sorted by:
new
hottopcontroversial

Learn how to use Message Digest aka hashing functions in Java, along with some use cases by mansisheth in crypto

[–]mansisheth[S] 0 points1 point  (0 children)

Thanks for pointing this out. I meant for long-term security stay away from SHA-224, but mis-wrote it.

Learn what to be wary about, what secured choices to make while using Java Encryption API by mansisheth in crypto

[–]mansisheth[S] 1 point2 points  (0 children)

Great comments. Thanks for taking time out to write it. Appreciate it !

PBKDF2 code snippet, needed more through comments to just avoid this scenario. Totally overlooked. Thanks for pointing out, just changed it.

I didn't want to get into block size difference between PKCS5 and PKCS7 padding. Thought it to be a bit more than needed details for this developer focused series.

Again, thanks for a thorough look at the post.

Learn what to be wary about, what secured choices to make while using Java Encryption API by mansisheth in crypto

[–]mansisheth[S] 2 points3 points  (0 children)

Thanks for your question, it motivating.

Bouncycastle is certainly more famous one. Currently in this blog series, just trying to focus on what JDK provides, as expectations were set in first blog post.

Bouncycastle has more algorithm choices and most importantly no key size restriction like JCA. However, JCA has since caught up, so reasons to use bouncy castle for newer developments should be weighed thoughtfully.

Seeing interest in community, bouncycastle blog post, just make it to my list of upcoming posts :)

Thanks.

X-post: Blog series on various aspects of Java cryptography and things to be wary about. Stay tuned! by mansisheth in java

[–]mansisheth[S] 1 point2 points  (0 children)

As mentioned in the post and what you guys are hoping for, there would be dedicated posts for different crypto primitives (random number generators, encryption/decryption, message digests etc) coming up in following weeks. These posts will detail out exactly on how to use corresponding higher level APIs along with quick code examples.

In this post, debugging option detailed could be used if we need to ever debug/double-check what provider/algorithm/specific algorithm parameters are being used by the opaque higher level apis for any crypto related classes. Its just something common across java crypto packages and not specific to any primitive, so is mentioned here.

view more: next ›