could not create encryption cipher

[anazri]

Hi @ctrimble

I got the following error when try to run the original app. please advice.

Exception in thread "main" com.meltmedia.jackson.crypto.EncryptionException: could not create encryption cypher
at com.meltmedia.jackson.crypto.EncryptionService.createEncryptionCipher(EncryptionService.java:282)
at com.meltmedia.jackson.crypto.EncryptionService.encrypt(EncryptionService.java:334)
at com.meltmedia.jackson.crypto.EncryptionService.encrypt(EncryptionService.java:361)
at com.meltmedia.jackson.crypto.EncryptionService.encryptValue(EncryptionService.java:372)
at com.meltmedia.dropwizard.crypto.Commands$Encrypt.run(Commands.java:116)
at io.dropwizard.cli.Cli.run(Cli.java:70)
at io.dropwizard.Application.run(Application.java:72)
at com.meltmedia.dropwizard.crypto.example.CryptoApplication.main(CryptoApplication.java:28)
Caused by: java.security.InvalidKeyException: Illegal key size or default parameters
at javax.crypto.Cipher.checkCryptoPerm(Cipher.java:1026)
at javax.crypto.Cipher.implInit(Cipher.java:801)
at javax.crypto.Cipher.chooseProvider(Cipher.java:864)
at javax.crypto.Cipher.init(Cipher.java:1249)
at javax.crypto.Cipher.init(Cipher.java:1186)
at com.meltmedia.jackson.crypto.EncryptionService.createEncryptionCipher(EncryptionService.java:276)

[ctrimble]

@anazri What encryption settings are you trying to use? Are you using the development branch?

It looks to me like you are using a large key size without the JCE.

[anazri]

@ctrimble (1) I am using default, did not set anything. (2) Yes, I am using develop branch. Is that the issue? What is your suggestion? Thanks

[ctrimble]

This is strange. I just did the following:

1. checked out the development branch
2. ran mvn clean install from the root of the project
3. ran cd example to get into the example project.
4. set the environment variable export DROPWIZARD_PASSPHRASE='correct horse battery staple' (NOTE: that line had a back tick instead of a single quote, I fixed that in the instructions)
5. ran ./target/dropwizard-crypto decrypt -p /secret config/example.yml and it decrypted the secret in the example.yml file.

I assume this is the process that is not working for you.

I just checked my java environment and I do have the JCE installed. This is probably the problem. The example uses 256 for the key length, but you can only do 128 bit key lengths without the JCE. Let me rework the example, so it uses a shorter key length.

[anazri]

Ah ha.. may be I need to install JCE in my environment might solve this issue.
Please do not change anything. Let me try to install JCE. Thanks

[ctrimble]

Installing the JCE would fix it. I have also pushed a change to the example that drops it to a 128 bit key length. If you pull down the latest and rebuild, the example should work for you without the JCE.

[anazri]

Many thanks @ctrimble . Now it works after I installed JCE. Appreciate that.
By the way, I got one question, your example of config.yml is only one value or a group of value. What if I want to use configuration consists of several groups of values such as below -

https://github.com/anazri/dropwizard/blob/master/dropwizard-example/example.yml

I have tested the following and it was successfully encrypted.

database:
driverClass: com.mysql.jdbc.Driver
user: root
password: password
url: jdbc:mysql://localhost:3306/database
properties:
charSet: UTF-8
hibernate.dialect: org.hibernate.dialect.MySQLDialect
#hibernate.show_sql: true
hibernate.hbm2ddl.auto: update

the encrypted yml as below -

---

database:
salt: "ywKtmA=="
iv: "l5M9z86Gw0dyxO2EiZQSqw=="
value: "zH4oG3tIB1Acbg6LHKhsY8aCxqa0B/sniRg48+UIhc3s1liAXmm5A1vWB5JvmDK8p/7LEg74C62mu7OpfYlBgRHcCu8nh+QFKThu+3UG7kM0C8maIGIi+3x/+s/ptjP4KCn64xIVIWR1qjEYF812iBjhLq+85GdHD6YJ7P6ia7jABEgSjw3uxDLfjpJ+6SuYumU64v40zbrT4kvA/MadPCi/6dbSRDVPSUsZRKJ3iurio0rrq83TqnnpkOZ5OP5WVlTIx+OHyLZs20OcsJaqxUg3Z6GMqyCIewRsP2/nOOTA9A41CnZFCN3NeS9TOD2GwiSS9JiS2qFqQbB7LeCuog=="
cipher: "aes-256-cbc"
keyDerivation: "pbkdf2"
keyLength: 256
iterations: 2000

thanks.

[ctrimble]

You should be able to encrypt the values one at a time. Already encrypted values will remain untouched. You can also pipe the output, so you could encrypt multiple values. If you had unencrypted-config.yml:

service1:
  username: username1
  password: password1
service2:
  username: username2
  password: password2

you could encrypt both passwords with this line:

cat config/unencrypted-config.yml | ./target/dropwizard-crypto encrypt -p '/service1/password' | ./target/dropwizard-crypto encrypt -p '/service2/password' > config/config.yml

and then config.yml would contain:

---
service1:
  username: "username1"
  password:
    salt: "0hgxEw=="
    iv: "zwUSuTRQ/5pXi6UsVowCUg=="
    value: "ZOYUyLODvAGxb8dqJHIynw=="
    cipher: "aes-256-cbc"
    keyDerivation: "pbkdf2"
    keyLength: 128
    iterations: 2000
service2:
  username: "username2"
  password:
    salt: "KG4FQA=="
    iv: "RJeL8CFhrGc0IE4KcCIkGg=="
    value: "uAjQ/e2zr2Ow0pAhueqKVg=="
    cipher: "aes-256-cbc"
    keyDerivation: "pbkdf2"
    keyLength: 128
    iterations: 2000

I usually just encrypt the values one at a time and copy the encrypted block back into the config file, since I do this rarely.

Also, letting the tool process the entire file causes string values to get quoted. I have not found a good way to get Snake Yaml to pass the formatting through. This is another good reason to just copy the encrypted blocks back into the config file manually.