CipherUtils.java

Go to the documentation of this file.

package org.matsim.core.utils.io;

import com.google.common.io.CharStreams;

import javax.crypto.Cipher;
import javax.crypto.CipherInputStream;
import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.PBEKeySpec;
import javax.crypto.spec.SecretKeySpec;
import java.io.FileInputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.nio.charset.StandardCharsets;
import java.security.GeneralSecurityException;
import java.security.Key;
import java.security.NoSuchAlgorithmException;
import java.security.spec.InvalidKeySpecException;
import java.util.Arrays;

public class CipherUtils {

    public static final  String ENVIRONMENT_VARIABLE = "MATSIM_DECRYPTION_PASSWORD";

    private CipherUtils() {
    }

    private static Key getKeyForFile(byte[] salt) throws NoSuchAlgorithmException, InvalidKeySpecException {

        SecretKeyFactory factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA512");

        String pw = System.getProperty(ENVIRONMENT_VARIABLE, System.getenv(ENVIRONMENT_VARIABLE));

        if (pw == null)
            throw new IllegalStateException("No password specified for encrypted file. Please set " + ENVIRONMENT_VARIABLE + " environment variable.");

        // generates 256bit key and 128bit iv
        PBEKeySpec keySpec = new PBEKeySpec(pw.toCharArray(), salt, 10000, 256 + 128);

        return factory.generateSecret(keySpec);
    }


    public static InputStream getDecryptedInput(InputStream is) throws IOException, GeneralSecurityException {

        byte[] header = new byte[16];

        if (is.read(header) != 16)
            throw new IllegalStateException("Read too few bytes. Encrypted file is most likely corrupted.");

        String h = new String(header, 0, 8, StandardCharsets.US_ASCII);

        if (!h.equals("Salted__"))
            throw new IllegalStateException("File header must start with 'Salted__'.");

        byte[] salt = Arrays.copyOfRange(header, 8, 16);

        Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");

        Key tmp = getKeyForFile(salt);

        SecretKeySpec secretKey = new SecretKeySpec(tmp.getEncoded(), 0, 32, "AES");
        IvParameterSpec ivspec = new IvParameterSpec(tmp.getEncoded(), 32, 16);

        cipher.init(Cipher.DECRYPT_MODE, secretKey, ivspec);

        return new CipherInputStream(is, cipher);
    }


    public static void main(String[] args) throws Exception {

        System.setProperty(CipherUtils.ENVIRONMENT_VARIABLE, "abc123");

        InputStream is = getDecryptedInput(new FileInputStream("some.secret.enc"));

        System.out.println(CharStreams.toString(new InputStreamReader(is)));

    }

}