jBCrypt Encrypt and Decrypt

Question

I came to know about jBCrypt for hashing a password and storing in DB. But I didnt find any option to get back the actual value from the hashed value. Only BCrypt.checkpw(password, hashedPassword) is available which is returning boolean.http://www.mindrot.org/projects/jBCrypt/ How can I get the actual value out of hashed value. If it is not possible in jBCrypt, is there any other way to encrypt and decrypt values in java? Thanks in advance...

Answer 1

The definition of a hash function has resistance to preimages: given h(x), it should be impossible to recover x. A hash function being "reversible" is the exact opposite of that property. Therefore, you cannot reverse hash function hence it is not possible to get actual value from hashed value.You cannot get x from h(x),only thing you can do is for the coming new password y compute h(y) and see if it is equal to h(x).

Not just jBcrypt any secured hash function won't provide this functionality of recovery

Answer 2

But I didnt find any option to get back the actual value from the hashed value

Well - that's the primary purpose of the cryptographic hash functions.

is there any other way to encrypt and decrypt values in java? Thanks in advance...

There are a lot of examples to encrypt / decrypt values in Java, just search for it, even here on SO. You may as well have a look into my blog about encryption in Java - it's about basic low level crypto API.

I hope you don't mean to use encryption for user passwords - even remote possibity to make the passwords reversible would make your system potentially dangerous for leaks.

Answer 3

Instead of using a hash function, you can use a symmetrical encryption algorithm, like offered by Spring Security, from their Crypto Module, more specifically their Encryptors class.

Here is a basic encryption/decryption example:

public static void main(String[] args) {
        final String salt = UUID.randomUUID().toString().replace("-", "");
        TextEncryptor textEncryptor = Encryptors.delux("my-super-secure-password-for-the-encryptor", salt);
        final String passwordToBeEncrypted = "my-secure-password-to-be-encrypted";
        final String encrypted = textEncryptor.encrypt(passwordToBeEncrypted);
        textEncryptor.decrypt(encrypted);
        System.out.println(passwordToBeEncrypted.equalsIgnoreCase(textEncryptor.decrypt(encrypted)));
}

Here, I am using the delux. As per their documentation:

Creates a text encryptor that uses "stronger" password-based encryption.

Keep in mind that this is a very naive approach of encrypting and decrypting.

I would not recommend you copy paste this solution in your production code.

In order for this functionality to be production ready, you want the password provided to the Encryptors.delux() to be stored somewhere safe. Also, you also want to use a different way of generating a salt for your password (potentially a salt for each new password encryption) and storing it for later where you want to decrypt your password.

Also, you might want to not keep the password in plain text (String), but keeping it as char[] or byte[], but this should give a start from where you can start.

There is also a different library that does the same, from Apache, Apache Commons Crypto, which does utilize the same algorithms as Spring Crypto.

Keep in mind, you are more safe in using a library instead of implementing yourself, since using package javax.crypto will require you to know what you are doing and not do more harm than needed.

Side note: You might bump into the situation that your jdk is limited to 128 bits. To benefit from the 256bits, make sure you add the Java Cryptography Extension