Jasypt decryption EncryptionOperationNotPossibleException while using newer algorithms

问题

I am using Jasypt APIs (version 1.9.2) for encryption and decryption. While listing the algorithms using the command line interface tool, I am getting the following list.

listAlgorithms.bat

PBE ALGORITHMS:      [PBEWITHHMACSHA1ANDAES_128, 
PBEWITHHMACSHA1ANDAES_256, 
PBEWITHHMACSHA224ANDAES_128, 
PBEWITHHMACSHA224ANDAES_256, 
PBEWITHHMACSHA256ANDAES_128, 
PBEWITHHMACSHA256ANDAES_256, 
PBEWITHHMACSHA384ANDAES_128, 
PBEWITHHMACSHA384ANDAES_256,
PBEWITHHMACSHA512ANDAES_128, 
PBEWITHHMACSHA512ANDAES_256, 
PBEWITHMD5ANDDES, 
PBEWITHMD5ANDTRIPLEDES, 
PBEWITHSHA1ANDDESEDE, 
PBEWITHSHA1ANDRC2_128, 
PBEWITHSHA1ANDRC2_40, 
PBEWITHSHA1ANDRC4_128, 
PBEWITHSHA1ANDRC4_40]

But when I use any of the below algorithms (those are listed in the above list) to encrypt and decrypt the text, then encryption is working but decryption is failing.

PBEWITHHMACSHA1ANDAES_128
PBEWITHHMACSHA1ANDAES_256
PBEWITHHMACSHA224ANDAES_128
PBEWITHHMACSHA224ANDAES_256
PBEWITHHMACSHA256ANDAES_128
PBEWITHHMACSHA256ANDAES_256

Here is the code snippet

StandardPBEStringEncryptor encryptor = new StandardPBEStringEncryptor();
encryptor.setPassword("9daed9cd-e828-485f-a0a9-c63cfc364f4b");
encryptor.setAlgorithm("PBEWITHHMACSHA1ANDAES_256");
String input = "secret";
String enc = encryptor.encrypt(input);
System.out.println("Enc String: "+enc);
String dec = encryptor.decrypt(enc); //line 17 in the code where exception is thrown
System.out.println("Dec String: "+dec);

Here is the exception I am getting, while trying to decrypt the encrypted text.

Enc String: +APh51ggjCYY/UX92dJ4QmD52lMyTTJ7btqClF2EGT8=
Exception in thread "main" org.jasypt.exceptions.EncryptionOperationNotPossibleException
    at org.jasypt.encryption.pbe.StandardPBEByteEncryptor.decrypt(StandardPBEByteEncryptor.java:1055)
    at org.jasypt.encryption.pbe.StandardPBEStringEncryptor.decrypt(StandardPBEStringEncryptor.java:725)
    at com.trimble.space.management.tpass.utilization.encryption.BasisTextCodec.main(BasisTextCodec.java:17)

After doing some more tests I can found that the following list of algorithms are not supported by Jasypt, it throws run time exception mentioned above.

PBEWITHHMACSHA1ANDAES_128, 
PBEWITHHMACSHA1ANDAES_256, 
PBEWITHHMACSHA224ANDAES_128, 
PBEWITHHMACSHA224ANDAES_256, 
PBEWITHHMACSHA256ANDAES_128, 
PBEWITHHMACSHA256ANDAES_256, 
PBEWITHHMACSHA384ANDAES_128, 
PBEWITHHMACSHA384ANDAES_256, 
PBEWITHHMACSHA512ANDAES_128, 
PBEWITHHMACSHA512ANDAES_256

But below algorithms are working fine, not giving any run time exception.

PBEWITHMD5ANDDES, 
PBEWITHMD5ANDTRIPLEDES, 
PBEWITHSHA1ANDDESEDE, 
PBEWITHSHA1ANDRC2_128, 
PBEWITHSHA1ANDRC2_40, 
PBEWITHSHA1ANDRC4_128, 
PBEWITHSHA1ANDRC4_40

Here is the test that produces the supported and not supported list of algorithms.

@Test
    public void test() {
        Set<String> supported = new HashSet<>();
        Set<String> unsupported = new HashSet<>();
        for (Object algorithms : AlgorithmRegistry.getAllPBEAlgorithms()) {
            String algo = (String) algorithms;
            try {
                StandardPBEStringEncryptor encryptor = new StandardPBEStringEncryptor();
                encryptor.setAlgorithm(algo);
                encryptor.setPassword("secret");
                String encrypted = encryptor.encrypt("foo");
                String decrypted = encryptor.decrypt(encrypted);
                Assert.assertEquals("foo", decrypted);
                supported.add(algo);
            } catch (EncryptionOperationNotPossibleException e) {
                unsupported.add(algo);
            }
        }
        System.out.println("Supported");
        supported.forEach((String name) -> System.out.println("   " + name)); 
        System.out.println("Unsupported");
        unsupported.forEach((String name) -> System.out.println("   " + name)); 
    }

http://www.jasypt.org/encrypting-texts.html

This seems like a bug in the Jasypt code, here is the discussion thread.

回答1:

There seems like a bug in Jasypt, the detail can be found here. Even though a patch is provided, I cannot find a binaries released.

回答2:

The bug for Jasypt has been reported here.

You can find the patched version here on GitHub and build it with mvn clean package.

https://github.com/melloware/jasypt

I use this version in JDK 8 patch 162 or higher and it works great and all of the high level encryption like PBEWITHHMACSHA512ANDAES_256 works out of the box.

I have deployed to Maven Central as:

<dependency>
  <groupId>com.melloware</groupId>
  <artifactId>jasypt</artifactId>
  <version>1.9.4</version>
</dependency>

来源：https://stackoverflow.com/questions/49491210/jasypt-decryption-encryptionoperationnotpossibleexception-while-using-newer-algo

标签

java

password-encryption

jasypt