Command line Jasypt client encryption 'Operation not possible'

Question

I am using Jasypt to store our database passwords in our hibernate config file in non-clear-text format.

Eg instead of

    <property name="hibernate.connection.username">user1</property>
    <property name="hibernate.connection.password">password1</property>

I want something like

    <property name="hibernate.connection.username">user1</property>
    <property name="hibernate.connection.password">ENC(0HY4F73HFPQ85CN)</property>

I am using the PBEWITHMD5ANDTRIPLEDES algorithm. I was reading up on it, and it seems that this may require installing a JCE, or a 'Jurisdiction Policy' extension. My question is, are these things already installed if I see this in my list of PBE Algorithms?

I ran the listAlgorithms.bat script:

C:\dev\jasypt-1.9.1\bin>listAlgorithms.bat

DIGEST ALGORITHMS:   [MD2, MD5, SHA, SHA-256, SHA-384, SHA-512]

PBE ALGORITHMS:      [PBEWITHMD5ANDDES, PBEWITHMD5ANDTRIPLEDES, PBEWITHSHA1ANDDESEDE, PBEWITHSHA1ANDRC2_40]

But when I try to encrypt my password, I get a very unhelpful error message:

C:\dev\jasypt-1.9.1\bin>encrypt.bat input=etrading_rw_123 password=encryptionkey algorithm=PBEWITHMD5ANDTRIPLEDES

----ENVIRONMENT-----------------

Runtime: Sun Microsystems Inc. Java HotSpot(TM) Client VM 20.14-b01



----ARGUMENTS-------------------

algorithm: PBEWITHMD5ANDTRIPLEDES
input: etrading_rw_123
password: encryptionkey



----ERROR-----------------------

Operation not possible (Bad input or parameters)

If I run the same script with algorithm=PBEWITHMD5ANDDES, it works fine. Does the list of 'supported algorithms' actually mean 'algorithms that would be supported if you enabled them' rather than 'algorithms that are good to go'?

I am using Java version:

java version "1.6.0_17"
Java(TM) SE Runtime Environment (build 1.6.0_17-b04)
Java HotSpot(TM) Client VM (build 14.3-b01, mixed mode, sharing)

Answer 1

1. The Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy (small download) can enable the higher strength algorithms.

https://www.oracle.com/technetwork/java/javase/downloads/jce-all-download-5170447.html

FYI: JDK 9 and later ship with, and use by default, the unlimited policy files.

The unlimited policy files for earlier releases available above are required only for JDK 8, 7, and 6 updates earlier than 8u161, 7u171, and 6u181. On those versions and later the policy files are included, but not enabled by default.

See JDK-8170157 for details. https://bugs.java.com/bugdatabase/view_bug.do?bug_id=JDK-8170157

2. Another issue, could be that your JAVA_HOME environment variable points to an older Java version. Jasypt's bin/*.sh and *.cmd scripts uses $JAVA_HOME/bin/java or %JAVA_HOME%\bin\java if that environment variable exists.

Answer 2

I was unable to generate encrypted password from command prompt using PBEWITHHMACSHA512ANDAES_256 algorithm. I have added additional parameters to command and it worked.

java -cp C:/Users/.m2/repository/org/jasypt/jasypt/1.9.3/jasypt-1.9.3.jar org.jasypt.intf.cli.JasyptPBEStringEncryptionCLI ivGeneratorClassName=org.jasypt.iv.RandomIvGenerator input="originalpassword*" password=encryptionpassword algorithm=PBEWITHHMACSHA512ANDAES_256

By using above command I was able to generated encrypted password and make use of it in application.properties file. I have used 3.0.0 spring dependency for Jasypt.

Answer 3

I faced this problem because of some lack of information in the Jasypt CLI usage description.

The default generator to generate the initial value is NoIvGenerator. For some/most algorithms the IV generated this way is not valid, so the error message above is displayed. You have to add the additional parameter ivGeneratorClassName=org.jasypt.iv.RandomIvGenerator to make it work.

See: https://github.com/jasypt/jasypt/issues/8