james edwin

IMHO, I think you should create one index.html and link all your deliverable to that only.

Thanks for the quick reply and i really Appreciate that.

I was just curious to know is there is any other way to verify the key. But as i understand 24 bytes is also a way to verifying the same.

Once again thanks for your help.

When i printed the byte length (byte[] getEncoded())..i get the size 24. so this should be 168 or 24....I am little confused now

Is this statement is true ...."Single DES the key is fixed size of 8 bytes. For Triple DES it is 24"...may be that's why i am getting the length of array as 24.

I changed the encryption from "DESede" to "DES" and got the result 8 back. which validates this statement ("Single DES the key is fixed size of 8 bytes. For Triple DES it is 24"...)

But after getting byte[] back from getEncoded, still how do i verify it's 168 bit. or getting length 24 ensure that it's 168 bit.
(let do some math here 24 *7= 168, but one 1 byte we have 8 bits which make 24 * 8 = 192..isn't ?..)...

Below URL explains that only 7 bit are used.

URL

so if we are getting size of 24 bytes back, then 24 * 7 = 168 which makes sense to me.

Is there is any other way to verify that's key is 168 bit.

Thanks for the information. So life will be easy i will depend on JCE only and let them generate key for my application. If its 168 bit it's fine with me. Can i some how verify it's 168 bit or not ?

I dont want to generate my own keys, as i new to security and i dont want to mess right now. May be sometime later once i get some more hands on i try the same.

Thanks for the searching and the reply.

So my understanding that " i need to generate three keys with 56 bits and do the following for encryption " is not correct..right... So will triple desede will internally do the following stuff for us ?

ciphertext = EK3(DK2(EK1(plaintext)))
I.e., DES encrypt with Key 1, DES decrypt with Key 2, then DES encrypt with Key3.
E -encrypt and D - descrypt

Decryption is the reverse:

plaintext = DK1(EK2(DK3(ciphertext)))
I.e., decrypt with K3, encrypt with K2, then decrypt with K1.

Thanks this really help.

is DESede by default means 168 bit or 112 bit. So where i need to specify 168 bit which i want like i asked in my previous post also, do i need to generate three keys for 168 ?

Hi John,

Thanks for the reply. I need to retrieve password and use it again. I also thought of hash, but as i have to retrieve and use to again at some other place i can't use hash.

What i wanted to understand was for 3des, we have to generate three keys differently and there is not auto way for 168 bit..right ?

i looked at the link and that was helpful.

Can you please verify that i understood correctly or not.

Requirement - encrypt password using 168 bit using 3 des and save 56 bit keys on some where on server drive in secure location and save encrypted password in the database.


My understanding :- for 168 bit encryption, i need to generate three keys with 56 bits and do the following for encryption :-

ciphertext = EK3(DK2(EK1(plaintext)))
I.e., DES encrypt with Key 1, DES decrypt with Key 2, then DES encrypt with Key3.
E -encrypt and D - descrypt

Decryption is the reverse:

plaintext = DK1(EK2(DK3(ciphertext)))
I.e., decrypt with K3, encrypt with K2, then decrypt with K1.



and save all those three 56 bit keys in somewhere. Is my understanding is correct ?

I am new to security, It may be a small question, but important for me to clear my understanding.

I am also refering this http://java.sun.com/j2se/1.5.0/docs/guide/security/jce/JCERefGuide.html

Thanks

Thanks i will have a look.

hi,

I am new to security. i have requirement where i need to stored password in encrypted format in database using 168 bit 3 DES. (and then 56 key will saved somewhere in secure path on server and that will changed frequently for security reasons and db will also be updated).

Can you guide me from where to start. i did some search for 3 des.

Thanks,

PS: this needs to implemented in Java

Get the local resturant guide and try calling them up at some good places, i am sure they must be having some plans.

In delhi, there are lot of places.

Check this

http://faq.javaranch.com/view?SceaLinks

You will be able to find lot of answers.

Hi Lakshmanan,

Congrats.

Can you please share which all resources you refered/studied for part1.

I also read saying its EJB 1.1 and not EJB 2.0 as it's based on J2EE 1.3

Messaging Link - http://java.sun.com/products/jms/tutorial/
[ November 14, 2006: Message edited by: james edwin ]

Siva,

Can you please share your preparation methodology or path you chosed...i have just started for this, may be this will help.