javax.crypto.BadPaddingException: Data must start with zero

[sanket jani]

hello friends
i have stuck up in the error labeled above
while decrypting the code with RSA

i am encrypting the key generated by one servlet and decrypting it in another servlet
but while decrypting it gives error
following is my code

Servlet which encrypting the data

package com.msr;

import java.io.File;
import java.io.FileInputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.ObjectInputStream;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.sql.Connection;
import java.sql.PreparedStatement;
import java.sql.ResultSet;

import javax.crypto.Cipher;
import javax.crypto.CipherInputStream;
import javax.crypto.SecretKey;
import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.DESKeySpec;
import javax.servlet.ServletException;
import javax.servlet.annotation.MultipartConfig;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.Part;




/**
 * Servlet implementation class Register
 */
@WebServlet("/Register")
@MultipartConfig(maxFileSize = 16177215)
public class Register extends HttpServlet {
	private static final long serialVersionUID = 1L;
	
	public static final String PRIVATE_KEY_FILE = "C:/keys/private.key";

	public static final String PUBLIC_KEY_FILE = "C:/keys/public.key";
	
	private final String key = "sanket123";   
    /**
     * @see HttpServlet#HttpServlet()
     */
    public Register() {
        super();
        // TODO Auto-generated constructor stub
    }
    
	/**
	 * @see HttpServlet#doPost(HttpServletRequest request, HttpServletResponse response)
	 */
	protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
		// TODO Auto-generated method stub
	    Connection conn = null;  
	    PreparedStatement pst = null;
	    PreparedStatement pstKey = null;
	    ResultSet rs = null;
	    InputStream is = null;
		DbConnection conObj = new DbConnection();
		String hPwd;
		String hrpwd;
		
		
		String fName = request.getParameter("ftext");
		String lName = request.getParameter("Ltext");
		String password = request.getParameter("password");
		String repassword = request.getParameter("repassword");
		
		try{
			conn = conObj.getConnection();
			Part filePart = request.getPart("fingerImage");
			
			DESKeySpec dks = new DESKeySpec(key.getBytes());
			SecretKeyFactory skf = SecretKeyFactory.getInstance("DES");
			SecretKey desKey = skf.generateSecret(dks);
			Cipher cipherObj = Cipher.getInstance("DES");
			
			//System.out.println("key value :- " + desKey);
			cipherObj.init(Cipher.ENCRYPT_MODE	,desKey);
			CipherInputStream CISobj=null;
			if(filePart != null){
				//System.out.println("WE ARE IN THE FILEPART !!");
				is = filePart.getInputStream();
				CISobj = new CipherInputStream(is, cipherObj);
			}
			//key need
			//simple requirement key store and retrieve 
			Hashing hashObj = new Hashing();
			hPwd = hashObj.SHA1(password);
			hrpwd = hashObj.SHA1(repassword);
			String insertQuery = "INSERT into registration (FirstName,LastName,password,repassword,fingerImage) VALUES (?,?,?,?,?)";
		
			pst = conn.prepareStatement(insertQuery);
			pst.setString(1, fName);
			pst.setString(2, lName);
			pst.setString(3, hPwd);
			pst.setString(4, hrpwd);
			if(is != null){
				pst.setBlob(5, CISobj);
			}
			pst.executeUpdate();
			
			/*CODE FOR RSA ENCRYPTION*/
			
			File publicKey = new File(PUBLIC_KEY_FILE);
			
			ObjectInputStream inputStream = new ObjectInputStream(new FileInputStream(PUBLIC_KEY_FILE));
			   final PublicKey PublicKey = (PublicKey) inputStream.readObject();
			   final byte[] cipherText = encrypt(desKey.toString(), PublicKey);
			   System.out.println("Text to be encrypted :- " + desKey);
			   System.out.println("Encrypted TEXT :- " + cipherText);
			   
			 /*  inputStream = new ObjectInputStream(new FileInputStream(PRIVATE_KEY_FILE));
			      final PrivateKey privateKey = (PrivateKey) inputStream.readObject();
			      final String plainText = decrypt(cipherText, privateKey);   
			      System.out.println("DECRYPTED TEXT :- " + plainText);*/
			
			String insertKey = "INSERT into keystore(FirstName,symmKey) VALUES(?,?)";
			pstKey = conn.prepareStatement(insertKey);
			pstKey.setString(1,fName);
			pstKey.setString(2,cipherText.toString());
			pstKey.executeUpdate();
			response.sendRedirect("http://localhost:8085/MSR/html/logIn.html");
		}catch(Exception e){
			e.printStackTrace();
		}
//		System.out.println("Saved Successfully");
	}
	public static byte[] encrypt(String text, PublicKey key){
	    byte[] cipherText = null;
	    try {
	      // get an RSA cipher object and print the provider
	      final Cipher cipher = Cipher.getInstance("RSA");
	      // encrypt the plain text using the public key
	      cipher.init(Cipher.ENCRYPT_MODE, key);
	      cipherText = cipher.doFinal(text.getBytes());
	    }catch (Exception e) {
	      e.printStackTrace();
	    }
	    return cipherText;
	  }
	  /*public static String decrypt(byte[] text, PrivateKey key) {
		    byte[] dectyptedText = null;
		    try {
		      // get an RSA cipher object and print the provider
		      final Cipher cipher = Cipher.getInstance("RSA");

		      // decrypt the text using the private key
		      cipher.init(Cipher.DECRYPT_MODE, key);
		      dectyptedText = cipher.doFinal(text);

		    } catch (Exception ex) {
		      ex.printStackTrace();
		    }

		    return new String(dectyptedText);
		  }
*/
}

and following servlet i used to decrypt the data

package com.msr;

import java.io.FileInputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.ObjectInputStream;
import java.security.KeyFactory;
import java.security.PrivateKey;
import java.security.spec.EncodedKeySpec;
import java.security.spec.PKCS8EncodedKeySpec;
import java.sql.Connection;
import java.sql.ResultSet;

import javax.crypto.Cipher;
import javax.crypto.CipherInputStream;
import javax.servlet.RequestDispatcher;
import javax.servlet.ServletException;
import javax.servlet.annotation.MultipartConfig;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.Part;

import com.mysql.jdbc.Statement;

/**
 * Servlet implementation class VerifyUser
 */
@WebServlet("/VerifyUser")
@MultipartConfig(maxFileSize = 16177215)
public class VerifyUser extends HttpServlet {
	private static final long serialVersionUID = 1L;
	public static final String PRIVATE_KEY_FILE = "C:/keys/private.key";  
    /**
     * @see HttpServlet#HttpServlet()
     */
    public VerifyUser() {
        super();
        // TODO Auto-generated constructor stub
    }

	/**
	 * @see HttpServlet#doPost(HttpServletRequest request, HttpServletResponse response)
	 */
	protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
		// TODO Auto-generated method stub
		System.out.println("WE ARE IN THE VERIFY SERVLET");
		//RequestDispatcher reqDispatcher = request.getRequestDispatcher("/html/success.jsp");
		//reqDispatcher.forward(request, response);
		
		Connection conn = null;  
	    Statement stmt = null;
	    ResultSet rs = null;
	    InputStream is=null;

		String userName = request.getParameter("userName");
		try{
			DbConnection conObj = new DbConnection();
			conn = conObj.getConnection();
			String retrieveQuery = "select * from keystore where FirstName='"+userName+"';";
			stmt = (Statement)conn.createStatement();
			/*FETCHING IMAGE FROM BIO INSERT JSP*/
			Part filePart = request.getPart("fingerImageVerify");
			if(filePart != null){
				is = filePart.getInputStream();
				//CISobj = new CipherInputStream(is, cipherObj);
			}
			/*FETCHING SYMMETRIC KEY FROM DATABASE*/
			String symmKey=null,prKey;
			rs = stmt.executeQuery(retrieveQuery); 
			while(rs.next()){
				System.out.println("symmKey :- "+ rs.getString(3));
				symmKey = rs.getString(3);
			}
					
			ObjectInputStream   inputStream = new ObjectInputStream(new FileInputStream(PRIVATE_KEY_FILE));
			final PrivateKey privateKey = (PrivateKey) inputStream.readObject();
			final String plainText = decrypt(symmKey.getBytes(), privateKey);   
			System.out.println("DECRYPTED TEXT :- " + plainText);
			
			System.out.println("Decrypted keys at the verify :- " + plainText);
			
			rs=null;
		}catch(Exception e){
			e.printStackTrace();
		}
		
		//System.out.println("verifying user :- " + userName);
	}
	  public static String decrypt(byte[] text, PrivateKey key) {
		    byte[] dectyptedText = null;
		    try {
		      // get an RSA cipher object and print the provider
		      final Cipher cipher = Cipher.getInstance("RSA");

		      // decrypt the text using the private key
		      cipher.init(Cipher.DECRYPT_MODE, key);
		      dectyptedText = cipher.doFinal(text);

		    } catch (Exception ex) {
		      ex.printStackTrace();
		    }

		    return new String(dectyptedText);
		  }

}

following is the stacktrace of the error

Jun 27, 2015 12:07:59 PM org.apache.catalina.startup.Catalina start
INFO: Server startup in 3618 ms
Text to be encrypted :- com.sun.crypto.provider.DESKey@18cc9
Encrypted TEXT :- [B@50893e4c
DECRYPTED TEXT :- com.sun.crypto.provider.DESKey@18cc9
YES USER IDENTIFIED .... PROCEED NOW..........
WE ARE IN THE USERCHECK SERVLET
WE ARE IN THE VERIFY SERVLET
symmKey :- [B@50893e4c
javax.crypto.BadPaddingException: Data must start with zero
at sun.security.rsa.RSAPadding.unpadV15(Unknown Source)
at sun.security.rsa.RSAPadding.unpad(Unknown Source)
at com.sun.crypto.provider.RSACipher.doFinal(RSACipher.java:356)
at com.sun.crypto.provider.RSACipher.engineDoFinal(RSACipher.java:382)
at javax.crypto.Cipher.doFinal(Cipher.java:2087)
at com.msr.VerifyUser.decrypt(VerifyUser.java:99)
at com.msr.VerifyUser.doPost(VerifyUser.java:79)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:754)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:847)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:220)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:503)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:170)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:950)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:421)
at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1070)
at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:611)
at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:316)
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.lang.Thread.run(Unknown Source)
java.lang.NullPointerException
at java.lang.String.<init>(Unknown Source)
at com.msr.VerifyUser.decrypt(VerifyUser.java:105)
at com.msr.VerifyUser.doPost(VerifyUser.java:79)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:754)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:847)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:220)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:503)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:170)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:950)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:421)
at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1070)
at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:611)
at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:316)
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.lang.Thread.run(Unknown Source)

[Richard Tookey]

There is even more wrong with this code than with your previous code. I can't really follow the overall design logic but it still seems that you are generating both the RSA private key and public key for your client.

In your previous post I said that using toString() on an array did not result in a representation of the content of the array..

You are still working with String when you should be working with byte arrays.

Testing a big amorphous chunk of code within a servlet is very difficult. You need to separate out the various parts of your code into manageable classes. You need a DAO (data access object) for you JDBC code and you need a DES encryption manager object for the DES and an RSA encryption manager object for the RSA. These can all be tested outside of your Servlet so that when you plug them into your Servlet you will be sure they are not giving the problem.