Package org.apache.wss4j.common.crypto

Class JasyptPasswordEncryptor

java.lang.Object

org.apache.wss4j.common.crypto.JasyptPasswordEncryptor

All Implemented Interfaces:

PasswordEncryptor

public class JasyptPasswordEncryptor
extends Object
implements PasswordEncryptor

An implementation of PasswordEncryptor that relies on Jasypt's StandardPBEStringEncryptor to encrypt and decrypt passwords. The default algorithm that is used is "PBEWithHmacSHA512AndAES_256". Values encrypted under the previous non-FIPS default ("PBEWithMD5AndTripleDES") can still be decrypted by setting the "org.apache.wss4j.crypto.jasypt.useLegacyDefaultAlgorithm" system property to "true", or by passing that algorithm to the constructor explicitly - but the legacy algorithm (an MD5-based PKCS#5 v1.5 KDF with 3DES) is weak against offline dictionary attack and values should be re-encrypted under the current default.

Field Summary

Fields

Modifier and Type	Field	Description
static final String	DEFAULT_ALGORITHM
static final String	LEGACY_DEFAULT_ALGORITHM	The default algorithm prior to WSS4J adopting "PBEWithHmacSHA512AndAES_256" universally (it was previously only the default when FIPS mode was enabled).
static final String	USE_LEGACY_DEFAULT_ALGORITHM_PROPERTY	System property to restore LEGACY_DEFAULT_ALGORITHM as the default algorithm (ignored in FIPS mode), for compatibility with values encrypted under previous releases.

Constructor Summary

Constructors

Constructor	Description
JasyptPasswordEncryptor(String password)
JasyptPasswordEncryptor(String password, String algorithm)
JasyptPasswordEncryptor(CallbackHandler callbackHandler)
JasyptPasswordEncryptor(CallbackHandler callbackHandler, String algorithm)

Method Summary

Modifier and Type	Method	Description
String	decrypt(String encryptedPassword)	Decrypt the given encrypted password
String	encrypt(String password)	Encrypt the given password

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

LEGACY_DEFAULT_ALGORITHM

public static final String LEGACY_DEFAULT_ALGORITHM

The default algorithm prior to WSS4J adopting "PBEWithHmacSHA512AndAES_256" universally (it was previously only the default when FIPS mode was enabled).

See Also:

• Constant Field Values

USE_LEGACY_DEFAULT_ALGORITHM_PROPERTY

public static final String USE_LEGACY_DEFAULT_ALGORITHM_PROPERTY

System property to restore LEGACY_DEFAULT_ALGORITHM as the default algorithm (ignored in FIPS mode), for compatibility with values encrypted under previous releases. The property is read each time an instance is constructed without an explicit algorithm, not once at class-loading time.

See Also:

• Constant Field Values

DEFAULT_ALGORITHM

public static final String DEFAULT_ALGORITHM

See Also:

• Constant Field Values

Constructor Details

JasyptPasswordEncryptor

public JasyptPasswordEncryptor(String password)

JasyptPasswordEncryptor

public JasyptPasswordEncryptor(String password,
 String algorithm)

JasyptPasswordEncryptor

public JasyptPasswordEncryptor(CallbackHandler callbackHandler)

JasyptPasswordEncryptor

public JasyptPasswordEncryptor(CallbackHandler callbackHandler,
 String algorithm)

Method Details

encrypt

public String encrypt(String password)

Encrypt the given password

Specified by:

encrypt in interface PasswordEncryptor

Parameters:

password - the password to be encrypted

Returns:

the encrypted password

decrypt

public String decrypt(String encryptedPassword)

Decrypt the given encrypted password

Specified by:

decrypt in interface PasswordEncryptor

Parameters:

encryptedPassword - the encrypted password to decrypt

Returns:

the decrypted password