Crypto Service

The Crypto Service allows an application to request various encryption algorithms.

Configuration

# -------------------------------------------------------------------
#
#  S E R V I C E S
#
# -------------------------------------------------------------------
# Classes for Turbine Services should be defined here.
# Format: services.[name].classname=[implementing class]
#
# To specify properties of a service use the following syntax:
# service.[name].[property]=[value]

services.CryptoService.classname=org.apache.turbine.services.crypto.TurbineCryptoService
.
.
.
# -------------------------------------------------------------------
#
#  C R Y P T O   S E R V I C E
#
# -------------------------------------------------------------------

#
# Standard Unix crypt(3) password encryption.
#
services.CryptoService.algorithm.unix  = org.apache.turbine.services.crypto.provider.UnixCrypt
#
# This providers allows access to the Java Message Digest encryption algorithms
#
services.CryptoService.algorithm.java  = org.apache.turbine.services.crypto.provider.JavaCrypt
#
# This is a simple, cleartext "encryption" provider.
#
services.CryptoService.algorithm.cleartext  = org.apache.turbine.services.crypto.provider.ClearCrypt
#
# Use this provider if you upgrade from Turbine 2.1 to current. It provides bug-to-bug
# compatibility for passwords created with the old Security Service. See the javadocs for
# OldJavaCrypt
#
services.CryptoService.algorithm.oldjava  = org.apache.turbine.services.crypto.provider.OldJavaCrypt
#
# This is the default crypto provider. It implements the normal Java MessageDigest ciphers
# You need not to have this, it is the default if no algorithms are given. The default
# provider gives you all the Java MessageDigest Ciphers
#
services.CryptoService.algorithm.default  = org.apache.turbine.services.crypto.provider.JavaCrypt

Usage

If you want to encrypt a clear text with a MessageDigest Cipher, you can do it like this:

import org.apache.turbine.services.crypto.CryptoAlgorithm;
import org.apache.turbine.services.crypto.TurbineCrypto;

public class CryptoExample
{
    public String doMD5Encryption(String input)
    {
        CryptoAlgorithm ca = TurbineCrypto.getCryptoAlgorithm("default");

        ca.setCipher("MD5");

        return ca.encrypt(input);
    }
}

Default Provider

In the source code and the example above, there is talk about a "default" provider which is used if no encryption algorithm is specifically requested. The reason for this comes from the first user of the crypto service, the Security Service. It gives you the ability to select an encryption algorithm like MD5 or SHA1 which is in turn used with the normal java crypto providers. As we just wanted to "add" new algorithms and still be able to use the old java.security names like MD5 and SHA1, we decided to add a "catchall" algorithm to the crypto service.

If you don't set the default provider explicitly, the org.apache.turbine.services.crypto.provider.JavaCrypt class is used. If you don't set the Cipher of this class explicitly, then SHA is used.

Included Providers

The following algorithm providers are included in the Cryptoservice:

1. ClearCrypt (org.apache.turbine.services.crypto.provider.ClearCrypt). This is the simplest algorithm which does nothing. It is still useful because you can use the Crypto Service all the time even if you don't want to actually encrypt something. Just request the "cleartext" algorithm.
2. UnixCrypt (org.apache.turbine.services.crypto.provider.UnixCrypt). This is an implementation of the Unix crypt(3) algorithm. Its main use is when you need to access legacy information or databases which already contain crypted passwords.
3. JavaCrypt (org.apache.turbine.services.crypto.provider.JavaCrypt). This is a wrapper around the java.security Message Digest functions which give you MD5, SHA1 and more algorithms.
4. OldJavaCrypt (org.apache.turbine.services.crypto.provider.OldJavaCrypt). Accessing the MessageDigest functions from java.security was buggy in Turbine 2.1, because the Security Service didn't pad the base64 values correctly but simply cut them off after 20 bytes. If you're stuck with an old database full of passwords and can't upgrade, please use this provider to keep going. DO NOT USE THIS PROVIDER FOR NEW APPLICATIONS!.