Could I have broken the law by using SunJCE?!!

[Steven Ho]

I have been developing a simple application where I need to encrypt and decrypt a short password sent by end user accross internet. The coding is working just fine. But I am worry whether I have violated the US cryptographic export restrictions by using these coding.
If I am, can anyone suggest an alternative to encrypt and decrypt the password?
Thank you all.

 
import java.io.*;
import java.security.*;
import javax.crypto.*;
import sun.misc.*;
/**
 *EnDec stands for Encryption and Decription, this class is primarily used for encrypting and decrypting 
 *password. The variable keyFile must be reconfigured if this application were to deploy in a different 
 *environment.
 *@author steven ho
 *@version 1.0
 */
public class EnDec {

private Key key;
private String keyFile = "/usr/local/jakartatomcat/jakarta-tomcat-4.0.6/webapps/opencms/WEB-INF/config/des.key";
//private String keyFile = "C:/tomcat/tomcat-4-1/webapps/opencms/WEB-INF/config/des.key";

/**
 *Default Constructor
 */
public EnDec(){

}//EnDec()

/**
 *Initialize the Key object with des.key file information.
 */
public void initKey(){

try{
ObjectInputStream in = new ObjectInputStream(new FileInputStream(keyFile));
key = (Key)in.readObject();
in.close();
}catch(Exception e){
System.err.println("Could not read the key from file des.key");
System.err.println(e);

}//catch()

}//initKey

/**
 *Encrypt a text into a BASE 64 string to be store in database using Cipher.
 *@paramtextoriginal text to be encrypted.
 *@return result string in BASE 64 to be store in database.
 *@throws <code>Exception</code> if occurs.
 *@see Cipher
 *@see BASE64Encoder
 */
public String Encrypt(String text) throws Exception {
String result = "";
Cipher cipher = Cipher.getInstance("DES/ECB/PKCS5Padding");
cipher.init(Cipher.ENCRYPT_MODE, key);

byte[] inputBytes = text.getBytes("UTF8");
byte[] outputBytes = cipher.doFinal(inputBytes);

BASE64Encoder encoder = new BASE64Encoder();
result = encoder.encode(outputBytes);

return result;
}//Encrypt
/**
 *Decrypt a text currently in BASE64 format into a normal string using Cipher.
 *@paramtextstring BASE 64 from database
 *@return resulta normal string 
 *@throws <code>Exception</code> if occurs.
 *@see Cipher
 *@see BASE64Decoder
 */
public String Decrypt(String text) throws Exception{
String result = "";
Cipher cipher = Cipher.getInstance("DES/ECB/PKCS5Padding");
cipher.init(Cipher.DECRYPT_MODE, key);

BASE64Decoder decoder = new BASE64Decoder();

byte[] inputBytes = decoder.decodeBuffer(text);
byte[] outputBytes = cipher.doFinal(inputBytes);

result = new String(outputBytes, "UTF8");
return result;
}//Decrypt


}//EnDec

[ March 14, 2003: Message edited by: Steven Ho ]

[Peter den Haan]

IANAL[1], but I'd like to point out the following.

The export restrictions were much relaxed a few years ago. I don't have a clue what the restrictions (if any) with regards to Malaysia are.

Whatever the case may be, your code is certainly not in violation. You're just coding against an abstract API (JCE) and not implementing the actual encryption. At most, you might be guilty of illegaly exporting the Sun JCE implementation or the Sun JCE provider. There is legalese about this on the Sun website, you might read that.

If you are concerned about the legal position of either your Sun JCE implementation or the provider, you can switch to alternative implementations such as The Legion of the Bouncy Castle (to be taken a whole lot more seriously than the name may suggest). They're hosted in Australia and not subject to U.S. export regulations. You can use them as a JCE provider, or ditch the Sun JCE altogether and use their JCE reimplementation.

Last but not least, there may be rules and regulations in your country which control or limit the encryption you are allowed to use. I don't have a clue about this, but you might well want to check.

- Peter
[1] I Am Not A Lawyer.

[Steven Ho]

Peter,
Thank you so much, I am so relieved now. And I will examine the bouncycastle.org later.
Steven
[ March 16, 2003: Message edited by: Steven Ho ]

[Sandep Chaturvedi]

We have been using Bouncy Castle in US and it is our security standard for all data encryptions/decryptions. Very cool...