Menu
I'm confused as to why I need to specify an algorithm such as "AES" when generating a key for encryption, e.g...
KeyGenerator kg = KeyGenerator.getInstance("AES");
It clearly is not used for specifying the size of the key since AES keys can be 128, 192, or 256-bits. That part would be done via init()...
kg.init(256, new SecureRandom());
SecretKey key = kg.generateKey();
For what it's worth, the above example code was borrowed from http://android-developers.blogspot.de/2013/02/using-cryptography-to-store-credentials.html
Furthermore, NIST FIPS-197 states...
No weak or semi-weak keys have been identified for the AES algorithm, and there is no restriction on key selection.
...so that would lead me to believe that any 128, 192, or 256 bits could be used as a key.
Clearly, specifying "AES" when I get a cipher instance, e.g...
Cipher cipher = Cipher.getInstance("AES/CBC/PKCS7Padding");
...is necessary to indicate the cipher algorithm to be use. I just don't get what the purpose of specifying it for the key generation does.
Thanks.
318
>AES/CBC/NoPadding. >AES/CBC/PKCS5Padding. Using the “AES” transformation, the Cipher will default to ECB and NoPadding. If the NoPadding mode is selected, the input data must be a multiple of 8 bytes; otherwise, the encrypted or decrypted result will be truncated.
This compliant solution uses the Advanced Encryption Standard (AES) algorithm in Cipher Block Chaining (CBC) mode to perform the encryption. It uses the "AES/CBC/PKCS5Padding" transformation, which the Java documentation guarantees to be available on all conforming implementations of the Java platform.
2.1 In Java, we use AES/GCM/NoPadding to represent the AES-GCM algorithm. For the encrypted output, we prefix the 16 bytes IV to the encrypted text (ciphertext), because we need the same IV for decryption.
As mentioned in the comments, other keys than AES may require more attention. And it is best to have a symmetrical method for DES and AES so you can switch between the algorithms.
Furthermore, not all cryptographic providers may create keys in memory. The Java JCA is also compatible with hardware key stores. For PKCS#11 providers (for instance) it is required to know the type of the key when it is being generated.
130
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
