PBE; final block not properly padded help!

Question

Hi there,
I'm having problems decrypting passwords using password based encryption (PBE), throwing me a "final block not properly padded" exception.
The passwords are also encrypted uses PBE in a seperate class called the PasswordEncryption. The code necessary to generate the Cipher is in a seperate method which is passed a String to determined if it would be initialized in "encrypt" or "decrypt" mode.
The class where the passwords are decrypted, UserManager, is passed the encrypted passwords as a String. It calls the PasswordEncryption class gets getcipher() to get the Cipher, and then decrypts the password. The data is read from the database by another class which reads database info, and passed in as a string to the decrypting class. The decrypting class converts the string to a byte[].
Below I have the UserManager class and PasswordEncryption class:
public class UserManager
implements SecurityServerInterface, PETComponent {
public UserManager() {
private static String decryptPassword(String asPassword) throws
SecurityException {
PasswordEncryption passwordEncryption = new PasswordEncryption();
Cipher pbeCipher = passwordEncryption.getCipher("decrypt");
String clearText = new String();
byte[] encryptedPassword = asPassword.getBytes();
try {
//This is where decryption failed! Given final block not properly padded
byte[] cipherText = pbeCipher.doFinal(encryptedPassword);
System.out.println(cipherText);
System.out.println("test cipher text");
clearText = new String(cipherText);
System.out.println("original:" + asPassword);
System.out.println("decrypted:" + clearText);
catch (IllegalBlockSizeException e) {
System.out.println(e.getMessage());
String illegalBlock = e.getMessage();
throw new SecurityException(illegalBlock);
catch (BadPaddingException e) {
System.out.println(e.getMessage());
String badPadding = e.getMessage();
throw new SecurityException(badPadding);
catch(Exception e) {
System.out.println(e.getMessage());
String exception = e.getMessage();
throw new SecurityException(exception);
System.out.println(clearText);
return clearText;
public class PasswordEncryption {
public static void main(String[] args) throws PETDBException,
SecurityEncryptionException {
PasswordEncryption encryptor = new PasswordEncryption();
ArrayList mainList = encryptor.getAllPasswords();
mainList = encryptor.encryptAllPasswords(mainList);
encryptor.updateAllPasswords(mainList);
public PasswordEncryption() {
//Get passwords from the user table of the database, e.g, loginName and passwords
private ArrayList getAllPasswords() throws PETDBException {
ArrayList passwordList = new ArrayList();
DBConnection.setConnection("jdbc:mysql://localhost/Mysql/data/pet?user=root&password=");
DBConnection dbCon = DBConnection.createConnection();
Connection con = dbCon.getConnection();
System.out.println(con);
try {
String allPasswordQuery = " SELECT " + DBColumns.USPASSWD.trim() + " , " +
DBColumns.USLOGINNAME.trim() + " from " + DBColumns.USER;
Statement stmt = con.createStatement();
ResultSet rs;
rs = stmt.executeQuery(allPasswordQuery);
if (rs.isFirst()) {
throw new PETDBException("No password found in the database.");
while (rs.next()) {
UserDO loUserDO = new UserDO();
loUserDO.setPassword(rs.getString(DBColumns.USPASSWD));
loUserDO.setLoginName(rs.getString(DBColumns.USLOGINNAME));
passwordList.add(loUserDO);
catch (SQLException sql) {
String sqlError = sql.getMessage();
throw new PETDBException(sqlError);
return passwordList;
private ArrayList encryptAllPasswords(ArrayList aoPasswordList) throws
SecurityEncryptionException {
// Encrypt the password
Cipher pbeCipher = getCipher("encrypt");
Iterator passwordIterator = aoPasswordList.iterator();
UserDO loUserDO = new UserDO();
try {
while (passwordIterator.hasNext()) {
loUserDO = (UserDO) passwordIterator.next();
String lsPassword = loUserDO.getPassword();
byte[] clearTextPassword = lsPassword.getBytes();
byte[] cipherText = pbeCipher.doFinal(clearTextPassword);
String cipherString = new String(cipherText);
loUserDO.setPassword(cipherString);
System.out.println(cipherString);
catch (IllegalBlockSizeException e) {
throw new SecurityException("Can't encrypt password, illegal block size");
catch (BadPaddingException e) {
throw new SecurityException("Can't encrypt password, bad padding");
System.out.println(aoPasswordList);
return aoPasswordList;
public Cipher getCipher(String mode) {
PBEKeySpec pbeKeySpec;
PBEParameterSpec pbeParamSpec;
SecretKeyFactory keyFac;
// Salt
byte[] salt = {
(byte)0xc7, (byte)0x73, (byte)0x21, (byte)0x8c,
(byte)0x7e, (byte)0xc8, (byte)0xee, (byte)0x99
// Iteration count
int count = 20;
// Create PBE parameter set & a SecretKey
pbeParamSpec = new PBEParameterSpec(salt, count);
SecretKey pbeKey;
// Use our own encryption password.
// Collect the password as char array and convert
// it into a SecretKey object, using a PBE key
// factory.
char[] password = new String("cmuw-team5").toCharArray();
pbeKeySpec = new PBEKeySpec(password);
try {
keyFac = SecretKeyFactory.getInstance("PBEWithMD5AndDES");
pbeKey = keyFac.generateSecret(pbeKeySpec);
catch (NoSuchAlgorithmException e) {
throw new SecurityException("Can't collect password as a char array");
catch (InvalidKeySpecException e) {
throw new SecurityException("Can't convert password into a SecretKey Object");
// Create PBE Cipher
Cipher pbeCipher;
try {
pbeCipher = Cipher.getInstance("PBEWithMD5AndDES");
catch(NoSuchAlgorithmException e) {
throw new SecurityException("Can't create a PBE Cipher, no such algorithm");
catch(NoSuchPaddingException e) {
throw new SecurityException("Can't create a PBE Cipher, no such padding");
// Initialize PBE Cipher with key and parameters
if (mode == "encrypt") {
try {
pbeCipher.init(Cipher.ENCRYPT_MODE, pbeKey, pbeParamSpec);
catch(InvalidKeyException e) {
throw new SecurityException("Can't initialize PBE Cipher with key");
catch(InvalidAlgorithmParameterException e) {
throw new SecurityException("Can't initialize PBE Cipher with parameters");
if (mode == "decrypt") {
try {
pbeCipher.init(Cipher.DECRYPT_MODE, pbeKey, pbeParamSpec);
catch(InvalidKeyException e) {
throw new SecurityException("Can't initialize PBE Cipher with key");
catch(InvalidAlgorithmParameterException e) {
throw new SecurityException("Can't initialize PBE Cipher with parameters");
return pbeCipher;
//Get encrypted passwords out of the ArrayList and update the database
private void updateAllPasswords(ArrayList aoUpdatePasswordList) throws
PETDBException {
DataService dataService = new DataService();
Iterator getEncryptPassword = aoUpdatePasswordList.iterator();
String lsUpdatePassword = new String();
String lsUserName = new String();
Statement stmt;
DBConnection dbCon = DBConnection.createConnection();
Connection con = dbCon.getConnection();
try {
stmt = con.createStatement();
System.out.println(stmt);
catch (SQLException sql) {
String sqlError = sql.getMessage();
System.out.println(sqlError);
throw new PETDBException(sqlError);
while (getEncryptPassword.hasNext()) {
UserDO loUser = (UserDO) getEncryptPassword.next();
lsUpdatePassword = loUser.getPassword();
lsUserName = loUser.getLoginName();
String allUpdatePassword = " UPDATE " + DBColumns.USER + " SET " +
DBColumns.USPASSWD + " = " + "'" + lsUpdatePassword + "'" + " WHERE "
+ DBColumns.USLOGINNAME + " = " + "'" + lsUserName + "'";
System.out.println(allUpdatePassword);
try {
int returnValue = stmt.executeUpdate(allUpdatePassword);
System.out.println(returnValue);
catch (SQLException sql) {
String sqlError = sql.getMessage();
throw new PETDBException(sqlError);
try {
con.commit();
con.close();
catch (SQLException sql) {
String sqlError = sql.getMessage();
throw new PETDBException(sqlError);

Answer 1

Thanks for the prompt response! I got this example
from the Sun Java cryptography extensions web page at:
http://java.sun.com/j2se/1.4.2/docs/guide/security/jce/
CERefGuide.html#PBEExThe code I'm pointing out did not come from there. Nowhere in Sun's examples do you see them creating Strings directly from ciphertext. (Which is good, because if you did, their examples wouldn't work). To give some more context on where the problem is:private ArrayList encryptAllPasswords(ArrayList aoPasswordList) throws SecurityEncryptionException {
  // Encrypt the password
  Cipher pbeCipher = getCipher("encrypt");
  Iterator passwordIterator = aoPasswordList.iterator();
  UserDO loUserDO = new UserDO();
  try {
    while (passwordIterator.hasNext()) {
      loUserDO = (UserDO) passwordIterator.next();
      String lsPassword = loUserDO.getPassword();
      byte[] clearTextPassword = lsPassword.getBytes();
      byte[] cipherText = pbeCipher.doFinal(clearTextPassword);
      // DOING THE FOLLOWING TO CIPHERTEXT TURNS IT INTO GARBAGE!
      String cipherString = new String(cipherText);
      loUserDO.setPassword(cipherString);
      System.out.println(cipherString);
  } catch (IllegalBlockSizeException e) {
    throw new SecurityException("Can't encrypt password, illegal block size");
  } catch (BadPaddingException e) {
    throw new SecurityException("Can't encrypt password, bad padding");
  System.out.println(aoPasswordList);
  return aoPasswordList;
}(Note: Please use the [ code ] tags when you post code - it makes it MUCH easier to figure out what you're doing.)
Also, my decryption code in the UserManager class does
work for two out of 8 users....I can't really figure
out why it's working for Only 2 users, and not the
rests. It's possible that the ciphertext is successfully string-able in those two cases (although I doubt it). But I can absolutely guarantee to you that trying to treat ciphertext as a String will turn your ciphertext into grabage, and that will result in a BadPaddingException when you decrypt. You need to stop doing that.
If you need to treat ciphertext or keys as Strings, the right way to do it is to Base64-encode the byte[] into a String, and then Base64-decode when you want to decrypt.
Grant