Overview
The Crypto Service allows an application to request various encryption algorithms.
It is written for use in Turbine but it can be used in any container compatible with Avalon's ECM container.
Configuration
Role Configuration
<role
name="org.apache.fulcrum.crypto.CryptoService"
shorthand="crypto"
default-class="org.apache.fulcrum.crypto.DefaultCryptoService"/>
Component Configuration
| Item | Datatype | Cardinality | Description |
|---|---|---|---|
| algorithm | Complex | [0|1] |
This element controls the various encryption providers. All sub-elements
of this element define the name of the provider as the element name and
the class that implements the provider as its value. See the configuration
example. The algorithm default can be used to override the
default which is JavaCrypt.
|
Component Configuration Example
<crypto>
<algorithm>
<unix>org.apache.fulcrum.crypto.provider.UnixCrypt</unix>
<clear>org.apache.fulcrum.crypto.provider.ClearCrypt</clear>
<java>org.apache.fulcrum.crypto.provider.JavaCrypt</java>
<oldjava>org.apache.fulcrum.crypto.provider.OldJavaCrypt</oldjava>
</algorithm>
</crypto>
Usage
If you want to encrypt a clear text with a MessageDigest Cipher, you can do it like this:
import org.apache.fulcrum.crypto.CryptoAlgorithm;
import org.apache.fulcrum.crypto.CryptoService;
public class CryptoExample
{
public String doMD5Encryption(String input)
{
CryptoService cs = (CryptoService) avalonComponentService.lookup(CryptoService.ROLE);
CryptoAlgorithm ca = CryptoService.getCryptoAlgorithm("default");
ca.setCipher("MD5");
return ca.encrypt(input);
}
}
To see an example, look at the test case CryptoServiceTest.
Default Provider
In the source code and the example above, there is talk about a "default" provider which is used if no encryption algorithm is specifically requested. The reason for this comes from the first user of the crypto service, the Turbine Security Service. It gives you the ability to select an encryption algorithm like MD5 or SHA1 which is in turn used with the normal java crypto providers. As we just wanted to "add" new algorithms and still be able to use the old java.security names like MD5 and SHA1, we decided to add a "catchall" algorithm to the crypto service.
If you don't set the default provider explicitly, the org.apache.fulcrum.crypto.provider.JavaCrypt class is used. If you don't set the Cipher of this class explicitly, then SHA is used.
Included Providers
The following algorithm providers are included in the Cryptoservice:
- ClearCrypt (org.apache.fulcrum.crypto.provider.ClearCrypt). This is the simplest algorithm which does nothing. It is still useful because you can use the Crypto Service all the time even if you don't want to actually encrypt something. Just request the "clear" algorithm.
- UnixCrypt (org.apache.fulcrum.crypto.provider.UnixCrypt). This is an implementation of the Unix crypt(3) algorithm. Its main use is when you need to access legacy information or databases which already contain crypted passwords.
- JavaCrypt (org.apache.fulcrum.crypto.provider.JavaCrypt). This is the default crypto provider. It implements the normal Java MessageDigest ciphers You don't need to have this, it is the default if no algorithms are given. The default provider gives you all the Java MessageDigest Ciphers including MD5, and SHA1.
- OldJavaCrypt (org.apache.fulcrum.crypto.provider.OldJavaCrypt). Accessing the MessageDigest functions from java.security was buggy in Turbine 2.1, because the Security Service didn't pad the base64 values correctly but simply cut them off after 20 bytes. If you're stuck with an old database full of passwords and can't upgrade, please use this provider to keep going. DO NOT USE THIS PROVIDER FOR NEW APPLICATIONS!.