Many people are protective of their credit card numbers, and for good reason. A stolen credit card number with other personal information can give a thief all he or she needs to create serious mayhem in someone's life. One way to keep credit card and other proprietary information secure when sending it over the net is to encrypt it.

Encryption is the process of applying a key to plain text that transforms that plain text into unintelligible (cipher) text. Only programs with the key to turn the cipher text back to original text can decrypt the protected information.

This lesson adapts the Part 2, Lesson 2: User Interfaces Revisited example to encrypt the credit card number before sending it over the net, and decrypt it on the other side.

---

Note: Because cryptography software is not exportable outside the United States and Canada, the example in this lesson is in pseudo code rather than source code.

---

• About the Example
• Running the Example
• Pseudo Code
  • Server
  • Generating the Public and Private Key
  • Sealing the Symmetric Key
  • Encrypting the Symmetric Key with the RSA Algorithm
• More Information

Running the Example

Make sure you have the following entries in ~/jre/lib/security/java.security:

security.provider.1=sun.security.provider.Sun
security.provider.2=com.sun.crypto.provider.SunJCE

You also need to purchase a package with an asymmetric algorithm such as the Rivest, Shamir, and Adleman (RSA) Asymmetric-Cipher algorithm.

The asymmetric algorithm is needed to create the asymmetric cipher for the public and private key encryption. Add the asymmetric algorithm package to ~/jre/lib/security/java.security as security.provider.3= and put it in the /jre/lib/ext directory with the other JAR files.

Using the documentation in the download, convert the pseudo code to source code.

Compile and run the example as usual.

Pseudo Code

Symmetric key encryption uses a symmetric algorithm such as Data Encryption Standard (DES). The asymmetric key encryption uses an asymmetric algorithm such as Rives, Shamir, and Adleman (RSA) Asymmetric-Cipher algorithm. The DES algorithm is available in the javax.crypto package by default, but an asymmetric algorithm must be purchased and installed separately.

The pseudo code shows two ways to do the asymmetric encryption of the session key. One way uses an RSA key to encrypt the symmetric key. The other way uses another asymmetric algorithm to seal (encrypt) the symmetric key. Sealing is the preferred way, but presents a problem when you use the RSA key because the RSA algorithm imposes a size restriction (discussed below) on the object being encrypted, and the sealing process makes the session key too large to be encrypted with an RSA key.

After the cipher is created with the correct symmetric or asymmetric algorithm, it is initialized for encryption or decryption with a key. In the case of symmetric encryption, the key is a secret key, and in the case of asymmetric encryption, the key is either the public or private key.

Server

  A method to get the public key
  A method to send the encryped credit card number
  A method to get the encrypted credit card number
  A method to send the encrypted symmetric key
  A method to get the encrypted symmetric key

Generating the Public and Private Key Pair

  Generate public and private key pair
	using asymmetric algorithm
  Store private Key in very safe place
  Store public key in accessible place

Sealing the Symmetric Key

RMIClient1Sealed.java: The RMIClient1.java code has an encrypt method to encrypt the credit card number, seal the symmetric key, and send the encrypted credit card number and sealed key to the server. Here is the pseudo code to do it:

  private void encrypt(credit card number){
    Create cipher for symmetric key encryption (DES)
    Create a key generator
    Create a secret (session) key with key generator
    Initialize cipher for encryption with session key
    Encrypt credit card number with cipher
    Get public key from server
    Create cipher for asymmetric encryption (do not use RSA)
    Initialize cipher for encryption with public key
    Seal session key using asymmetric Cipher
    Send encrypted credit card number and sealed 
	session key to server
  }

RMIClient2Sealed.java: The RMIClient2.java code has a decrypt method to unseal the symmetric key and decrypt the credit card number. Here is the pseudo code to do it:

  public byte[] decrypt(encrypted key,
                        encrypted credit card number){
    Get private key from file
    Create asymmetric cipher (do not use RSA)
    Initialize cipher for decryption with private key
    Unseal wrapped session key using asymmetric cipher
    Create symmetric cipher 
    Initialize cipher for decryption with session key
    Decrypt credit card number with symmetric cipher
  }

Encrypting the Symmetric Key with the RSA Algorithm

So, if you have a session key that is only 8 bytes long, sealing expands it to 3644 bytes, which is way over the size restriction imposed by the RSA algorithm. This is because the process of sealing the session key causes extra information such as the session key class hierarchy to be included. The result is a javax.crypto.IllegalBlockSizeException run time error.

RMIClient1.java: The RMIClient1.java code has an encrypt method to encrypt the credit card number, seal (encrypt) the session key, and send the encrypted credit card number and sealed session key to the server. Here is the pseudo code to do it:

  private void encrypt(credit card number){
    Create cipher for symmetric key encryption (DES)
    Create a key generator
    Create a secret (session) key with key generator
    Initialize cipher for encryption with session key
    Encrypt credit card number with cipher
    Get public key from server
    Create cipher for asymmetric encryption (RSA)
    Initialize cipher for encryption with public key
    Encrypt session key
    Send encrypted credit card number and session key to server
  }

RMIClient2.java: The RMIClient2.java code has a decrypt method to unseal (decrypt) the symmetric key and decrypt the credit card number. Here is the pseudo code to do it:

  public String decrypt(encrypted key,
                        encrypted credit card number){
    Decrypt credit card number
    Get private key from file
    Create asymmetric cipher (RSA)
    Initialize cipher for decryption with private key
    Decrypt symmetric key
    Instantiate symmetric key
    Create symmetric cipher
    Initialize Cipher for decryption with session key
    Decrypt credit card number with symmetric Cipher
  }

[TOP]

[ This page was updated: 26-Jul-99 ]