What's the standard way to encrypt a file with a public key in Java?

Question

I'm writing a client app in Java that sends encrypted data back to the server. All clients have my RSA public key. Is there a standard way to encrypt a given file with it to send it back to the server?

From websites such as this one, I gather that usually, a symmetric key is generated to encrypt the actual file, and this key is then encrypted with the RSA public key and sent along the file. Is there a standard way in Java or a standard file format (without additional libs) to package the encrypted symmetric key and the symmetrically encrypted file?

Of course, I could design my own file format, but I'd rather stick to standards if possible.

Answer 1

One common, standard encryption format is Cryptographic Message Syntax (CMS, evolved from PKCS#7), and e.g. BouncyCastle supports it. It allows for signatures also, and is the basis, e.g., for S/MIME mail message security. It may be overkill, but is widely supported.

Example code is provided by Bouncy Castle. For CMS, see org.bouncycastle.cms.test, probably the Enveloped Data examples.

Another option is the XML Encryption format, standardized by W3C. For Java examples, see e.g. Exploring XML Encryption, Part 1 or do it with XSS4J: Implementing XML Encryption in Java

Answer 2

The simplest and most surefire way of file encryption is to shell out and invoke gpg or pgp to encrypt it. I know it sounds inelegant, but in my experience reviewing a lot of crypto code, this is the simplest way to ensure that your solution is secure, without having to know a lot about cryptography. If you want to do it yourself, you will need to learn more about how cryptography works, and the risk of a security problem increases.

Make sure there is authenticity protection for the encrypted data (e.g., encrypt and then sign/MAC): you will need both confidentiality and authenticity protection. A very common error is to encrypt but fail to sign; this error can introduce subtle security problems. (If you are not a cryptographer, I realize this may not make any sense to you. I realize this is by no means obvious, but I am a cryptographer. If you are familiar with IND-CCA2 and INT-CTXT, you will understand why I am recommending this. If you're not familiar with those concepts, you can read about them if you want, or you can take my word on it. Hey, crypto is tricky stuff; what can I say.) For instance, the website you link to makes this mistake; I should not rely upon that website for advice about secure encryption. The strawman approach you mention in your question also suffers from this flaw, and it looks like some of the proposed answers here also have a similar shortcoming.

An alternative approach, which is a very good one if the client and server are connected in real time, is to open a TLS-encrypted channel between the client and the server and send the data over that channel. Make sure that the client verifies the public key / cert of the server. If you want to authenticate clients, give clients a client cert and make sure that the server requires the client to provide a client cert and validates that cert.

Answer 3

@JPP, This comment of yours makes me think you're asking the wrong question:

The client app saves user activity logs whose content should be published to a server unaltered, even if the user has read/write access to the saved files. Moreover, the user should not be able to inspect the contents (the files are exercise, progress, and error reports from a quiz application).

If the client app writes the log files, and encrypts them - that means the client app has access to the encryption key, whatever that may be.
However, you're trying to prevent the user of the client app from reading the files!
That's just not going to work, because:

1. The user has access to anything the client app has access to - including the file contents, and the encryption key...
2. The user has control of anything running in his own process - i.e. he can even attach a debugger to the client app - so don't bother trying to get smart and figure out a way to obfuscate the encryption key.

To me, your problem sound more like one of access control - how can I write a log file from a client app, without the user having access to the contents?
One way would be to build a local service (e.g. Windows Service, on Windows) that runs in a different user context; the client app would talk to the service, and the service would then write the contents to the file in a protected location that regular users cannot reach.
Another alternative is, as @D.W. suggested, send it directly to the server immediately, and not write to file any of the contents.

The problem with both these solutions, is as I previously noted: The user has control of anything in his process, and can block or modify any requests sent, either to the server or the local Windows service.

Answer 4

Apparently, there's no way to do it with the standard library without significant recoding of stuff already available in Bouncy Castle, for instance.

Here's what I came up with. On the client side, I encrypt a file plainfile as follows:

// install security provider
if (Security.getProvider(BouncyCastleProvider.PROVIDER_NAME) == null) {
    Security.addProvider(new BouncyCastleProvider());
}

// load public certificate for signing
KeyStore publicKs = KeyStore.getInstance(KeyStore.getDefaultType());
publicKs.load(new FileInputStream("/path/to/publicKeystore.ks"), null);
TrustedCertificateEntry entry = (TrustedCertificateEntry) publicKs.getEntry("public", null);
X509Certificate cert = (X509Certificate) entry.getTrustedCertificate();

// create CMS envelope data;
// check http://www.ietf.org/rfc/rfc3852.txt pages 15-16 for details
CMSEnvelopedDataGenerator envelopedDataGen = new CMSEnvelopedDataGenerator();

// specify that generated symmetric key will be encrypted by with this public key
envelopedDataGen.addKeyTransRecipient(cert);

// automatically generate the AES key, encrypt the data, and encrypt the key
CMSEnvelopedData data = envelopedDataGen.generate(new CMSProcessableFile(plainfile),
        CMSEnvelopedDataGenerator.AES256_CBC, 256, BouncyCastleProvider.PROVIDER_NAME);

byte[] encryptedData = data.getEncoded();

Then, on the server, I can decrypt this data as follows:

// load private key
KeyStore privateKs = KeyStore.getInstance(KeyStore.getDefaultType());
privateKs.load(new FileInputStream("/path/to/privateKeystore.ks"), null);
PrivateKeyEntry privateKeyEntry = (PrivateKeyEntry) privateKs.getEntry("privatekey",
        new KeyStore.PasswordProtection("password".toCharArray()));
PrivateKey privateKey = privateKeyEntry.getPrivateKey();

byte[] encryptedData = ...

// parse CMS envelope data
CMSEnvelopedDataParser envelopedDataParser = new CMSEnvelopedDataParser(new ByteArrayInputStream(encryptedData));

// expect exactly one recipient
Collection<?> recipients = envelopedDataParser.getRecipientInfos().getRecipients();
if (recipients.size() != 1)
    throw new IllegalArgumentException();

// retrieve recipient and decode it
RecipientInformation recipient = (RecipientInformation) recipients.iterator().next();
byte[] decryptedData = recipient.getContent(privateKey, BouncyCastleProvider.PROVIDER_NAME);

Please leave comments if I'm missing something important or am making mistakes here... Thanks!