Is it safe to use the same passphrase for multiple disks?

I have a very elaborate passphrase using letters, digits and punctuation marks that I'm fairly confident nobody will ever be able to crack even if they have the seed and hash and a couple of million GPU's to throw at it.
However, from a cryptography course I know that if two "messages" have been encrypted using the same "pad", you will be able to extract information by or-ing the messages, for example.
Now I'm sure that the encryption scheme in OS X is much more sophisticated, but just to be sure:
If I encrypt two disks using the same passphrase, and somebody steals both disks, would that make it easier for them to crack it? Is there some way they could exploit the fact that the passphrases are the same? Could they find data by combining the data on the two disks?
I assume it's not possible, but just checking.

Short answer: don't worry.  AES-256 is currently a secure scheme.
Long answer: If your reference to a "pad" is to the reuse of a so-called one-time pad scheme, that's a very different cryptographic system than what's typically used now, and the attacks against a reused one-time pad are different sorts of cryptographic attacks.
If you're using a one-time pad for a whole disk, you either need a ginormous one-time pad that's itself as big as the disk, or you'll get data that's repeated; a typical disk has great wads of zeros and ranges of blocks of zeros, after all.
In modern systems, it's quite common for the same private key to be used for thousands and even millions of messages, when asymmetric encryption is used.
Now I don't know which encryption algorithm is currently being used to encrypt DMGs, but I'd suspect it's still AES-grade encryption.
AES works very hard at making the results of the encryption process as close to random as it can manage, which reduces the exposure to frequency-based attacks.  (This is also why effectively-encrypted data can't be compressed; there should be no repeats.)  This randomness is part of the basis for the attacks against the one-time pad; that the output of the pad - the encrypted data - if the one-time pad is re-used - isn't really random.  Particularly if you know (or can guess) some of the cleartext, too.  Or those big blocks of zeros.
Now the other central discussion here is around how much somebody would pay to decrypt your data.  Because if your data is worth enough to the attacker, then there can potentially be other ways to attempt to gain access, even if AES itself isn't breached. 
If you're storing some very valuable data (worthy of attacks), then receiving guidance from some yutz like me in an Apple forum probably isn't in your best interest.  But if you're not storing miltary-grade, or financial secrets, or identifying medical data, or credit card data, then AES-256 will do nicely.  And even if you are, AES-256 might be enough.  But check with the crypto and legal folks for details, or with your site security officer.
And as was correctly noted in an earlier reply, if a password is used once, and once known, an attacker will try it against other systems and servers.  This being another common form of re-use.
If you're interested here, then get one or two of Bruce Schneier's books on crypto.  If you don't already have them.

Similar Messages

  • How do use the same crop for multiple images.

    I have a number of images that I want to use the same crop on. Instead of go through the whole slow process for each image is there a way to use the same crop for all of the images?
    And in iPhoto there was a way to copy the adjustment settings to multiple images, I can't see how to do that in aperture.

    Use the "Lift&Stamp" tool:
    Crop one image.
    Lift the crop using the "Lift" tool.
    Select the other images.
    Stamp the crop adjustment to all of them.
    But caution: By default "Lift" will copy all Metadata tags and all adjustments, but the gps data. If you only want to transfer the cropping rectangle, deselect all lifted items but the crop adjustment before stamping.
    Regards
    Léonie

  • Using the same account for multiple Macs?

    I have two Macs at home that I download apps to with my personal account and I also have an iMac and MBP from work that I want to start downloading apps to. Should I use my existing personal account or should I create a new account? Does it make a difference if I download 4 copies of the same free app to 4 different macs?
    Thanks.

    Does it make a difference if I download 4 copies of the same free app to 4 different macs?
    No as long as you use the same Apple ID they were purchased wtih.
    How to re download apps from the Mac App Store:
    Open the App Store. From the menu bar click Store > Sign In
    Click Purchases from the top of the App Store window.
    Select which apps you want to re download. Then right or control click where you see Installed  then click Install.
    If you create another account, it's sure to cause confusion.
    You may want to backup your purchases >  Mac App Store: Backing up your app purchases

  • How to use the same script for multiple buttons

    Hi,
    I've only just started using flash so any help would be great!
    I'm creating a blockbusters type game, I have a grid of 20 buttons and I need  them (individually) to turn blue on click and red on double click. I've managed to do it with the first one using this code;
    var clicked:Boolean = false;
    bn1.addEventListener(MouseEvent.CLICK, bn1click);
    function bn1click(event:MouseEvent):void {
        clicked = true;
        var newColorTransform:ColorTransform = bn1.transform.colorTransform;
        if(clicked){
        newColorTransform.color = 0x064258;
        bn1.transform.colorTransform = newColorTransform;
    bn1.doubleClickEnabled = true;
    var doubleclicked:Boolean = false;
    bn1.addEventListener(MouseEvent.DOUBLE_CLICK, bn1dclick);
    function bn1dclick(event:MouseEvent):void {
        doubleclicked = true;
        var newColorTransform:ColorTransform = bn1.transform.colorTransform;
        if(clicked){
        newColorTransform.color = 0xac1e23;
        bn1.transform.colorTransform = newColorTransform;
    Now I'm having trouble getting the same to work for the rest of the buttons, they are each named bn2, bn3 etc. They need to work individually and remain blue/red once clicked. I've tried listing them as addEventListener commands but not having a great deal of success!
    Any help would be greatly appreciated, thanks!
    Tomo

    One way to do this is to use arrays to keep track of the buttons and their properties.
    var buttonList:Array = new Array(bn1,bn2,bn3);
    var clickedList:Array = new Array();
    var doubleClickedList:Array = new Array();
    //then use a for loop to assign the functions and properties for each button:
    var thisMany:int = buttonList.length; // this will give you the number of items in the buttonList array
    for(var i:int = 0; i<thisMany; i++) {
         buttonList[i].addEventListener(MouseEvent.CLICK,btnClick); // assign the click function to each button
         buttonList[i].addEventListener(MouseEvent.DOUBLE_CLICK,btnDClick); // assign the double click function
         clickedList.push(false);  // add a false value for each button to this array
         doubleClickedList.push(false);
               buttonList[i].doubleClickEnabled = true; // set the double click property for each button
    function btnClick(event:MouseEvent):void {
              var thisButton:int = buttonList.indexOf(event.target);  // figure out which button was clicked as an item in the array
              clickedList[thisButton] = true;  // change the value in the array
               var newColorTransform:ColorTransform = buttonList[thisButton].transform.colorTransform;
        if(clickedList[thisButton]){
        newColorTransform.color = 0x064258;
        buttonList[thisButton].transform.colorTransform = newColorTransform;
    function btnDClick(event:MouseEvent):void {
              var thisButton:int = buttonList.indexOf(event.target);
              doubleClickedList[thisButton] = true;
        var newColorTransform:ColorTransform = buttonList[thisButton].transform.colorTransform;
        if(doubleClickedList[thisButton]){
        newColorTransform.color = 0xac1e23;
        buttonList[thisButton].transform.colorTransform = newColorTransform;
    Now you can have any number of buttons, just add their instance names to the array at the top.

  • Using the same library for multiple iTunes IDs

    My wife and I have the same exact library. When she buys something, my computer/ipod/devices are authorized to use it. We both got new laptops and we wanted to refrain from adding too much on them. I have an iMac with the music library on it. I signed up for iTunes match so that I could have my library on my devices and our Apple TV. So the question is, how can I get the same library on her devices, without uploading this library to her laptop?
    Can I simply log out of iTunes on the iMac and then log in as her and sign up for iTunes Match under her ID and go through the process again and all is done?
    We'd like to maintain the separate IDs as she purchases apps on her own and then has a lot of podcast subscriptions that I don't. But again, just trying to get the shared library to her device.
    Any help would be appreciated.
    Thanks.

    No, there is no way to do this at this time, and if you make a mistake trying, you can screw yourself up and end up locking yourself out of Match.
    Apple makes a subtle and extremely annoying distinction between "authorization" and "association".  You need "authorization" to play content on a particular computer, and several users with different Apple IDs can authorize their content on a single computer.
    However, to do any of the following:
    -auto-download content
    -download previously purchased content
    -use Match!
    you must "associate" the computer to an Apple ID in addition to "authorizing" it. Only *a single AppleID* may be associated with a computer (not account, computer!) at a time, and this can only be changed once every 90 days. In other words, in this context, it treats the computer just like a mobile device. You can't run Match with more than one user, and Match also precludes anyone else from downloading previously purchased content.
    I recently learned about this the hard way when my son came home from college and used his Apple account to re-download a single TV show on my computer.  When I logged in later to try to use Match, a splash informed me I would have to wait *90 days* to switch back to my AppleID!  Luckily, I emailed the iTunes store and they were able to reset it.  I'm not sure if they have single incident forgiveness policy, if they were able to see exactly how much money I've put in their pockets over the  last couple years, or if they were simply smart enough to realize that *not* doing so could only lose them money in the future.
    Add to this the fact that you now "associate" (with a different definition) your AppleID with your *user account* to use cloud services, and you have three different and inconsistent ways your AppleID is used on a computer.
    Hopefully, Apple will clean all of this up at some point.

  • How do I change the icloud account on my iphone? I want to use the same account for all my apple devices (macbook air and imac and iphone). I can't see where I can amend the iphone account because it is in grey?

    I want to use the same account for all my apple devices (macbook air, imac and iphone). I can't see how I can amend the iphone account because it is in grey? I also can't remember the password for this account so i can't even delete it and start again?
    Help!
    Thanks

    Deleting an iCloud account only deletes it from the Device, not from iCloud.  In iOS 8, the name of this setting changed to "Sign Out" as that is a better reflection of what actually happens.  Your iCloud data remains on the server, available to devices still signed into the account, but the device you sign out of the account on is disconnected from the account, and as a result, the iCloud data from that account is removed from the device.  It will redownload to the device should you sign back into the account.
    The only issue you'll run into when you switch between accounts is with my photo stream photos older than 30 days.  When you delete (or sign out of) and account, your photo stream photos are deleted along with the other data from the account in question.  However, unlike other data which remains on the server and can redownload to your device when you sign back in, my photo stream photos only remain in iCloud for 30 days.  When you sign back in, you will only get back my photo stream photos added in the last 30 days (as older photos are no longer in iCloud to redownload).  Like other account data, any my photo stream photos on your other devices signed into the account are unaffected by this.  If you want to keep older my photo stream photos on your device as you change iCloud accounts, save them to your camera roll before deleting (signing out of) the account.

  • I have used the same laptop for all three of my iPhones but awhile back this laptop had a virus so my husband wiped it out and now when I sync my iPhone I no longer get my entire music library ( including purchased songs) on my iPhone. How do I fix this?

    I have always used the same laptop for all of my iPhones but awhile back this laptop had a virus so my husband wiped out the laptop and now when I sync my iPhone I no longer receive my entire music library (including purchased songs) on my iPhone. How do I fix this?

    kimberlyfromtopeka wrote:
    Ok,thanks but, I should be able to something so that I am able to sync the entire library again not just the purchased songs.
    If the non purchased music is not on your computer, how can it Sync to your iPhone...

  • HT204074 How do I use 2 apple id's on one mac?  I have my apple id on my mac and would like to use the same mac for my wife's phone and ipad?

    How do I use 2 apple id's on one mac?  I have my apple id on my mac and would like to use the same mac for my wife's phone and ipad?

    Correction, thats two itune id's

  • How do I use the same profile for two users on the same computer

    I use my laptop both at home and at work. And in each venue I use a different user log on. But I wish to have firefox use the same profile for each user log on. How can I get firefox to point to the same profile for each user?

    Note that only one user (Firefox instance) can use a profile folder at the time, so if you would switch the Windows user to another account then you would first have to close Firefox.
    * http://kb.mozillazine.org/Creating_a_new_Firefox_profile_on_Windows
    * http://kb.mozillazine.org/Shortcut_to_a_specific_profile
    * http://kb.mozillazine.org/Using_multiple_profiles_-_Firefox
    * http://kb.mozillazine.org/Bypassing_the_Profile_Manager

  • HT4314 I have a iPad and iPhone with the same Apple ID, but on Game Center I have used the same id for both devices and they are two different profiles and I was wondering how to have one of the accounts on both devices.

    I have a iPad and iPhone with the same Apple ID, but on Game Center I have used the same id for both devices and they are two different profiles and I was wondering how to have one of the accounts on both devices.

    Hi Jamesdwills,
    Welcome to the Support Communities!
    If you are using the same Apple ID on both devices, the Game Center profile should be the same.
    Check out this information from the iPad User Guide.  Try signing out of the Game Center on both devices and then sign back in with the correct Apple ID:
    Using Game Center
    http://support.apple.com/kb/ht4314
    Game Center settings - iPad User Guide
    http://help.apple.com/ipad/7/#/iPad9a13d039
    Game Center settings
    Go to Settings > Game Center, where you can:
    Sign out (tap your Apple ID)
    Allow invites
    Let nearby players find you
    Edit your Game Center profile (tap your nickname)
    Get friend recommendations from Contacts or Facebook
    Specify which notifications you want for Game Center. Go to Settings > Notifications > Game Center. If Game Center doesn’t appear, turn on Notifications.
    Change restrictions for Game Center. Go to Settings > General > Restrictions.
    Cheers,
    - Judy

  • How to Use the same iview for both KM End User and the KM Administrator

    Hi friends,
    *This is my scenario :* How to Use the same iview for both KM End User and the KM Administrator but with different Context
    Menu Options.
    i followed these steps but im getting same context menu for both KM End User and the KM Administrator .
    Assign the role Content Administrator to the user km_admin. This is needed so that km_admin can change
    the presentation settings for the KM Folder u201EReports_kmFolder‟.
    Now, login with user km_admin. Navigate to the Km Folder reports_kmFolder through Content Administration
    -> Km Content. Click on Details link of the folder reports_kmFolder.
    Go To Settings -> Presentation. Click on the tab u201ESettings for You‟-> Click on button u201ESelect Profile‟.
    Select the radio button corresponding to u201Elayout Set‟, and choose u201EConsumerExplorer‟ from the dropdown.
    Click u201EOK‟.
    Select both the check boxes corresponding to Items Affected as shown above, and click u201ESave‟
    Now, remove the u201ESuper Administrator‟ role from the user km_admin and login with this user.
    How rto resolve this????
    Regards,
    Prasad.

    Hello Prasad,
    Most likely the user km_admin still has system principal roles assigned, even though you removed the Super Admin role, you should check that this user doesn't have any other admin roles, otherwise it will be considered a System Principal user and will therefore still have access to all content. For more information see http://help.sap.com/saphelp_nw70/helpdata/en/19/56f28fbd4e11d5993b00508b6b8b11/frameset.htm
    Try creating a new user with just read access to the content and you should see that it will not be able to make any changes etc.
    Regards,
    Lorcan.

  • Do I use the same password for apple ID and for iCloud?

    I am not getting mail on my iphone or my ipad air!
    When I put the password for my apple ID into icloud- it keeps reverting to another password. i.e. doesn't hold the apple ID password.
    Is this a problem keeping the mail from getting to my phone and ipad?
    DO I USE THE SAME PASSWORD FOR APPLE ID AND ICLOUD?
    Help. and MERRY CHRISTMAS

    What are you trying to do when you say "When I put the password for my apple ID into icloud- it keeps reverting to another password"?
    Where are you doing when you try to enter your password?

  • MDT Console with more then 15 machines, How to use the same drivers for more machines.

    Hello,
    I'm am looking for a solution to make our MDT design as effective as possible(as small as posible).
    The Situation:
    The company has more then 15 different computers added to the MDT console for the automated installation of Windows 7. The installations are done in 2 different ways, 1 with a local USB key installation (with the deployment folder on the USB key) and the other
    installation is a network USB key installation (with the deployment folder on the server).
    The local USB key exists for offices in parts of the world where the internet connection is poor.
    The problem:
    We have machines which can use the same driver for different kinds of hardware functions (LAN, WLAN, etc..)
    If we add a new machine to the MDT and we don't check the box for "Import drivers even if they are duplicates of an existing driver" we will automatic use the driver which already exists in the deployment folder. If say half a year
    later we stop using an older machine which "may" have drivers that are being used for other machines and we delete the machine from MDT we should
    NOT check the box "Completely delete these items, even if there are copies in other folders". The problem is that this can also lead to a lot of unused drivers in the deployment folder also because we do not know exactly how many
    computers are using a certain driver.
    At the moment we have another deployment share with for each machine its own drivers installed (so some drivers will be multiple times in the deployment folder) as you can guess this becomes really big.(deployment folder of more then 24 GB). The advantage
    of this is that we can delete a machine from the MDT list without having to worry if the drivers for that machine might be used by other machines. It is now just becoming to big in size(GB).
    The Question:
    Is there not an option within MDT that checks automatically if the drivers connected to a certain machine in MDT are being used by other machines? In this case we would check the box "Completely delete these items, even if there are copies in other folders"
    and MDT would not delete the drivers which are still used for the installations of other computers.
    Thanks in advance.
    Greets,
    Arie

    Arie,
    I think you are over-complicating this. Basically using drivers that already exist is the way to go. Otherwise drivers will be imported a second, third or fourth time. Which also takes up allot of disk space. If you're concerned about driver management,
    then I would suggest to drop your concerns, since there is nothing to less you can do about this particular issue. As long as you don't delete the driver that's been imported earlier by another machine there is nothing to worry.
    Ask yourself:
    - how long am I going to support model x
    - how many times do I want to update drivers
    With selection profiles you can easily target which content needs to go where (on your USB drive of-course)
    I can imagine that managing 25 shares for 25 different models, just because you 'refuse' to have old drivers in your share, or have removed support for some hardware models, isn't really time and energy efficient too.
    If you take a look in your deploymentshare\control folders you will see some XML files. These XML files hold all the entries in your deploymentshare. So your drivers.xml and drivergroups.xml (depending on the number of groups you have) are going to be very
    big XML files. These XML files are read by MDT to identify the objects in MDT and under which folder the objects are located.
    It's not possible to create or have an dependency between driver files and hardware models, other then creating groups under "Out-of-box Drivers" and using selection profiles.
    Another suggestion would be to decrease your number of hardware models drastically. On the other hand, having 25 Gb of offline media isn't really a big deal either. Portable and removable media of those sizes (32 and 64 Gb) isn't that expensive as it used
    to be 5 years ago.
    Don't get me wrong, I perfectly understand your desire to manage this, but MDT doesn't provide any other way, then the things I have pointed out to you here.
    Good luck! :)
    If this post is helpful please click "Mark for answer", thanks! Kind regards

  • How to use the same keypair for both encrypt/decryprt-SunPKCS#11

    Dear All,
    Subject: To access iKey 2032 token, to retrieve public/private key from iKey 2032 token using pkcs#11 in sdk1.5, to encrypt/decrypt files.
    When I separate the encrypt and decrypt part of java program, encryption program works well, whereas decryption program does not decrypt anything in the decrypt file (But there is no error). I printed out the public and private key in both encrypt and decrypt part of java program, its displayed differently::
    Encrypt program:
    SunPKCS11-rainbow_token RSA public key, 1024 bits (id 10, session object)
    modulus: 114338469922835728259534620463489934081917342509275191892563243582065
    74380495029336519036972702864998634664269499641616889325482699399559620370181624
    72068116957594402738459932902481604823224406859575930392708524033619120886256353
    58738237376491107769961041015109436347533548940674900728805627968145581222172729
    public exponent: 65537
    SunPKCS11-rainbow_token RSA private key, 1024 bits (id 11, session object, sensi
    tive, unextractable)
    Decrypt Program::
    SunPKCS11-rainbow_token RSA public key, 1024 bits (id 12, session object)
    modulus: 138556361758970660122782926386849783732271581948935425587968692317930
    09262429353977097956605140384961825974398004270547046620971835394362397699233738
    54481804748731546655197744692886754946373745924825650876065903334173666990347814
    83727290962956934521650035029131176614982652900659797194703065074407857754883163
    public exponent: 65537
    SunPKCS11-rainbow_token RSA private key, 1024 bits (id 13, session object, sensi
    tive, unextractable)
    I suspect that every time program generates different set of key, therefore we need to store the generated key during encryption part (i believe it is to be in the keystore) and to use the same for decryption part. Could you please give me a tips how to do this?
    Encrypt Program ::
    import java.io.*;
    import java.util.*;
    import java.lang.*;
    import java.sql.*;
    import java.text.*;
    import java.math.*;
    import java.security.*;
    import java.security.cert.*;
    import java.security.interfaces.*;
    import javax.crypto.interfaces.*;
    import javax.net.ssl.*;
    import javax.crypto.*;
    import javax.crypto.spec.DESKeySpec;
    import java.security.KeyStore.*;
    * A class of Encrypt.
    public class Encrypt
    public Encrypt(){}
    public void loginToken() {
         Provider p = new sun.security.pkcs11.SunPKCS11(MQConfig.getvalue("SecurityPropertyPath"));
         Security.addProvider(p);
         KeyStore ks = null;
         try{
              String password = General.ReadFiles(MQConfig.getvalue("logFilePath"),"Simple");
              password = password.trim();
              char pin[] = password.toCharArray();
              ks = KeyStore.getInstance("pkcs11");
              ks.load(null,pin);
         KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA",p);
              KeyPair kp = kpg.genKeyPair();
              kpg.initialize(1024, new java.security.SecureRandom());
              FileInputStream in = new FileInputStream("C:\\ReportDBBE.properties");
              FileOutputStream out = new FileOutputStream("C:\\ReportDBAE.properties");
              Cipher cp=Cipher.getInstance("RSA/ECB/PKCS1Padding", p);
              cp.init(cp.ENCRYPT_MODE,kp.getPublic());
              CipherOutputStream cout=new CipherOutputStream(out,cp);
              byte[] input=new byte[8];
              int byteread=in.read(input);
              while(byteread!=-1){
                   cout.write(input,0,byteread);
                   byteread=in.read(input);
              cout.flush();
              in.close();
              cout.close();
         catch(NoSuchAlgorithmException nsae)
         System.out.println("No Such Algorithm Exception " + nsae.getMessage());
         catch(NoSuchPaddingException nspe)
         System.out.println("No Such Padding Exception " + nspe.getMessage());
         catch(InvalidKeyException ike)
         System.out.println("Invalid Key Exception " + ike.getMessage());
         catch(IllegalStateException ise)
         System.out.println("Illegal State Exception " + ise.getMessage());
         catch(KeyStoreException kse)
         System.out.println("Key Store Exception " + kse.getMessage());
         catch(CertificateException ce)
         System.out.println("Certificate Exception " + ce.getMessage());
         catch(IOException ioe)
         System.out.println("IO Exception " + ioe.getMessage());
    public static void main (String args[]) throws Exception {
         try{
         Encrypt tl = new Encrypt();
         tl.loginToken();
         }catch(Exception e){
         e.printStackTrace();
    Decrypt Program ::
    import java.io.*;
    import java.util.*;
    import java.lang.*;
    import java.sql.*;
    import java.text.*;
    import java.math.*;
    import java.security.*;
    import java.security.cert.*;
    import java.security.interfaces.*;
    import javax.crypto.interfaces.*;
    import javax.net.ssl.*;
    import javax.crypto.*;
    import javax.crypto.spec.DESKeySpec;
    import java.security.KeyStore.*;
    * A class of Decrypt.
    public class Decrypt
    public Decrypt(){}
    public void loginToken() {
         Provider p = new sun.security.pkcs11.SunPKCS11(MQConfig.getvalue("SecurityPropertyPath"));
         Security.addProvider(p);
         KeyStore ks = null;
         try{
              String password = General.ReadFiles(MQConfig.getvalue("logFilePath"),"Simple");
              password = password.trim();
              char pin[] = password.toCharArray();
              ks = KeyStore.getInstance("pkcs11");
              ks.load(null,pin);
         KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA",p);
              KeyPair kp = kpg.genKeyPair();
              kpg.initialize(1024, new java.security.SecureRandom());
              FileInputStream in1 = new FileInputStream("C:\\ReportDBAE.properties");
              FileOutputStream out1 = new FileOutputStream("C:\\ReportDBAD.properties");
              Cipher cipher=Cipher.getInstance("RSA/ECB/PKCS1Padding", p);
              AlgorithmParameters algParams = cipher.getParameters();
              cipher.init(Cipher.DECRYPT_MODE,kp.getPrivate(),algParams);
              CipherInputStream cin1=new CipherInputStream(in1,cipher);
              byte[] input1=new byte[8];
              int byteread1=cin1.read(input1);
              while(byteread1!=-1){
                   out1.write(input1,0,byteread1);
                   byteread1=cin1.read(input1);
              out1.flush();
              in1.close();
              out1.close();
              cin1.close();
         catch(NoSuchAlgorithmException nsae)
         System.out.println("No Such Algorithm Exception " + nsae.getMessage());
         catch(NoSuchPaddingException nspe)
         System.out.println("No Such Padding Exception " + nspe.getMessage());
         catch(InvalidKeyException ike)
         System.out.println("Invalid Key Exception " + ike.getMessage());
         catch(IllegalStateException ise)
         System.out.println("Illegal State Exception " + ise.getMessage());
         catch(InvalidAlgorithmParameterException iape)
         System.out.println("Invalid Algorithm ParameterException " + iape.getMessage());
         catch(KeyStoreException kse)
         System.out.println("Key Store Exception " + kse.getMessage());
         catch(CertificateException ce)
         System.out.println("Certificate Exception " + ce.getMessage());
         catch(IOException ioe)
         System.out.println("IO Exception " + ioe.getMessage());
    public static void main (String args[]) throws Exception {
         try{
         Decrypt tl = new Decrypt();
         tl.loginToken();
         }catch(Exception e){
         e.printStackTrace();
    Configuration file::
    name = rainbow_token
    library = c:\winnt\system32\dkck201.dll
    attributes(*,CKO_PRIVATE_KEY,*) = {
    CKA_SIGN = true
    attributes(*,CKO_PRIVATE_KEY,CKK_DH) = {
    CKA_SIGN = null
    attributes(*,CKO_PRIVATE_KEY,CKK_RSA) = {
    CKA_DECRYPT = true
    }

    Hi all,
    Now i manage to use the same keypair for both encrypt/decryprt-SunPKCS#11. Below is my code woks well. In my code i hard coded alias name of certificate, did anyone knows how to read alias name of certificate from iKey token 2032??
    import java.io.*;
    import java.util.*;
    import java.lang.*;
    import java.sql.*;
    import java.text.*;
    import java.math.*;
    import java.security.*;
    import java.security.cert.*;
    import java.security.interfaces.*;
    import javax.crypto.interfaces.*;
    import javax.net.ssl.*;
    import javax.crypto.*;
    import javax.crypto.spec.DESKeySpec;
    import java.security.KeyStore.*;
    * A class of Encrypt.
    public class Encrypt
    public Encrypt(){}
    public void loginToken() {
         Provider p = new sun.security.pkcs11.SunPKCS11(MQConfig.getvalue("SecurityPropertyPath"));
         String myAlias = "349eefd1-845b-4ba4-9f88-06e9f5cb82f6";
         /** to view alias name
         keytool -list -v -keystore NONE -storetype PKCS11 -storepass PASSWORD
         Security.addProvider(p);
         KeyStore ks = null;
         PrivateKey privKey = null;
         PublicKey pubKey = null;
         try{
              String password = General.ReadFiles(MQConfig.getvalue("logFilePath"),"Simple");
              password = password.trim();
              char pin[] = password.toCharArray();
              ks = KeyStore.getInstance("pkcs11");
              ks.load(null,pin);
              java.security.cert.Certificate cert = ks.getCertificate(myAlias);
              Key key = ks.getKey(myAlias, pin);
              if(key != null) {
                   System.out.println("key class: " + key.getClass().getName()); // -> sun.security.pkcs11.P11Key$P11PrivateKey
                   System.out.println("key bytes: " + key.getEncoded()); // -> null!!!!!!!
         if(PrivateKey.class.isInstance(key)) {
         privKey = (PrivateKey)key;
         System.out.println("algo: " + privKey.getAlgorithm()); // -> RSA
         //Signature rsasig = Signature.getInstance("SHA1withRSA");
         //rsasig.initSign(privKey);
         //rsasig.update(data.getBytes());
         //byte[] sigBytes = rsasig.sign();
         pubKey = cert.getPublicKey();
         //System.out.println("signed bytes: " +sigBytes);
         //return sigBytes;
         //KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA",p);
              //KeyPair kp = kpg.genKeyPair();
              //KeyPair kp = kpg.generateKeyPair();
              //kpg.initialize(1024, new java.security.SecureRandom());
              FileInputStream in = new FileInputStream("C:\\ReportDBBE.properties");
              FileOutputStream out = new FileOutputStream("C:\\ReportDBAE.properties");
              Cipher cp=Cipher.getInstance("RSA/ECB/PKCS1Padding", p);
    //cp.init(cp.ENCRYPT_MODE,kp.getPublic());
              cp.init(cp.ENCRYPT_MODE,pubKey);
              CipherOutputStream cout=new CipherOutputStream(out,cp);
              byte[] input=new byte[8];
              int byteread=in.read(input);
              while(byteread!=-1){
                   cout.write(input,0,byteread);
                   byteread=in.read(input);
              cout.flush();
              in.close();
              cout.close();
         catch(NoSuchAlgorithmException nsae)
         System.out.println("No Such Algorithm Exception " + nsae.getMessage());
         catch(NoSuchPaddingException nspe)
         System.out.println("No Such Padding Exception " + nspe.getMessage());
         catch(InvalidKeyException ike)
         System.out.println("Invalid Key Exception " + ike.getMessage());
         ike.printStackTrace();
         catch(IllegalStateException ise)
         System.out.println("Illegal State Exception " + ise.getMessage());
         catch(KeyStoreException kse)
         System.out.println("Key Store Exception " + kse.getMessage());
         catch(CertificateException ce)
         System.out.println("Certificate Exception " + ce.getMessage());
         catch(IOException ioe)
         System.out.println("IO Exception " + ioe.getMessage());
         catch(UnrecoverableKeyException unrke)
         System.out.println("Unrecoverable Key Exception " + unrke.getMessage());
    public static void main (String args[]) throws Exception {
         try{
         Encrypt tl = new Encrypt();
         tl.loginToken();
         }catch(Exception e){
         e.printStackTrace();
    Your help is very much appreciated!!!!

  • Can i use the same advertisement to multiple collections?

    Can i use the same advertisement to multiple collections?
    Advertisment A1 currently linked to collection C1.
    Can i use the same advertisement A1 to a collection C2? Because my collection C1 is query based and the C2 would be a static one.
    If i use the same A1 advert, will it affect the earlier linked C1 collection i any ways?
    System Security analyst at CapG

    Well, in 2007 you actually kind of can. You can used linked collections to make C2 a linked sub-collection under C1 and ensure that the advert applies to sub-collections.
    Jason | http://blog.configmgrftw.com | @jasonsandys

Maybe you are looking for

  • Voice over vpn-call not completing

    Hi folks, I got a problem,where with voice over vpn. So far my voip calls were running purely on shared IP internet. Today we had tried to make two side a vpn site-to-site tunnel and send traffic thru.vpn is working. (md5,des) The problem We faced is

  • Reading data from a text file but can't use the data outside of the function.

    I am trying to load a variable from data in a text file. I can read the text file fine but the variable data seems only to be available with in the function that reads it. I need to use the variable data outside of the function. Does anyone have any

  • Motion and alert message

    I have built maps for a TV show. They are vector, I was able to put the movement in the map as I wanted to do in motion. I made a QT movie of it and opened it in a new project to add text while still in motion. It's simple. When I try to make a QT mo

  • I am not able to open a new tab....help

    Hi I am not able to open new tabs......I am using Firefox.

  • Anyone Install 10.1.0.4 in AIX 10g RAC?

    We can´t, because failed when do the post installation task. Thanks... Charly