javax.crypto.BadPaddingException：填充块有时损坏

Question

I have the following code for encrypt

public static String encrypt(String value, char[] secret) {
        try {
            final byte[] bytes = value != null ? value.getBytes(StandardCharsets.UTF_8) : new byte[0];
            SecretKeyFactory keyFactory = SecretKeyFactory.getInstance("PBEWithMD5AndDES");
            SecretKey key = keyFactory.generateSecret(new PBEKeySpec(secret));
            Cipher pbeCipher = Cipher.getInstance("PBEWithMD5AndDES");
            pbeCipher.init(Cipher.ENCRYPT_MODE, key, new PBEParameterSpec(IsoGame.$().crossPlatformManager.getCrossPlatformUtilsInstance().getDeviceUniqueIdentifier().getBytes(StandardCharsets.UTF_8), 20));
            return new String(Base64.encodeBase64(pbeCipher.doFinal(bytes)), StandardCharsets.UTF_8);

        } catch (Exception e) {
            e.printStackTrace();
        }
        return value;

    }

and the following code for decrypt.

public static String decrypt(String value, char[] secret) {
        try {
            final byte[] bytes = value != null ? Base64.decodeBase64(value.getBytes(StandardCharsets.UTF_8)) : new byte[0];
            SecretKeyFactory keyFactory = SecretKeyFactory.getInstance("PBEWithMD5AndDES");
            SecretKey key = keyFactory.generateSecret(new PBEKeySpec(secret));
            Cipher pbeCipher = Cipher.getInstance("PBEWithMD5AndDES");
            pbeCipher.init(Cipher.DECRYPT_MODE, key, new PBEParameterSpec(IsoGame.$().crossPlatformManager.getCrossPlatformUtilsInstance().getDeviceUniqueIdentifier().getBytes(StandardCharsets.UTF_8), 20));
            return new String(pbeCipher.doFinal(bytes), StandardCharsets.UTF_8);

        } catch (Exception e) {
            e.printStackTrace();
        }
        return value;

    }

However, sometimes the exception is being thrown at

pbeCipher.doFinal(bytes)

in decrypt method.

The exception is javax.crypto.BadPaddingException: pad block corrupted

It's strange, as I'm getting this exception sometimes with the same values.

Any ideas? Thanks.

Answer 1

The most likely reason would simply be the wrong password to be supplied. If the wrong password is supplied then the wrong key is derived. Then the ciphertext will be decrypted to garbage plaintext. This will only be noticed if the padding exception gets thrown: unpadding random bytes is likely to fail.

You could eg first validate that the derived key is correct by performing a HMAC over known data using the derived key. In addition, it would be a good idea to use some kind of authenticated encryption, so that if the key or data is wrong or corrupted that decryption does indeed fail. If you're unlucky then - at this time - the data will decrypt, unpadding will succeed and you end up with garbage plaintext.

Of course, you'd better upgrade to PBKDF2 for key derivation, and upgrade AES to eg AES-GCM instead of DES. Currently your encryption is entirely insecure, even if you use a strong password.

Answer 2

Your problem is

IsoGame.$().crossPlatformManager.getCrossPlatformUtilsInstance().getDeviceUniqueIdentifier().getBytes(StandardCharsets.UTF_8)

I have ran the following code multiple times and no exception occurred and the decrypted data was equal to "Hello there!":

public static void main(String[] args)
    {
        new CryptographyError();
    }

    private CryptographyError()
    {
        char[] secret = "MySecret".toCharArray();
        String mesasge = "Hello there!";
        EncryptedData encryptedData = encrypt(mesasge, secret);
        System.out.println("ENCRYPTED " + encryptedData.encryptedString);
        String decrypted = decrypt(encryptedData, secret);
        System.out.println("DECRYPTED " + decrypted);
    }

    private static final SecureRandom RANDOM = new SecureRandom();

    public static EncryptedData encrypt(String value, char[] secret) {
        try {
            final byte[] bytes = value != null ? value.getBytes(StandardCharsets.UTF_8) : new byte[0];
            SecretKeyFactory keyFactory = SecretKeyFactory.getInstance("PBEWithMD5AndDES");
            SecretKey key = keyFactory.generateSecret(new PBEKeySpec(secret));
            Cipher pbeCipher = Cipher.getInstance("PBEWithMD5AndDES");
            byte[] salt = new byte[8];
            RANDOM.nextBytes(salt);
            pbeCipher.init(Cipher.ENCRYPT_MODE, key, new PBEParameterSpec(salt, 20));
            return new EncryptedData(salt, new String(Base64.getEncoder().encode(pbeCipher.doFinal(bytes)), StandardCharsets.UTF_8));

        } catch (Exception e) {
            e.printStackTrace();
            System.out.println(value);
        }
        return null;

    }

    public static String decrypt(EncryptedData encryptedData, char[] secret) {
        try {
            String value = encryptedData.encryptedString;
            byte[] salt = encryptedData.salt;
            final byte[] bytes = value != null ? Base64.getDecoder().decode(value.getBytes(StandardCharsets.UTF_8)) : new byte[0];
            SecretKeyFactory keyFactory = SecretKeyFactory.getInstance("PBEWithMD5AndDES");
            SecretKey key = keyFactory.generateSecret(new PBEKeySpec(secret));
            Cipher pbeCipher = Cipher.getInstance("PBEWithMD5AndDES");
            pbeCipher.init(Cipher.DECRYPT_MODE, key, new PBEParameterSpec(salt, 20));
            return new String(pbeCipher.doFinal(bytes), StandardCharsets.UTF_8);

        } catch (Exception e) {
            e.printStackTrace();
        }
        return null;

    }

    private static class EncryptedData
    {
        private final byte[] salt;
        private final String encryptedString;

        private EncryptedData(byte[] salt, String encryptedString)
        {
            this.salt = salt;
            this.encryptedString = encryptedString;
        }
    }

The only main difference between my code and your code is

IsoGame.$().crossPlatformManager.getCrossPlatformUtilsInstance().getDeviceUniqueIdentifier().getBytes(StandardCharsets.UTF_8)

which means that must not return the same value on encryption and decryption. Also if you want to test this you can just change the salt between them and notice the exception is thrown again.

Also Maarten Bodewes gave you some good notes about how to improve your code.

Answer 3

Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());