Have a look at the source code for the various classes in is.logi.crypto.test.
Why is garbage inserted when I call the flush() method on EncryptStream or EncryptMode?
This happend when you use the ECB or CBC modes, which need a whole multiple of blocks to pass to the encryption key. The size of the block depends on the key used and is returned by the CipherKey.plainBlockSize() method.
If less than a whole multiple of blocks has been sent to the EncryptECB or EncryptCBC object when flush() is called, random data will be appended to make certain attacks on the key more difficult.
Some possible solutions include sending the size of the message along with the message itself or making certain that the message size is a whole multiple of blocks. Alternatively, you may want to use either the CFB of OFB modes.
How do I encrypt passwords with logi.crypto?
Normally, passwords are not encrypted, but hashed. Hashing can be thought of as one-way encryption: there is no key to get back the original password if you know the hashed password.
In logi.crypto this could be done with:
String password = getPassword(); Fingerprint fp = Fingerprint.create(password,"SHA1");In the above, "SHA1" is the name of the hash-function used. It can be replaced with "MD5" and possibly others will be added in the future.
Please see the next question.
How do I authenticate users?
In many authentication systems the user types in a password which is sent to the server. The server hashes the password and compares the hash to the value stored in a database. There are serious problems with this protocol!
The password could be captured on the network connecting the client and the server. This can be alleviated by sending the password encrypted, for example through an CipherStreamClient initialized with a DHKeyExClient.
The other problem is that the user has no guarantee that he is talking to the correct server and might be giving his password away to the wrong entity.
A better way is to create a pair of CipherStreamClient and CipherStreamServer objects, and execute the appropriate QRAuthClient and QRAuthServer objects on them. This authenticates the client to the server and the server to the client without ever sending the secret to the other.
The QRAuth objects must be initialized with a secret CipherKey object. This could be created by hashing a password and passing the bytes of the hash to the constructor for the CipherKey.