posted 20 years ago
Actually, you could use a symmetric cipher and just use the same key to encrypt/decrypt. DUH! I don't know why I suggested a keypair. Here's a class that uses passphrase-based encryption...
What you would do is create a ServletContextListener for your webapp. Instantiate a PassphraseCrypto object (supply your own passphrase) and add it to your ServletContext. Then, use it later when you want to encrypt/decrypt files. Now, the problem here is that the key is passphrase-based, so if someone knows your passphrase (and what algorithm you use), they can (theoretically) decrypt the files you have stored on disk. You have to decide on the likelihood of that happening. If you're trying to protect the data from people who have no idea how to do that stuff (and haven't seen this post), then you're probably safe.
However, if you can live with it, you COULD use a random passphrase. The problem with that would be that you can't decrypt files which were encrypted using a previous random value (the server went down and you brought it back up).
James Carman, President<br />Carman Consulting, Inc.