I was looking for an encryption package for GWT. A client had some mildly private information that they wanted to encrypt in transmission. Now, of course, this is ultimately futile. Anyone who wants to get at this information can, because we send the source code (however obfuscated) that decrypts the information to the client. To borrow Corey Doctorow’s words, the attacker is also the recipient. But, sometimes just making getting the information inconvenient is good enough.
I looked at a couple of encryption options. There’s are a couple of nice javascript libraries that do encryption: Gibberish-AES and javascript.crypto.library, but they hav no GWT hooks (and javascript.crypto.library is released under the AGPL which has some unclear legal ramifications).
However, there is a project from about two years ago that does Triple DES encryption and is written in pure GWT. It’s even called gwt-crypto. Unfortunately, it hasn’t been maintained recently. I was able to download the files, apply a fix (for issue #1) and move some files around in such a way that it works.
Here’s how you use it:
on the server:
TripleDesCipher cipher = new TripleDesCipher();
cipher.setKey(Constants.GWT_DES_KEY);
try {
enc = cipher.encrypt(String.valueOf(value));
} catch (DataLengthException e1) {
e1.printStackTrace();
} catch (IllegalStateException e1) {
e1.printStackTrace();
} catch (InvalidCipherTextException e1) {
e1.printStackTrace();
}
On the client, make sure you inherit the module:
<inherits name='com.googlecode.gwt.crypto.Crypto'/>
Then:
TripleDesCipher cipher = new TripleDesCipher();
cipher.setKey(Constants.GWT_DES_KEY);
String dec ="";
try {
dec = cipher.decrypt(enc);
} catch (DataLengthException e) {
e.printStackTrace();
} catch (IllegalStateException e) {
e.printStackTrace();
} catch (InvalidCipherTextException e) {
e.printStackTrace();
}
I just use a constant DES key, which is not all that secure. I’m sure you could do something more secure like hashing the request time, filename and some other secret key, but you need to make sure that both the server and the client agree on the key, otherwise you’ll not be able to decrypt the info.
Update 6/13: I got permission from the project owner to update the google project, so I’ve done that. You can download the new gwt-crypto jar there.
The modified gwt-crypto jar file is here. I’m hoping the administrator will let me at least check in the changes I’ve made so that it works on GWT 1.5.3 (can’t speak for GWT 1.6).
[tags]gwt,tripledes encryption,hiding in plain sight[/tags]
Follow me on Twitter
Follow me on Blue Sky