{"id":529,"date":"2009-06-12T10:08:55","date_gmt":"2009-06-12T16:08:55","guid":{"rendered":"http:\/\/www.mooreds.com\/wordpress\/archives\/000529"},"modified":"2009-06-13T09:44:00","modified_gmt":"2009-06-13T15:44:00","slug":"gwt-encryption-options","status":"publish","type":"post","link":"https:\/\/www.mooreds.com\/wordpress\/archives\/529","title":{"rendered":"GWT encryption options"},"content":{"rendered":"

I was looking for an encryption package for GWT.\u00a0 A client had some mildly private information that they wanted to encrypt in transmission.\u00a0 Now, of course, this is ultimately futile.\u00a0 Anyone who wants to get at this information can, because we send the source code (however obfuscated) that decrypts the information to the client.\u00a0 To borrow Corey Doctorow’s words, the attacker is also the recipient<\/a>.\u00a0 But, sometimes just making getting the information inconvenient is good enough.<\/p>\n

I looked at a couple of encryption options.\u00a0 There’s are a couple of nice javascript libraries that do encryption: Gibberish-AES<\/a> and javascript.crypto.library<\/a>, but they hav no GWT hooks (and javascript.crypto.library is released under the AGPL<\/a> which has some unclear legal ramifications).<\/p>\n

However, there is a project from about two years ago that does Triple DES encryption and is written in pure GWT.\u00a0 It’s even called gwt-crypto<\/a>.\u00a0 Unfortunately, it hasn’t been maintained recently.\u00a0 I was able to download the files, apply a fix (for issue #1<\/a>) and move some files around in such a way that it works.<\/p>\n

Here’s how you use it:<\/p>\n

on the server:
\nTripleDesCipher cipher = new TripleDesCipher();
\ncipher.setKey(Constants.GWT_DES_KEY);
\ntry {
\nenc = cipher.encrypt(String.valueOf(value));
\n} catch (DataLengthException e1) {
\ne1.printStackTrace();
\n} catch (IllegalStateException e1) {
\ne1.printStackTrace();
\n} catch (InvalidCipherTextException e1) {
\ne1.printStackTrace();
\n}<\/code><\/p>\n

On the client, make sure you inherit the module:
\n<inherits name='com.googlecode.gwt.crypto.Crypto'\/><\/code>
\nThen:<\/p>\n

TripleDesCipher cipher = new TripleDesCipher();
\ncipher.setKey(Constants.GWT_DES_KEY);
\nString dec =\"\";
\ntry {
\ndec = cipher.decrypt(enc);
\n} catch (DataLengthException e) {
\ne.printStackTrace();
\n} catch (IllegalStateException e) {
\ne.printStackTrace();
\n} catch (InvalidCipherTextException e) {
\ne.printStackTrace();
\n}<\/code><\/p>\n

I just use a constant DES key, which is not all that secure.\u00a0 I’m sure you could do something more secure like hashing the request time, filename and some other secret key, but you need to make sure that both the server and the client agree on the key, otherwise you’ll not be able to decrypt the info.<\/p>\n

Update 6\/13: I got permission from the project owner to update the google project, so I’ve done that.\u00a0 You can download the new gwt-crypto jar there<\/a>.
\n<\/em><\/p>\n

The modified gwt-crypto jar file is here.\u00a0 I’m hoping the administrator will let me at least check in the changes I’ve made so that it works on GWT 1.5.3 (can’t speak for GWT 1.6).<\/strike><\/em><\/p>\n

[tags]gwt,tripledes encryption,hiding in plain sight[\/tags]<\/p>\n","protected":false},"excerpt":{"rendered":"

I was looking for an encryption package for GWT.\u00a0 A client had some mildly private information that they wanted to encrypt in transmission.\u00a0 Now, of course, this is ultimately futile.\u00a0 […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18,2],"tags":[],"class_list":["post-529","post","type-post","status-publish","format-standard","hentry","category-gwt","category-technology-and-society"],"_links":{"self":[{"href":"https:\/\/www.mooreds.com\/wordpress\/wp-json\/wp\/v2\/posts\/529","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mooreds.com\/wordpress\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mooreds.com\/wordpress\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mooreds.com\/wordpress\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mooreds.com\/wordpress\/wp-json\/wp\/v2\/comments?post=529"}],"version-history":[{"count":1,"href":"https:\/\/www.mooreds.com\/wordpress\/wp-json\/wp\/v2\/posts\/529\/revisions"}],"predecessor-version":[{"id":612,"href":"https:\/\/www.mooreds.com\/wordpress\/wp-json\/wp\/v2\/posts\/529\/revisions\/612"}],"wp:attachment":[{"href":"https:\/\/www.mooreds.com\/wordpress\/wp-json\/wp\/v2\/media?parent=529"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mooreds.com\/wordpress\/wp-json\/wp\/v2\/categories?post=529"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mooreds.com\/wordpress\/wp-json\/wp\/v2\/tags?post=529"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}