Java.lang.IllegalStateException: Cipher not initialized during loadtest

Question

Hi All,
Below is my code :
static Cipher pbeCipher;
     byte[] encbytes = hexToByte( encrypted );
     pbeCipher.init( javax.crypto.Cipher.DECRYPT_MODE, pbeKey, pbeParamSpec );
byte[] decbytes ;
synchronized (pbeCipher) {
     decbytes = pbeCipher.doFinal( encbytes );
          return new String( decbytes );
I got the below exception when we are actually performing the load tests where in 4000 hits are made on the code in 1 min.
java.lang.IllegalStateException: Cipher not initialized
at javax.crypto.Cipher.c(Unknown Source)
at javax.crypto.Cipher.doFinal(Unknown Source)
My doubt here is : Is it occuring becuase of synchronizing issue? As shown in the code above i had synchronized the doFinal call. Still the exceptions are occuring. These are randomly coming say 1 out of 500 hits.
Please suggest me a solution on how to fix this. We are using PBEWithMD5AndDES encryption mechanism in this case.
Solution for this would help me a lot in terms of fixing it...
Thanks in Advance......

Answer 1

Cipher is not thread safe so that is almost certainly your problem. Your synchronisation does not include the init() method so it is possible that the instance is being initialised in one thread and used for decryption in a different thread.
My approach is to create a pool of Cipher instances and then get an instance from the pool, use it and then put it back in the pool.
P.S. DES is now considered deprecated in favour of AES. PBE is a poor man's approach since the chances are the password has far less entropy than the key size so will be much weaker than that implied by the algorithm being used. PBE is normally used for securing a user's data so in a Web based application it normally does not make sense to use PBE.