AES Encryption and Decryption in Java

by

In this article you will learn AES Encryption and Decryption algorithm, advantages and disadvantages of AES algorithm, AES mode of operation and common vulnerabilities and attacks in AES algorithm.

The AES algorithm, also known as Rijndael, is a symmetric block cipher encryption method. Symmetric encryption means that the same secret key is used for both encryption and decryption processes. AES operates on fixed-size blocks of data, with key sizes of 128, 192, or 256 bits.

Working Method of AES Encryption

  1. Key Expansion: The secret key undergoes an expansion process to generate a set of round keys.
  2. Initial Round: The input data is XORed with the first round key.
  3. Rounds of Substitution and Permutation: Multiple rounds of substitution (SubBytes), permutation (ShiftRows), mixing (MixColumns), and adding the round key (AddRoundKey) are performed to scramble the data.
  4. Final Round: The final round excludes the MixColumns step, providing the encrypted output.

Advantages and Disadvantages of AES Encryption

Advantages:

  1. High Security: AES offers strong protection against various cryptographic attacks, ensuring data confidentiality.
  2. Efficiency: Despite its robust security, AES encryption and decryption processes are computationally efficient.
  3. Widespread Adoption: AES is globally recognized and utilized across diverse industries for securing sensitive data.

Disadvantages:

  1. Algorithm Complexity: While AES is secure, its underlying mathematical operations can be challenging to grasp, requiring expertise for implementation.
  2. Block Cipher Limitation: Certain modes of operation, like ECB, may exhibit patterns in encrypted data, impacting security.
  3. Key Management: Proper key management practices are essential, as compromised keys can compromise the entire encryption scheme.

Example of encryption and decryption of AES algorithm in java

import javax.crypto.Cipher;
import javax.crypto.KeyGenerator;
import javax.crypto.SecretKey;

import java.util.Base64;

public class AESEncryptionExample {

    public static void main(String[] args) throws Exception {

        // Generate a secret key for AES encryption

        KeyGenerator keyGenerator = KeyGenerator.getInstance("AES");

        keyGenerator.init(256); // 256-bit key size

        SecretKey secretKey = keyGenerator.generateKey();

        // Create an AES cipher instance

        Cipher cipher = Cipher.getInstance("AES");

        // Initialize the cipher for encryption using the secret key

        cipher.init(Cipher.ENCRYPT_MODE, secretKey);

        // Plaintext to be encrypted

        String plaintext = "Hello, Symmetric Cryptography in Java!";

        // Encrypt the plaintext

        byte[] encryptedBytes = cipher.doFinal(plaintext.getBytes());

        // Encode the encrypted bytes to Base64 for readability

        String encryptedText = Base64.getEncoder().encodeToString(encryptedBytes);

        System.out.println("Encrypted Text (AES): " + encryptedText);

        // Initialize the cipher for decryption using the same secret key

        cipher.init(Cipher.DECRYPT_MODE, secretKey);

        // Decrypt the encrypted bytes

        byte[] decryptedBytes = cipher.doFinal(Base64.getDecoder().decode(encryptedText));

        // Convert the decrypted bytes back to plaintext

        String decryptedText = new String(decryptedBytes);

        System.out.println("Decrypted Text (AES): " + decryptedText);

    }

}

In the above example

  • We generate a 256-bit secret key for AES encryption using KeyGenerator.
  • Create an AES cipher instance and initialize it for encryption using the secret key.
  • Encrypt the plaintext “Hello, Symmetric Cryptography in Java!” using cipher.doFinal().
  • Encode the encrypted bytes to Base64 for better display.
  • Initialize the cipher for decryption using the same secret key and decrypt the encrypted text back to plaintext.

Video Example of implementation of AES encryption and Decryption in java

Aes encryption and decryption in java

AES mode of operation

AES supports several modes of operation, each offering unique characteristics and security properties. Let’s delve into each mode and provide a coding example in Java for better understanding.

Electronic Codebook (ECB) Mode:

  • ECB divides the plaintext into blocks and encrypts each block separately using the same key.
  • However, ECB is vulnerable to patterns in data, as identical plaintext blocks yield identical ciphertext blocks.

ECB Mode java example

import javax.crypto.Cipher;
import javax.crypto.KeyGenerator;
import javax.crypto.SecretKey;
import java.util.Base64;

public class AESModesExample {

    public static void main(String[] args) throws Exception {
        String plaintext = "Hello, ECB Mode!";
        SecretKey key = KeyGenerator.getInstance("AES").generateKey();

        Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5Padding");
        cipher.init(Cipher.ENCRYPT_MODE, key);
        byte[] encryptedBytes = cipher.doFinal(plaintext.getBytes());

        String encryptedText = Base64.getEncoder().encodeToString(encryptedBytes);
        System.out.println("Encrypted Text (ECB): " + encryptedText);
    }
}

Cipher Block Chaining (CBC) Mode:

  • CBC uses an Initialization Vector (IV) to XOR with the first plaintext block before encryption.
  • Each subsequent block XORs with the previous ciphertext block, adding randomness and preventing patterns.

CBC Example

import javax.crypto.Cipher;
import javax.crypto.KeyGenerator;
import javax.crypto.SecretKey;
import javax.crypto.spec.IvParameterSpec;
import java.util.Base64;

public class AESModesExample {

    public static void main(String[] args) throws Exception {
        String plaintext = "Hello, CBC Mode!";
        SecretKey key = KeyGenerator.getInstance("AES").generateKey();
        IvParameterSpec iv = new IvParameterSpec(new byte[16]); // Initialization Vector

        Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
        cipher.init(Cipher.ENCRYPT_MODE, key, iv);
        byte[] encryptedBytes = cipher.doFinal(plaintext.getBytes());

        String encryptedText = Base64.getEncoder().encodeToString(encryptedBytes);
        System.out.println("Encrypted Text (CBC): " + encryptedText);
    }
}

Cipher Feedback (CFB) Mode:

  • CFB turns AES into a stream cipher by encrypting the IV first and XORing it with plaintext to generate ciphertext.
  • Subsequent blocks encrypt the previous ciphertext block instead of the IV.

CFB Example

import javax.crypto.Cipher;
import javax.crypto.KeyGenerator;
import javax.crypto.SecretKey;
import javax.crypto.spec.IvParameterSpec;
import java.util.Base64;

public class AESModesExample {

    public static void main(String[] args) throws Exception {
        String plaintext = "Hello, CFB Mode!";
        SecretKey key = KeyGenerator.getInstance("AES").generateKey();
        IvParameterSpec iv = new IvParameterSpec(new byte[16]); // Initialization Vector

        Cipher cipher = Cipher.getInstance("AES/CFB/PKCS5Padding");
        cipher.init(Cipher.ENCRYPT_MODE, key, iv);
        byte[] encryptedBytes = cipher.doFinal(plaintext.getBytes());

        String encryptedText = Base64.getEncoder().encodeToString(encryptedBytes);
        System.out.println("Encrypted Text (CFB): " + encryptedText);
    }
}

Common vulnerabilities and attacks in AES algorithm

Common vulnerabilities and attacks related to AES encryption primarily revolve around implementation flaws, key management issues, and side-channel attacks. Here are some key vulnerabilities and corresponding mitigation strategies:

Implementation Flaws:

  • Incorrect implementation of AES algorithms or using weak cryptographic libraries can lead to vulnerabilities.
  • Mitigation: Always use well-vetted and reputable cryptographic libraries or frameworks. Regularly update software and libraries to patch any known vulnerabilities. Follow best practices and guidelines provided by cryptographic experts and standards bodies.

Key Management Issues:

  • Weak key management practices such as using easily guessable keys, storing keys insecurely, or not rotating keys regularly can compromise AES encryption.
  • Mitigation: Use strong, randomly generated keys with appropriate key lengths (e.g., AES-256). Implement secure key storage mechanisms such as hardware security modules (HSMs) or key management services (KMS). Enforce regular key rotation and ensure keys are only accessible to authorized entities.

Side-Channel Attacks:

  • Side-channel attacks exploit information leaked during the encryption process, such as timing variations, power consumption, or electromagnetic emissions.
  • Mitigation: Implement countermeasures against side-channel attacks, such as constant-time algorithms to prevent timing attacks. Use hardware-based encryption modules that mitigate physical side-channel vulnerabilities. Employ techniques like masking, blinding, and randomization to obscure sensitive information.

Padding Oracle Attacks:

  • Padding oracle attacks exploit vulnerabilities in the padding mechanism used in AES encryption (e.g., PKCS#5 padding), allowing an attacker to decipher encrypted data by manipulating padding.
  • Mitigation: Use padding schemes with integrity checks, such as AES-GCM (Galois/Counter Mode), which includes authentication tags to detect tampering. Implement secure error handling to avoid leaking information about padding errors.

Key Reuse and Key Recovery Attacks:

  • Reusing AES keys across different encryption contexts or failing to securely manage key recovery processes can lead to key compromise.
  • Mitigation: Avoid key reuse by generating unique keys for each encryption session or context. Implement secure key recovery mechanisms, such as key escrow systems or secure key revocation procedures, to mitigate risks associated with key loss or compromise.

Cryptanalysis Attacks:

  • Advanced cryptanalysis techniques may attempt to exploit weaknesses in AES algorithms, such as differential or linear cryptanalysis.
  • Mitigation: Use AES with larger key sizes (e.g., AES-256) to increase resistance against cryptanalysis attacks. Regularly review and update AES implementations based on the latest cryptographic research and recommendations.

Leave a Comment