Posts

Showing posts from July, 2016

Using PyCrypto with Spring Crypto/Spring Security Default Encoders

Spring Crypto Encryptor Details The Spring Crypto module is amazing. Secure defaults using standard interfaces really make it a pleasure to use, and with it being full tested and vetted, it also gives a develoepr the warm fuzzy feelings of nice Java security implentation.

The standard interface is through the org.springframework.security.crypto.encrypt.Encryptors class, defined (in version 3.2.0 here (the class API to which this blog post was written in July 2016). Spring Crypto uses AES256 encryption behind the scenes in its out of the box class setup; it's as easy as:

In the above code snippet, the password variable is a passcode, with the salt variable used to create the AES key. It uses 256 bit encryption with the standard calls (depending on your JRE/Java Cryptography Extension (JCE) Setup, make sure to download the appropriate extension). The default AESBytesEncryptor setup generates a 256 bit key (32 bytes) from a salted iteration done 1024 times. Another thing to note …