Jar file cryptation/decryptation

Hi,
I'm currently using Java Web Start for downloading components to the client. The jar files are signed, and I'm using a Certificate for the verification on the client side.
My question is: is there a way to encrypt my jar-files and then decrypt them on the client automatically by using the certificate?
If not, can a certificate be used for encryption/decryption of files in any way?
/johan

Since a certificate usually contains a public key, you should be able to use public key cryptography. I guess the client has your certificate, with your public key. For the encryption to work, you would have to have a public key of the user. You could also encrypt the jar with your private key and the user could decrypt it with your public key, then you would not need the user's public key, the only problem there is that anyone with your public key would be able to decrypt it. So I do not think there is a way around you having the user's public key.
- Daniel

Similar Messages

Encryption/decryption through jar file and classes

Hi,
My application uses tomcat as web server.
I am doing encrytion and decyption.
i fetch encypted data from database and then decrypt it
If i use calsses in webapps -> WEB-INF -> classes folder, i place classes in that ,
In other case i use jar file and place that file in WEB-INF -> lib folder in the webapps directory.
There is huge performance difference.
While using classes performance is great while using jar file performance is very disappointed.
I am using a file for encryption /decryption also.

Are you getting any error messages? Have you put debugging code in those classes to see what is happening?

Problem parsing XML with schema when extracted from a jar file

I am having a problem parsing XML with a schema, both of which are extracted from a jar file. I am using using ZipFile to get InputStream objects for the appropriate ZipEntry objects in the jar file. My XML is encrypted so I decrypt it to a temporary file. I am then attempting to parse the temporary file with the schema using DocumentBuilder.parse.
I get the following exception:
org.xml.sax.SAXParseException: cvc-elt.1: Cannot find the declaration of element '<root element name>'
This was all working OK before I jarred everything (i.e. when I was using standalone files, rather than InputStreams retrieved from a jar).
I have output the retrieved XML to a file and compared it with my original source and they are identical.
I am baffled because the nature of the exception suggests that the schema has been read and parsed correctly but the XML file is not parsing against the schema.
Any suggestions?
The code is as follows:
public void open(File input) throws IOException, CSLXMLException {
    InputStream schema = ZipFileHandler.getResourceAsStream("<jar file name>", "<schema resource name>");
    DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
    DocumentBuilder builder = null;
    try {
      factory.setNamespaceAware(true);
      factory.setValidating(true);
      factory.setAttribute(JAXP_SCHEMA_LANGUAGE, W3C_XML_SCHEMA);
      factory.setAttribute(JAXP_SCHEMA_SOURCE, schema);
      builder = factory.newDocumentBuilder();
      builder.setErrorHandler(new CSLXMLParseHandler());
    } catch (Exception builderException) {
      throw new CSLXMLException("Error setting up SAX: " + builderException.toString());
    Document document = null;
    try {
      document = builder.parse(input);
    } catch (SAXException parseException) {
      throw new CSLXMLException(parseException.toString());
    }

I was originally using getSystemResource, which worked fine until I jarred the application. The problem appears to be that resources returned from a jar file cannot be used in the same way as resources returned directly from the file system. You have to use the ZipFile class (or its JarFile subclass) to locate the ZipEntry in the jar file and then use ZipFile.getInputStream(ZipEntry) to convert this to an InputStream. I have seen example code where an InputStream is used for the JAXP_SCHEMA_SOURCE attribute but, for some reason, this did not work with the InputStream returned by ZipFile.getInputStream. Like you, I have also seen examples that use a URL but they appear to be URL's that point to a file not URL's that point to an entry in a jar file.
Maybe there is another way around this but writing to a file works and I set use File.deleteOnExit() to ensure things are tidied afterwards.

Interactive Reporting-Importing jar files

Hello Experts,
We have Hyperion Interactive reporting 8.3 installed and I am trying to implement user level restrictions to access the Brio reports, using a dashboard section. We already have a table tab_user where the login_id and password are stored. The user supplied values should be compared with that table values. Problem here is, the password is stored in an encrypted format in the database table. So, in brio also I have to encrypt it and do the comparison with the database password or the other way around. For this, can we import jar files (where the password will be encrypted )in Hyperion??
If yes, please let me know how to achieve that.
Also please suggest URL’s that has some complex sample dashboards.
Let me know if anything is not clear.
Thanks in avance.

Hi Wayne,
We don't need the decrypt routine. We have other applications that also follow the same process to encrypt the string and whatever output I am getting it's matching with those applications.
When I encrypt the string password with key M&T_reee the encrypted string is *894B11B5A398331FA6C58CD301AAE756*
I was not able to establish an ODBC connection(where I am processing the stored procedure) from the dashboard.
When I try following set of commands, it's throwing an error "Script(x):uncaught exception: Internal Error"
ActiveDocument.Sections["Procedure_qry"].DataModel.Connection.Open("C:\\ODBC_SP_DB.oce")
ActiveDocument.Sections["Procedure_qry"].DataModel.Connection.SetPassword("test")
ActiveDocument.Sections["Procedure_qry"].DataModel.Connection.Connect()
When I connect the query manually using the same oce it's working fine, but I couldn't achieve this thru dashboard.Please advice.
-Thanks

Performance issue if we use jar file instead of classes

Hi,
My application uses tomcat as web server.
If i use calsses in webapps -> WEB-INF -> classes folder, i place classes in that ,
In other case i use jar file and place that file in WEB-INF -> lib folder in the webapps directory.
There is huge performance difference.
While using classes performance is great while using jar file performance is very disappointed.
I am using a file for encryption /decryption also.

I can't really believe that classes vs jars makes a difference, but whatever.

Protect jar file from unzip utility

Hi
I have an application in .jar file and I don't want that the client
can extract or unzip and see the contents of my .jar file.But still the .jar file
could run by mouse double click or java -jar command.
Anyone can give me an idea how to do it.
Thanks...

If java can read it on your client's machine, the client can read it. There is no way to prevent this. Here's the general cycle:
int protectionMode = chooseProtectionMode();
boolean haveCustomers = true;
while (haveCustomers)
switch (protectionMode)
    case OBFUSCATE:
      //You can obfuscate your code to make it (marginally) harder to
      //reverse-engineer. If your client is really interested in your
      //code, this won't keep them from figuring out what it does.
      break;
    case ENCRYPT:
      // You can encrypt most of your class files, and build a
      // decrypting classloader, and build a framework that calls
      // the decrypting classloader to get at the rest of the jar.
      // Of course, your client can just arrange to call your
      // classloader from their own, and write the (decrypted)
      // classfiles to disk, and then reverse engineer them.
      protectionMode = OBFUSCATE;
      break;
    case STATECHECK:
      // You can put some kind of check in your decrypting classloader
      // that calls System.exit() if it discovers it's being called in
      // such an unfriendly way. Your client will take about 10 minutes
      // to find and remove the check.
      protectionMode = ENCRYPT;
      break;
    case REMOTE:
      // You can keep your code on your server and let the client run
      // something that talks to it. The client will complain
      // vociferously, and refuse to use your app.
      haveCustomers = false;
      break;
    default:
      // You can decide to stop stressing over something you can't
      // help, and write code that people will buy
}(Sorry - in an odd mood, seen this question or one like it too often recently, not enough sleep...)

Where should the third party JAR files be placed ?

Hi,
We have a requirement to perform encryption / decryption of supplier bids. In this case we require to use third party provider JAR files with OA framework code. Where should the JAR files generally be placed in such a scenario ?
Thanks and Regards,
Sandhya

Checkout this post.
How to inclue a third party .jar file in OA fwk classpath Class not found

Securing .jar file

Hi guys,
I need to secure my .jar file so that nobody can unjar it and reverse engineer it.... is there a solution in the market that you suggest to be used??
I would very much appreciate your response

How do you imagine the classes in the jar could be loaded if java cannot unjar the jar file? And if java can unjar it, so can jar.
Individual class files can be encrypted - then you need a custom ClassLoader that can decrypt them when loading them - which means someone can reverse-engineer your ClassLoader and un-encrypt the class files.
You can run your classes through an obfuscator making it more difficult to reverse-engineer the classes.

Updating a running JAR file without using JDK

Hi guys, I have been stuck on this problem for days. I have a program that allows the user to log in and encrypt/decrypt files. This program must be stored on the removable drive and it should work on any operating system without requiring any installation of files. In order to store their login data, I wrote it to a shadow.txt file. My idea was to pack this shadow file into the JAR file so as not to create unnecessary files. I understand that in order to update JAR files, all I need to do is to do
Runtime.getRuntime().exec("jar uf login.jar shadow.txt");However, here's the problem. I cannot assume that every user PC has JDK installed. As JRE doesn't have jar.exe, that command won't work anymore. Furthermore, the JAR is currently in use. So even if the user has JDK, windows will never allow this command to go through. Anyone has any ideas?

I had similar requirement, except that, i used a war file.
Had a client.war file in JBoss deploy directory, and i needed to update client.jnlp file present in it.
But as jar.exe comes only with jdk, could not use jar -uf command.
But not sure if it works with other application server too,
in jboss we can explode the war file, meaning we can create a directory "client.war" in deploy directory and extract your client.war contents to it. Now when server starts, it considers the extracted directory as web archive application.
This extraction can be done with out using jar.exe. can be done using jarinputstream aswell.
Once the contents are extracted , the files in it can be modified with out jar.exe.
For my case it worked as my client.war file is not signed, although the resources inside are signed.

Hide the jar file

hi All,
i have created one jar file,which contains lot of java class files.i want no one can see the original coding of the class file(some software is available for converting class files in to java file).
how can i restrict these functionality?

You cannot keep him from decrypting/decompiling your
code. You can only make it quite difficult.
Obfuscators, maybe a custom classloader with
encryption... the usual suspects.
Or simply take the quite favorable chance that
nobody's interested in seeing you app's code.Unless something has changed this is worthless.

DrClap, schapel, jschell whats better architecture jar files or class files

What would be a better architecture for deployment. Jar files or class files. We were recently having a debate at work as to generate installation scripts that put jar files on the system where the app is being installed or to make the script generate class files at the desired location.
It would be good to know as to what you ppl think and what are the pros and cons of both.
Some claimed with class files it would be easier to put in patches later on and I kinda agree with that. However your thoughts would be appreciated.
Come on DrClap, schapel, jschell, jsalonen....... I am a fan of yours already

This, of course, is why topics shouldn't be addressed to individuals - they are likely to never see it. Today is the first time I have seen this, and that is due solely to a search that I was running.
Why would you use one over the other?
----Distribution costs
It takes more time to send a bunch of class files down the wire than a single jar file. However, it takes more time to send a jar than a single class file. So there is a delicate trade off in a web application where one is using java. If you send the jar every time it is modified the entire jar must be moved. Class files take less time, but all of them must be moved for a new person.
So in this case if you have a fixed based of users (internal use), and a majority of the files do not change then class files are better. If the user base is transitory and large (external use) then a jar file is probably better.
----Usage:
You can use reflection to dynamically add functionality to an application. If you use a jar file then the application must be restarted for the changes to take effect. If you use class files then the application does not have to be restarted. Obviously the second only works if you have some way to dynamically notify the application that new classes are available - like a database.
This becomes very relevant if you do not want to restart the application and you do not have a distributed application base in place.
Also the older classes, even if not used, are still loaded in the application unless it is restarted (presuming a class loader is not used.) Most of the time this does not make difference.
Since in the above it is likely that there is not a large distribution problem, when the usage is a concern then the best strategy is as class files. They allow the most flexibility and there is unlikely to be any concern at all how it is packaged.
-------Misc
Speed. Someone suggested speed. Guessing I would say that the jar file is going to be faster. Once the Sun jvm gets the file it doesn't let go. And as pointed out opening files is rather costly. However, I doubt this is going to be a significant cost on any system. Startup costs, although sometimes annoying, are seldom significant in terms of application performance.
Security. The is a certain level of security with a jar file. You have one jar file and distribute it to the help desk people. And one of them deletes it accidently. It is going to be a lot easier to figure that out than if they deleted one class file. Additionally it is probably easier to encrypt/decrypt a jar file (if you really must) than class files.
Dynamic class loading. If you are storing classes in non-traditional places, like a database rather than files, then it is probably going to be easier if you do it as class files.
Testing. It is easier to replace a class file in a testing environment to fix a bug than a jar file. Particularily if the make process for the jar file rebuilds everything.

Application working under NetBeans but not as a *.jar file

Hello,
recently I found a little problem. I wrote application that shows all available ports in my computer. When I am running this applications under NetBeans it works with no problem - finds all available ports. Then I am building it to the *.jar file. Application is working with no problem but command:
Enumeration PortIds = CommPortIdentifier.getPortIdentifiers();
is not returning any identifiers - PortIds is empty.
Anyone knows a solution for this type of problems? Thanks

Hi Venkatesh,
Few questions.
1. What is your JDeveloper version? (Always better to post your JDev version along with the question, which would help us to help you better).
2. Did you try adding webserviceclient.jar to the classpath? (Search in your JDev installation directory for the location of this jar file).
-Arun

.jar file is not working properly :developed in NETBEANS

Hi Gurus,
i am using NETBEANS IDE 7.2.
i am developing a project that interacts with databases 10g and COM ports of machine , these all processes are performed by .bat file which i am trying to run from jFramform , code works perfectly .bat file is also called perfectly when i run the project using F6 from the NETBEANS, for testing i placed some dialogue boxes on the form to test it ,
but when i run executable .jar file , form run successfully and dialogue box works perfectly but .bat file is not called by executable .jar file.
this is how i call the .bat file...
String filePath = "D:/pms/Libraries/portlib.bat";
        try {
          Process p = Runtime.getRuntime().exec(filePath);
        } catch (Exception e) {
            e.printStackTrace();
and below is the contents of portlib.bat file
java -jar "D:\SMS\SMS\dist\SMS.jar"
you must probably ask why i am calling a .jar file using .bat file .
reason is that this .jar project sends message using GSM mobile , System.exit(); is compulsory to complete a job and then do the next one ,
if i use the same file to execute this job it makes exit to entire the application (hope you can understand my logic).
that's why i use extra .jar file in .bat file , when single job is completed .bat exits itself and new command is given.
Problem is that code is working perfectly in NETBEANS when i run the project but when i run .jar then .bat file is not working ,
thanks.

Thanks Sir ,
You need to first test an example that works like the one in the article.
There are plenty of other examples on the web - find one you like:
http://javapapers.com/core-java/os-processes-using-java-processbuilder/
I tried this one.
try {
            ProcessBuilder dirProcess = new ProcessBuilder("D:/SMS/SMS/Send_message.bat");
             File commands = new File("D:/SMS/SMS/Send_message.bat");
             File dirOut = new File("C:/process/out.txt");
             File dirErr = new File("C:/process/err.txt");
           dirProcess.redirectInput(commands);
             dirProcess.redirectOutput(dirOut);
           dirProcess.redirectError(dirErr);
             dirProcess.start();
        } catch (IOException ex) {
            Logger.getLogger(mainform.class.getName()).log(Level.SEVERE, null, ex);
as instructed in the article i compiled both the projects at same version or sources and libraries which is 1.7
here is my version details
C:\>javac -version
javac 1.7.0_07
C:\>java -version
java version "1.7.0_07"
Java(TM) SE Runtime Environment (build 1.7.0_07-b11)
Java HotSpot(TM) Client VM (build 23.3-b01, mixed mode, sharing)
inside the NETBEANS IDE c:\process\err.txt remains empty and code works perfectly , but when I run executable .jar file( by double clicking on that file in dist directry) then c:\process\err.txt becomes full with this error text and there is no response from calling D:\SMS\SMS\send_message.bat
here is the error text
java.lang.UnsupportedClassVersionError: sms/SMSMAIN (Unsupported major.minor version 51.0)
at java.lang.ClassLoader.defineClass0(Native Method)
at java.lang.ClassLoader.defineClass(Unknown Source)
at java.security.SecureClassLoader.defineClass(Unknown Source)
at java.net.URLClassLoader.defineClass(Unknown Source)
at java.net.URLClassLoader.access$100(Unknown Source)
at java.net.URLClassLoader$1.run(Unknown Source)
at java.security.AccessController.doPrivileged(Native Method)
at java.net.URLClassLoader.findClass(Unknown Source)
at java.lang.ClassLoader.loadClass(Unknown Source)
at sun.misc.Launcher$AppClassLoader.loadClass(Unknown Source)
at java.lang.ClassLoader.loadClass(Unknown Source)
at java.lang.ClassLoader.loadClassInternal(Unknown Source)
Exception in thread "main"
here is /SMS/SMS
unknown source ?

Unable to load database driver from my applet's jar file

I'm trying to set up an applet that will talk to a MySQL database. I have no problem connecting to the database as I'm developing the code ("un-jarred"), but when I create a jar file of my code to test through a web browser, I cannot connect to the database due to the usual ClassNotFoundException. I have included mysql-connector-java-3.1.12-bin.jar (the current driver) in the jar, but I don't know if I'm supposed to supply some info through an attribute to the applet tag to let it know that the jar contains the driver it needs or if I have to call the driver differently in my code.
Any help is appreciated, thanks.

The simplest approach is always the best. :)Abso-lutely.
Awesome, that worked perfectly. I Included the extra
jar file in the applet tag and now my applet makes
some sweet lovin' to the database.And you have succeeded where thousands have failed. Congratulations.

Crystal Report not works in JAR File

I'm using Eclipse All in one, which includes Crystal Reports.. I Connected my Java program with Crystal Reports and its working properly. Now my problem is that the Report is not working in JAR files.. It throws some exception as
"com.crystaldecisions.sdk.occa.report.lib.ReportSDKException: com.businessobjects
com.businessobjects.reports.sdk.JRCCommunicationAdapter---- Error code:-2147215357 Error code name:internal"
Whats the Error.. I don't know. I think that i may missed some CLASSPATH Files. The included CLASSPATH Files are:
ReportViewer.jar
jrcerom.jar
Concurrent.jar
CrystalCharting.jar
CrystalCommon.jar
CrystalContentModels.jar
CrystalExporters.jar
CrystalExportingBase.jar
CrystalFormulas.jar
CrystalQueryEngine.jar
CrystalReportEngine.jar
CrystalReportingCommon.jar
icu4j.jar
keycodeDecoder.jar
log4j.jar
MetafileRenderer.jar
rasapp.jar
rascore.jar
rpoifs.jar
Serialization.jar
URIUtil.jar
xercesImpl.jar
xml-apis.jar
and the mysql-connector jar file
Anybody help me please...

Unable to load database connector
'com.crystaldecisions.reports.queryengine..driverImpl.
DriverLoader
now you have any idea.. pleaseIs that a typo where you have two periods below?
queryengine..driverImplOther than that I don't think anybody here can help you with that. If your classpath includes all necessary JAR files and you are able to access all your resources from within your application JAR file, then I imagine there is a problem with the third-party crystal decisions JAR file or how you are attempting to use it.
My advice to you is to try and contact support with the vendor or provider of this API or possibly try posting on a support forum on their website to see if somebody can help you there.

Jar file cryptation/decryptation

Similar Messages

Maybe you are looking for