Encrypt/decrypt in XML

Question

Hi all,
I've got a test program I'm running that does the following:
Take servername, username, pwd from command line, and encrypt them.
Write an encrypted XML document (see below).
Read the encrypted document, and write a decrypted version of the same.
The encrypted XML document looks like this:
<?xml version="1.0"?>
<ENCRYPTED_ATTRIBUTES
     KEY_STRING="�u�����@a:b��,"
     DB_SERVER="|="
     DB_LOGIN=""
     DB_PASSWORD="(+;"
/>The KEY_STRING value is the wrapped SecretKey. Each of the encrypted strings in the XML document are just basic alphanumeric Strings encrypted using DES/EBC/PKCS5Padding.
I'm using javax.xml.parsers.DocumentBuilder to parse the XML file, and I'm getting the following error:
java.io.UTFDataFormatException: invalid byte 1 of 1-byte UTF-8 sequence (0x88) The XML parser doesn't appreciate some of those characters (obvious).
Is there a way to limit the character set used in encrypting a value? Should I try a different algorithm?
I'm quite new to crypto, so any help is appreciated. Oh yeah: here is the code:
import org.w3c.dom.Document;
import javax.crypto.*;
import javax.crypto.spec.IvParameterSpec;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import java.io.*;
import java.security.spec.AlgorithmParameterSpec;
* Class Description:
* Date: May 27, 2003
* Time: 1:54:16 PM
*  $Id: $
*  $Log: $
public class JCE_Test {
    public static void doUsage() {
        System.out.println("JCE_Test Usage:\n");
        System.out.println("\tjava JCE_Test <server> <user> <pass>\n");
        System.out.println();
    public static void main(String[] args) {
        if( args.length != 3 ) {
            doUsage();
            System.exit(1);
        String sDatabase, sLogin, sPwd;
        sDatabase = args[0];
        sLogin = args[1];
        sPwd = args[2];
        byte[] bStringData;
        try {
            KeyGenerator keygen = KeyGenerator.getInstance("DES");
            SecretKey theKey = keygen.generateKey();
            Cipher theCipher = Cipher.getInstance("DES/ECB/PKCS5Padding");
            theCipher.init(Cipher.ENCRYPT_MODE, theKey);
            FileOutputStream fos;
            String tmpdir = System.getProperty("java.io.tmpdir");
            fos = new FileOutputStream(tmpdir + "JCE_Test.xml");
            PrintWriter pw = new PrintWriter(fos);
            pw.println("<?xml version=\"1.0\"?>");
            pw.println("<ENCRYPTED_ATTRIBUTES");
            theCipher.init(Cipher.WRAP_MODE, theKey);
            String sKey = new String(theCipher.wrap(theKey));
            pw.println("\tKEY_STRING=\""+sKey+"\"");
            byte[] iv = new byte[]{
            (byte)0x8E, 0x12, 0x39, (byte)0x9C,
            0x07, 0x72, 0x6F, 0x5A
            AlgorithmParameterSpec paramSpec = new IvParameterSpec(iv);
            theCipher.init(Cipher.ENCRYPT_MODE, theKey, paramSpec);
            pw.print("\tDB_SERVER=\"");
            bStringData = sDatabase.getBytes();
            System.out.println(new String(theCipher.doFinal(bStringData), "UTF-8"));
            pw.write(new String(theCipher.doFinal(bStringData), "UTF-8"));
            pw.println("\"");
            pw.print("\tDB_LOGIN=\"");
            bStringData = sLogin.getBytes();
            System.out.println(new String(theCipher.doFinal(bStringData), "UTF-8"));
            pw.write(new String(theCipher.doFinal(bStringData), "UTF-8"));
            pw.println("\"");
            pw.print("\tDB_PASSWORD=\"");
            bStringData = sPwd.getBytes();
            System.out.println(new String(theCipher.doFinal(bStringData), "UTF-8"));
            pw.write(new String(theCipher.doFinal(bStringData), "UTF-8"));
            pw.println("\"");
            pw.println("/>");
            pw.close();
            Document iniFile;
            DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
            DocumentBuilder builder = factory.newDocumentBuilder();
            File config;
            config = null;
            iniFile = null;
            try {
                config = new File(tmpdir + "JCE_Test.xml");
            } catch(Exception a) {
                System.out.println("Error getting file.\n" + a.toString());
                System.exit(1);
            try {
                iniFile = builder.parse(config);
            } catch(Exception b) {
                System.out.println("Error parsing XML file.\n" + b.toString());
                System.exit(1);
            org.w3c.dom.Element rootElement;
            org.w3c.dom.NamedNodeMap Attributes;
            rootElement = null;
            Attributes = null;
            try {
                rootElement = iniFile.getDocumentElement();
                Attributes = rootElement.getAttributes();
            } catch(Exception c) {
                System.out.println("Error getting elements.\n" + c.toString());
                System.exit(1);
            theCipher.init(Cipher.DECRYPT_MODE, theKey, paramSpec);
            try {
                for( int i=0; i < Attributes.getLength(); i++ ) {
                    String sNode = Attributes.item(i).getNodeName();
                    String sValue = Attributes.item(i).getNodeValue();
                    fos = new FileOutputStream(tmpdir + "JCE_Test_Decrypt.txt");
                    pw = new PrintWriter(fos);
                    pw.println("<?xml version=\"1.0\"?>");
                    pw.println("<DECRYPTED_ATTRIBUTES");
                    if( sNode.startsWith("KEY") == false ) {
                        System.out.println("Printing decrypted " + sNode);
                        pw.println("\t"+sNode+"=\""+ theCipher.doFinal(sValue.getBytes()) + "\"");
            } catch(Exception e1) {
                System.out.println("Error getting info from XML file.\n");
                System.out.println(e1.toString());
            pw.println("/>");
            pw.close();
            System.exit(0);
        } catch(Exception e) {
            System.out.println("Error doing the cipher thang...");
            System.out.println(e.toString());
            System.exit(1);

Answer 1

Unfortunately if your code/jar file is accessable to others then those others
will have no problem defeating whatever you do except for the user supplied
password at startup example. Let me give you an example of what I am talking
about.
Lets say you have a class that is final and package private with methods
such as getUsername() getPassword() etc... Now this class can do all sorts
of tricks to hide and obscure the stuff. Pretty much as complicated as you
want but in the end I can defeat it by doing this assuming I have access to
your jar. For this example lets assume the package name of your class is
com.xyz.crypto.
package com.xyz.crypto;
public class Breakit {
public static void main(String[] args)
YourSoCalledCryptoClass break = new YourSoCalledCryptoClass();
System.out.println("Username: " + break.getUsername());
System.out.println("Password: " + break.getPassword());
Now that you see how easy it is for an attacker you have to realize that
the only way to stop this is by preventing me access to the code at all.
And or to have that code require something that I don't have (aka a
password). Note that the password option requires that the only place the
password is stored is in your head. If you put it on disk I may be able
to obtain it through hacking your machine, or if I am an employee and have
access either because I am the SysAdmin or whatever...
I know this is hard to swallow. There has got to be a wy right? Wrong.
I have been hacking for a long time and I can assure you the only secure
way to encrypt data is in the end to have something protected by a password
or key that is not accessible by me. A weak password is an example of
something that is accessible to me via dictionary attacks and guessing if
I know anything about you as examples.
Sorry!!! Keep in mind that crypto can take years to brute force break. But
if I can go another route to break it in a couple of hours or days such as
the above then it makes the whole thing kinda pointless right???
The number one thing crypto anaylists use to break ciphers is exploitation
of the weaknesses of the system and incorrect usage by users!