How to pack / encrypt / unzip / decrypt a bunch of files in Java?

Question

I try to do the following on a Java / JSP based website:

• User Provides Password
• The password is used to create a highly encrypted archive file (zip or something else) containing a text file, as well as several binary files that are stored on the server. This is essentially a backup of user files and settings.
• Later, the user can download the file, provide the original password, and the site will decrypt and unzip the archive, save the extracted binary files to the appropriate folder on the server, and then read the text file so that the site can restore the old user settings and metadata about the binary files.

This is building / encrypting the archive and then extracting its contents, which I am trying to figure out how to do. I really do not care about the archive format, except that it is very safe.

The ideal solution to my problem will be very easy to implement and will require only tried and tested libraries with free and non-limiting licenses (for example, apache, berkeley, lgpl).

I know the TrueZIP and WinZipAES libraries; the first seems like a massive overkill, and I can’t say how stable it is ... Are there any other solutions that would work well?

Answer 1

, zip java.util.zip, PBE Cipher CipherOutputStream CipherInputStream ( , ).

:

public class ZipTest {

    public static void main(String [] args) throws Exception {
        String password = "password";
        write(password);
        read(password);
    }

    private static void write(String password) throws Exception {
        OutputStream target = new FileOutputStream("out.zip");
        target = new CipherOutputStream(target, createCipher(Cipher.ENCRYPT_MODE, password));
        ZipOutputStream output = new ZipOutputStream(target);

        ZipEntry e = new ZipEntry("filename");
        output.putNextEntry(e);
        output.write("helloWorld".getBytes());
        output.closeEntry();

        e = new ZipEntry("filename1");
        output.putNextEntry(e);
        output.write("helloWorld1".getBytes());
        output.closeEntry();

        output.finish();
        output.flush();
    }

    private static Cipher createCipher(int mode, String password) throws Exception {
        String alg = "PBEWithSHA1AndDESede"; //BouncyCastle has better algorithms
        PBEKeySpec keySpec = new PBEKeySpec(password.toCharArray());
        SecretKeyFactory keyFactory = SecretKeyFactory.getInstance(alg);
        SecretKey secretKey = keyFactory.generateSecret(keySpec);

        Cipher cipher = Cipher.getInstance("PBEWithSHA1AndDESede");
        cipher.init(mode, secretKey, new PBEParameterSpec("saltsalt".getBytes(), 2000));

        return cipher;
    }

    private static void read(String password) throws Exception {
        InputStream target = new FileInputStream("out.zip");
        target = new CipherInputStream(target, createCipher(Cipher.DECRYPT_MODE, password));
        ZipInputStream input = new ZipInputStream(target);
        ZipEntry entry = input.getNextEntry();
        while (entry != null) {
            System.out.println("Entry: "+entry.getName());
            System.out.println("Contents: "+toString(input));
            input.closeEntry();
            entry = input.getNextEntry();
        }
    }

    private static String toString(InputStream input) throws Exception {
        byte [] data = new byte[1024];
        StringBuilder result = new StringBuilder();

        int bytesRead = input.read(data);
        while (bytesRead != -1) {
            result.append(new String(data, 0, bytesRead));
            bytesRead = input.read(data);
        }

        return result.toString();
    } 
}

Answer 2

( , ), , , , : , HTTPS HTTP. . , . . , , Apache Tomcat, Tomcat SSL HOW-TO.

, .

Answer 3

, , truecrypt. - , zip . . , , .

Answer 4

Of course, there are some tips on how to solve your problem, but I miss a very big BUT in the answers. You cannot perform both “password-based” and “strong encryption” for any reasonable definition of “strong encryption”.