I have a bunch of data in a database encrypted via ColdFusion and I need to figure out the exact Java equivalent so that I can encrypt / decrypt across application boundaries.

The ColdFusion code uses encrypt() / decrypt() with DESEDE and a hex encoding. I know the key value (duh!) but I can't figure out the exact same Java equivalent code.

Anyone know?

http://www.java2s.com/Code/Java/Security/TripleDES.htm

I'd post links, but your comment box hates me :). Just look up "java crypto" and its the first two links for the two versions respectively.

For these two versions, the classes are probably found in javax.crypto.* and recursive namespaces.

I haven't had a need for this specific situation, so I haven't tried anything compatibility-wise, but maybe that gets you headed in the right direction.

@Joel, interesting idea, thank you. I hadn't thought of OpenBD working the same way as Adobe ColdFusion. I'll download it and have a look.

In the meantime, keep the ideas coming folks but, please, actually try the code out and make sure it really does do the same as ColdFusion's encrypt() function!

http://www.bouncycastle.org/

I'm still trying to figure out when you've ever helped *me*! :)

ColdFusion test: <cfset message = "This is a test."/> <!--- the secret key was generated using generatesecretkey("DESEDE") ---> <cfset encrypted=encrypt(message,"eoVbj51R74xw+z0fyDs38kpJc/Gzihby","DESEDE","HEX")/> Encrypted: <cfdump var="#encrypted#">

Java test: import javax.crypto.*; import javax.crypto.spec.*;

public class TestCrypto {

public static void main(String[] args) throws Exception {

String myMessage = new String("This is a test."); //setup secret key and convert to byte array String secretKeyInBase64 = new String("eoVbj51R74xw+z0fyDs38kpJc/Gzihby"); byte[] rawSecretKey = new sun.misc.BASE64Decoder().decodeBuffer(secretKeyInBase64); //output secret key to console System.out.println(secretKeyInBase64); // Generate the secret key specs. SecretKeySpec secretkeySpec = new SecretKeySpec(rawSecretKey, "DESEDE");

// get instance of cipher and initialize with key spec Cipher cipher = Cipher.getInstance("DESEDE"); cipher.init(Cipher.ENCRYPT_MODE, secretkeySpec); //encrypt myMessage byte[] encrypted = cipher.doFinal(myMessage.getBytes()); //convert to strings and output to console String sEncrypted = new sun.misc.BASE64Encoder().encode(encrypted); System.out.println("encrypted string Base64: " + sEncrypted); System.out.println("encrypted string Hex: " + asHex(encrypted)); //decrypt the message cipher.init(Cipher.DECRYPT_MODE, secretkeySpec); byte[] originalraw = cipher.doFinal(encrypted); //convert to strings and output to console String originalmessage = new String(originalraw); System.out.println("The original message: " + originalmessage); } public static String asHex (byte buf[]) { StringBuffer strbuf = new StringBuffer(buf.length * 2); int i; for (i = 0; i < buf.length; i++) { if (((int) buf[i] & 0xff) < 0x10){ strbuf.append("0"); } strbuf.append(Long.toString((int) buf[i] & 0xff, 16)); } return strbuf.toString(); } }

I'll e-mail you a Groovy script.

@CoolJJ, thank you - you and Joe were the only two people to provide a tested code sample. The key was the base64 stuff so I was extremely close by the time I gave up last night.

To those who suggested decompilers - remember your EULA prohibits such behavior (but I was getting frustrated enough to consider trying that next :)

Moral: build some code and test it before offering to help (you may learn something too).

CoolJJ

Anyone know what this error is about using base64, normal coldfusion decrypt?

decrypt(Data,Key,"AES","Base64")

An alternative is to use the hash (salt + password) method. Do a google and it will explain the method and the reason behind it being reasonably more secure, provided interesting users such as admins create good passwords.