. For specific code examples, please refer to the HMAC example above.

6. Digital Signature

Digital signature is a technology used to verify the integrity of messages and the identity of senders. It combines the content of the message and the sender's private key to generate a unique value that can be used to verify whether the message has been tampered with during transmission, and to verify the sender identity of the message.

6.1 What is a digital signature

Digital signature is an encryption technology used to verify the integrity of messages and the identity of the sender. Digital signatures are a unique value generated by the message content and the sender's private key through a specific algorithm. When the receiver receives the message and signature, they can use the sender's public key and the same algorithm to verify the signature. If the signature verification is successful, the message is considered complete, not tampered with, and indeed comes from the claimed sender.

An important feature of digital signatures is that no correct signature can be generated without a private key. This means that even if the attacker knows the algorithm and message content, they cannot forge the signature unless they also know the private key.

Common digital signature algorithms include DSA (Digital Signature Algorithm), RSA, ECDSA (Elliptic Curve Digital Signature Algorithm), etc.

6.2 How to use digital signatures in Java

Java providesClass, used to implement digital signatures. This class supports a variety of signature algorithms, including DSA, RSA and ECDSA.

Here is a simple example showing how to use itSignatureClasses perform DSA signature and verification:

import .*;

public class SignatureExample {
    public static void main(String[] args) throws Exception {
        // Generate a key pair
        KeyPairGenerator keyPairGenerator = ("DSA");
        (2048);
        KeyPair keyPair = ();

        // Create a Signature instance and initialize it for signing
        Signature signature = ("SHA256withDSA");
        (());

        // Sign the message
        String originalMessage = "Hello, World!";
        (());
        byte[] signatureBytes = ();
        ("Signature: " + ().encodeToString(signatureBytes));

        // To verify the signature, you would initialize the Signature instance for verification,
        // update it with the original message and then call the verify method.
        (());
        (());
        boolean isSignatureValid = (signatureBytes);
        ("Is signature valid? " + isSignatureValid);
    }
}

In this example, we first generate a DSA key pair and then create aSignatureobject and initialize it to SHA256withDSA algorithm. Next, we use thisSignatureThe object and private key generate a signature for a message. Then, we use the sameSignatureThe object and public key verifies this signature.

6.3 Examples: DSA and ECDSA

DSA (Digital Signature Algorithm) and ECDSA (Elliptic Curve Digital Signature Algorithm) are two commonly used digital signature algorithms.

DSA is a signature algorithm based on discrete logarithmic problem, and its security depends on the difficulty of discrete logarithmic problem. DSA supports multiple key lengths, usually 1024 or 2048 bits.

ECDSA is a signature algorithm based on elliptic curve cryptography. Its security depends on the difficulty of discrete logarithmic problems of elliptic curves. ECDSA can provide the same security compared to DSA, but requires a shorter key and is therefore more efficient.

In Java, we can useSignatureClass to implement signature and verification of DSA and ECDSA. For specific code examples, please refer to the DSA example above.

7. Java Key Management

In Java, key management is implemented through a keystore (KeyStore). A keystore is a secure database for storing keys and certificates.

7.1 What is Java Keystore (KeyStore)

The Java KeyStore is a secure database for storing keys and certificates. Each keystore has a corresponding password to protect access to the keystore. In addition, each key or certificate stored in the keystore also has a corresponding alias and password.

Java KeyStore supports a variety of types, including JKS (Java KeyStore), PKCS12, JCEKS (Java Cryptography Extension KeyStore), etc. Among them, JKS is the default keystore type for Java, but starting from Java 9, PKCS12 is recommended as the default keystore type because it provides better security.

7.2 How to use Java Keystore

In Java, we can useclass to operate the keystore. Here is a simple example showing how to use itKeyStoreThe class creates a new keystore, stores a key, and reads the key from the keystore:

import ;
import ;
import ;
import ;
import ;
import ;
import ;

public class KeyStoreExample {
    public static void main(String[] args) throws Exception {
        // Generate a key pair
        KeyPairGenerator keyPairGenerator = ("RSA");
        (2048);
        KeyPair keyPair = ();

        // Create a new KeyStore
        KeyStore keyStore = ("PKCS12");
        (null, null);  // initialize an empty keystore

        // Store the private key in the KeyStore
         protParam = new ("my key password".toCharArray());
         privateKeyEntry = new ((), new [0]);
        ("mykey", privateKeyEntry, protParam);

        // Save the KeyStore to a file
        try (FileOutputStream fos = new FileOutputStream("mykeystore.p12")) {
            (fos, "my keystore password".toCharArray());
        }

        // Load the KeyStore from a file
        try (FileInputStream fis = new FileInputStream("mykeystore.p12")) {
            (fis, "my keystore password".toCharArray());
        }

        // Retrieve the private key from the KeyStore
        Key key = ("mykey", "my key password".toCharArray());
        ("Retrieved key: " + key);
    }
}

In this example, we first generate an RSA key pair, then create a new PKCS12 keystore, where the private key is stored. Next, we save the keystore to a file and then load the keystore from this file. Finally, we retrieved the private key from the keystore.

8. Best Practices

In actual encryption and decryption operations, there are some best practices that can help us avoid common problems and improve security.

8.1 Frequently Asked Questions and Solutions when Encrypting and Decrypting

Question 1: Using weak encryption algorithm

Solution: Use strong encryption algorithms whenever possible. For example, instead of using MD5 and SHA-1, which have been proven to have security problems, use SHA-256 or stronger hashing algorithms. For symmetric encryption, it is recommended to use AES instead of DES. For RSA, a key of 2048 bits or longer is recommended.

Question 2: Using a fixed key

Solution: Use dynamically generated keys instead of fixed keys when possible. Fixed keys are more likely to be guessed by attackers or brute-forced. For symmetric encryption, a secure random number generator can be used to generate a key. For asymmetric encryption, a key pair can be generated using a key pair generator.

Question 3: Incorrectly storing and managing keys

Solution: Keys are the key to encryption and decryption and must therefore be stored and managed securely. Java's KeyStore can be used to securely store and manage keys.

8.2 Best practices for encryption and decryption

  1. Use strong encryption algorithms and long enough keys: Strong encryption algorithms and long enough keys can provide higher security. For example, for hashing algorithms, SHA-256 or stronger algorithms are recommended; for symmetric encryption, AES is recommended; for asymmetric encryption, RSA is recommended, and the key length is at least 2048 bits.
  2. Correctly store and manage keys: The key is the key to encryption and decryption and must therefore be stored and managed securely. Java's KeyStore can be used to securely store and manage keys.
  3. Using dynamically generated keys: Use dynamically generated keys instead of fixed keys when possible. Fixed keys are more likely to be guessed by attackers or brute-forced.
  4. Use a safe random number generator: In encryption operations, it is often necessary to generate random numbers, such as generating keys or initializing vectors. Safe random number generators, such as Java'sSecureRandomkind.
  5. Regularly change keys: Even if a strong encryption algorithm is used and a key that is long enough, the key should be changed regularly to prevent the key from being guessed or brute-forced.
  6. Use the latest encryption library: There may be known security vulnerabilities in the encryption library, so the encryption library should be updated regularly for the latest security fixes and improvements.
  7. Follow the "minimum permission principle": Only people or programs that need to use the key should be able to access the key. Other people or programs should be prohibited from accessing the key.
  8. Where possible, use the Hardware Security Module (HSM): Hardware Security Module (HSM) is a specialized device for securely generating, storing and managing keys. HSM provides higher security than software solutions.

Summarize

The above is personal experience. I hope you can give you a reference and I hope you can support me more.