序列化期间的构造函数调用

Question

I have a KeyChain class in my code, which allows me to store to disk and retrieve an encrypted list of credentials.

During the KeyChain 's construction, i initialize AES ciphers.

To serialize the object, i first serialize the credentials list into a buffer, then encrypt that buffer and put it into the original OutputObjectStream .

To deserialize it, i tried reading the ObjectInputStream into a buffer, decrypting it and deserializing my credentials from it, but to do that, i need to have the ciphers constructed in the first place. I can't do that since deserialization doesn't calls my constructor. How do i turn around this?

KeyChain:

private void readObject(ObjectInputStream is) throws IOException {
    byte[] buffer = new byte[512000];

    int readBytes = is.read(buffer);

    byte[] encryptedBytes = new byte[readBytes];
    System.arraycopy(buffer, 0, encryptedBytes, 0, readBytes);

    // Here it crashes and burns because i can't decrypt yet, the ciphers haven't been setup
    byte[] decryptedBytes = decryptBytes(encryptedBytes);

    ByteInputStream stream = new ByteInputStream(decryptedBytes, readBytes);
    ObjectInputStream unsafeInputStream = new ObjectInputStream(stream);
    try {
        Keys = (List<Key>)unsafeInputStream.readObject();
    } catch (ClassNotFoundException ex) {
        // Fail miserably
    }
}

private void writeObject(ObjectOutputStream os) throws IOException {
    ByteOutputStream streamBytes = new ByteOutputStream();
    ObjectOutputStream unsafeOutputStream = new ObjectOutputStream(streamBytes);

    unsafeOutputStream.writeObject(Keys);
    unsafeOutputStream.flush();

    byte[] decryptedBytes = streamBytes.getBytes();

    byte[] encryptedBytes = encryptBytes(decryptedBytes);

    os.write(encryptedBytes);
    os.flush();

    Arrays.fill(decryptedBytes, (byte)0);
    Arrays.fill(encryptedBytes, (byte)0);
}

gotcha: I can't just call initCryptograhy(char[] password) in readObject because i just don't have the password available there, i can't pass it as an argument, this is the root of the problem.

Answer 1

Java actually has a facility called SealedObject for encrypting a serialized instance. Maybe this would work better for what you are trying to achieve. I think the key difference between what you are doing and what SealedObject does is that it does the decrypting in a second phase, not in the initial deserialization.