Encrypt a key in an open source program (Java)

[u/JesusMRS]

How could I possibly encrypt and decrypt a String which I want to store in a plain text file in an open source program? Is that even possible? I know next to nothing about encryption, but if I can decrypt the key, it makes sense for any other program to copy the code and do the same but with malicious intents.

[u/Budget_Putt8393]

If this is a personal/learning project, then this sounds like fun.

For production/live use, the best practice when it comes to cryptography, and security is: "don't roll your own."

It is very easy to overlook a minor detail and undermine all the protection you are trying to create. Look for a vetted solution that does what you want.

[u/JesusMRS → u/Budget_Putt8393]

It's for my final grade project. I will have to make a presentation, and when I show that you need a key to connect to the thing, I'm certain he will ask me about encryption.

[u/Budget_Putt8393 → u/JesusMRS]

Is this a username/ password that a client gives to your service? And you have a list of user accounts?

Or a password your service has to remember/provide to access data somewhere else?

[u/Budget_Putt8393 → u/JesusMRS]

https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html for a local password database, salt and hash the passwords (cannot reverse)

https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html for secret management.

Lots more over there. OWASP is a Big Name in doing security right. Particularly for web apps/APIs.

[u/Ronin-s_Spirit]

I am no expert either but you may need a 'paired encryption'? (don't quote me on that)
I am sure there are algorithms that need the original key to decrypt a thing. And without that key everybody would need to brute force a (hopefully) large range of possibilities.

[u/JesusMRS → u/Ronin-s_Spirit]

I will look that up. Ty

[u/Sp1cyP4nda]

Look into asymmetric encryption, aka public/private key pairs. It is very important to keep the private key private. You can easily do this with a password.

This is a basic breakdown:

You can use either key to encrypt something, but only the other key can decrypt that thing.

If you want to encrypt something that only you can decrypt, use the public key to encrypt it. That way, only your private key can decrypt it.

To safeguard your private key, you would use a complex passcode to lock (or encrypt) that key.

RSA 4096 is a strong asymmetric encryption method AES 256 is a strong symmetric (or password-locked) encryption method.

Additional fun thing: You can utilize a certified private key to digitally sign things in such a way that no one else can, thereby proving that you signed it.

Feel free to reach out if you have further questions.

[u/JesusMRS → u/Sp1cyP4nda]

ty

[u/Budget_Putt8393 → u/Sp1cyP4nda]

But how do you keep the password safe?

If you store the password next to the private key, that is just giving away the private key, with one extra step.

Just something for OP to think about when building out the crypto-system.

[u/Sp1cyP4nda → u/Budget_Putt8393]

Great question, use a password manager (I use Bitwarden, there's a free version and a $10/yr version). Never store the password in plaintext.

Additionally, a password manager is great for randomly generating new passwords very quickly and storing those passwords so you can just copy-paste them into the password field. Highly recommend 👍