JSP Code to decrypt dbms_obfuscation_toolkit.DESEn

2019-08-27 23:45发布

问题:

I am new to Oracle and JSP Both.. As a part of my assignment i am try to create a login page in JSP. so I have connected it to the database and i have all username and passwords. but passowrd is in encrypted format.. My supervisor told me that its encrypted in dbms_obfuscation_toolkit.DESEncrypt ... I have to decrypt that password to original so I could check it with provided password on login page.. I am using this code in JSP:

<%@ page import="java.sql.*" %>
<%@ page import="java.security.*" %>
<%@ page import="javax.crypto.*" %>
<%@ page import="javax.crypto.spec.*" %>

<HTML>
<HEAD>
<TITLE>Simple JSP/Oracle Query Example</TITLE>
</HEAD>
<BODY>

<%
   Class.forName("oracle.jdbc.OracleDriver");

   Connection conn = DriverManager.getConnection("jdbc:oracle:thin:@xxx:xxxx:xxxx","ixxxer","ixxxer");
                        // @//machineName:port:SID,   userid,  password

    Statement st=conn.createStatement();

    ResultSet rs=st.executeQuery("Select * from Cusxxxxer");

    while(rs.next()){
        String name=rs.getString("user_id");
        String p=rs.getString("password");
        out.println(name+":"+p);
        out.println("</br>");


    String algorithm1 = "DES";//magical mystery constant
    String algorithm2 = "DES/CBC/NoPadding";//magical mystery constant
    IvParameterSpec iv = new IvParameterSpec( new byte [] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 } );//magical mystery constant
    Cipher cipher;
    SecretKey key;
    String k="12345abc";
    key = new SecretKeySpec( k.getBytes( ), algorithm1 );
    cipher = Cipher.getInstance( algorithm2 );

    String str="test1234abc";

    cipher.init( Cipher.ENCRYPT_MODE, key, iv ); //normally you could leave out the IvParameterSpec argument, but not with Oracle

    byte[] bytes=str.getBytes("UTF-8");

    byte[] encrypted = cipher.doFinal( bytes );

    }
%>  
</BODY>
</HTML>

I am having issue with the last line where statement is: byte[] encrypted = cipher.doFinal( bytes ); This statement gives me an error:

javax.crypto.IllegalBlockSizeException: Input length not multiple of 8 bytes at com.sun.crypto.provider.SunJCE_h.a(DashoA6275) at com.sun.crypto.provider.SunJCE_h.b(DashoA6275) at com.sun.crypto.provider.SunJCE_h.b(DashoA6275) at com.sun.crypto.provider.DESCipher.engineDoFinal(DashoA6275) at javax.crypto.Cipher.doFinal(DashoA6275) at _check1._jspService(_check1.java:83) [SRC:/check1.jsp:45] at com.orionserver[Oracle Application Server Containers for J2EE 10g (10.1.2.0.2)].http.OrionHttpJspPage.service(OrionHttpJspPage.java:56) at oracle.jsp.runtimev2.JspPageTable.service(JspPageTable.java:350) at oracle.jsp.runtimev2.JspServlet.internalService(JspServlet.java:509) at oracle.jsp.runtimev2.JspServlet.service(JspServlet.java:413) at javax.servlet.http.HttpServlet.service(HttpServlet.java:853) at com.evermind[Oracle Application Server Containers for J2EE 10g (10.1.2.0.2)].server.http.ServletRequestDispatcher.invoke(ServletRequestDispatcher.java:824) at com.evermind[Oracle Application Server Containers for J2EE 10g (10.1.2.0.2)].server.http.ServletRequestDispatcher.forwardInternal(ServletRequestDispatcher.java:330) at com.evermind[Oracle Application Server Containers for J2EE 10g (10.1.2.0.2)].server.http.HttpRequestHandler.processRequest(HttpRequestHandler.java:830) at com.evermind[Oracle Application Server Containers for J2EE 10g (10.1.2.0.2)].server.http.HttpRequestHandler.run(HttpRequestHandler.java:285) at com.evermind[Oracle Application Server Containers for J2EE 10g (10.1.2.0.2)].server.http.HttpRequestHandler.run(HttpRequestHandler.java:126) at com.evermind[Oracle Application Server Containers for J2EE 10g (10.1.2.0.2)].util.ReleasableResourcePooledExecutor$MyWorker.run(ReleasableResourcePooledExecutor.java:186) at java.lang.Thread.run(Thread.java:534)

I know the error means that parameter requires multiple of 8 bytes. but How should I do? Please can anyone correct my code or give me some other example. I am a newbie to JSP and ORACLE both so dont know much. Thanks in advance! :)

回答1:

Kindly replace

String str="test1234abc"; 

to

String str="12345abc";  


回答2:

Ok I got the answer to my query... psaraj12 mentioned the same thing. but just to make it clear to all people whats the reason behind it, I am using a 8byte encryption. So Passwords must be in multiple of 8 characters. So the problem is solved by putting a check on the login page that passwords must be in multiple of 8 characters.