Java encryption alternitive to hardcoded key

Question

I am new to encryption.

I have looked at the javax.crypto documentation and got encryption of a file to work using this code ...

File saveFile = new File("Settings.set");
        saveFile.delete();
        FileOutputStream fout = new FileOutputStream(saveFile);

        //Encrypt the settings
        //Generate a key
        byte key[] = "My Encryption Key98".getBytes();
        DESKeySpec desKeySpec = new DESKeySpec(key);
        SecretKeyFactory keyFactory = SecretKeyFactory.getInstance("DES");
        SecretKey skey = keyFactory.generateSecret(desKeySpec);

        //Prepare the encrypter
        Cipher ecipher = Cipher.getInstance("DES");
        ecipher.init(Cipher.ENCRYPT_MODE, skey);
        // Seal (encrypt) the object
        SealedObject so = new SealedObject(this, ecipher);

        ObjectOutputStream o = new ObjectOutputStream(fout);
        o.writeObject(so);
        o.close();

However if you were a clever hacker ( or maybe even amateur since I figured this out), all you would have to do is open the class file that contains this code, and the encryption key (My Encryption Key98) is plainly visible.

How do you encrypt the encryption key? ...LOL... Can you?

Thanks for your help!

Answer 1

If the attacker has access to both the software and the file, it could decrypt it. There are some ways to solve this:

• Use asymetric keys. Encrypt the file with the public key, and it can only be decrypted with a private key. This assumes that the software does not need to decrypt the file.
• Use Diffie-Hellman exchange. If you want to send an encrypted piece of data over the network, both parties can establish a key without an attacker knowing about it.

If the program needs to both encrypt and decrypt the data, there is nothing you can do. The attacker can simply run the program and look at the decrypted information.