Java API to read the Encrypted Values from Windows Registry settings

Question

Is there any Java API to read the Encrypted Values from Windows Registry settings ?
My Java Application invokes a 3rd party Tool that writes the key/value to windows registry settings under : “HKLM\Software\<3rdparty>\dataValue”.
This entry is in BINARY and encrypted with 3DES, using crypto API from Microsoft.
3rd party software to encrypt the data stored in registry it
either uses C++ code: and uses the call “CryptProtectData” and “CryptUnProtectData” or
If it is a .NET (C#) it uses the call “Protect” or “UnProtect” from class “ProtectData” of WinCrypt.h from the library “Crypt32.lib.
Note: The data is encrypted using auto-generated machinekey and there is no public key shared to decrypt the Encrypted data.
Since the data is encrypted using auto-generated machinekey the same can be decrypted from a .Net / C++ application using CryptUnprotectData or UnProtect() API of WinCrypt.h from the library “Crypt32.lib.
To know more about Auto-Generated MachineKey in Windows refer the links below
http://aspnetresources.com/tools/machineKey
http://msdn.microsoft.com/en-us/library/ms998288.aspx
I need to find a way in Java to find the equivalent API to decrypt (CryptUnprotectData) and Microsoft will automatically use the correct key.
But i couldn't find any informato related to Java APIs to enrypt or decrypt data using auto-generated machinekey.
Is there a way to read the encrypted data from Windows regsitry settings that is encrypted using the Auto-Generated Machine Key ?
Kindly let me know if Java provides any such API or mechanism for this.

Answer 1

If the symmetric key is "auto-generated" and is not being stored anywhere on the machine, it implies that the key is being regenerated based on known values on the machine. This is the same principle in generating 3DES keys using PBE (password-based-encryption). I would review the documentation on the C# side, figure out the algorithm or "seed" values being used by the algorithm, and then attempt to use the JCE to derive the 3DES key using PBE; you will need to provide the known values as parameters to the PBE key-generation function in JCE. Once derived, it can be used to decrypt the ciphertext from the Regiistry in exactly the same way as the CAPI/CNG framework.
An alternate way for Java to use this key, is to write a JNI library that will call the native Windows code to do the decryption; then the Java program does not need to know details about the key.
That said, there is a risk that if your code can derive the key based on known seeds, then so can an attacker. I don't know what your applicatiion is doing, but if this is anything related to compliance for some data-security regulation like PCI-DSS, then you will fail the audit (for being unable to prove you have adequate controls on the symmetric key) if a knowledgable QSA probes this design.
Arshad Noor
StrongAuth, Inc.