Information and Communication Technology Seminar, Vol. 1 No. 1, August 2005
ISSN 1858-1633 2005 ICTS 98
In the code after a Message Digest refactoring of Figure 9, new code fragments for creating a message
digest object and calculating the digest were inserted.
3.7. Convert Message with Private Key to Public Key
A message which is encrypted by using Private Key such as DES, AES, or Blowfish has a weakness.
The problem is: how to send the key to the receiver without a risk of information disclosure. Since Java
also allows for using Public Key for encryption, it is more secure to use Public Key to increase the security
level of our message.
Figure 9. Message Digest refactoring
Next are the principles of Public Key implementation [10].
• When a sender wants to send a secure message to the receiver, she needs to encrypt the message.
Therefore she does the encryption by using receiver public key and sends. The receiver could
use her private key to decrypt the message.
• The receiver also could do the same method to send message to the sender. It means the private
keys of the receiver and sender are never sent. • The third party could get the message and both
public keys but she will not be able to decrypt the message.
It opens opportunity to apply a refactoring to a method or class which is using private key to encrypt
a message. We could propose for using Public Key in order to increase the security level of the code.
Figure 10 and 11 show codes before and after applying a Convert Message refactoring.
before refactoring
this code read the plain text input but we assume that the programmer did not create any effort to protect the plain text.
public static void main String[ ] args throws Exception { get plain text from input
if args.length =1 { System.err.println“ Please provide the text parameter”;
System.exit1; }
byte [ ] plaintext = args[0].getBytes“UTF8”; }
after refactoring
MessageDigest function is added import java.security.;
import javax.crypto.; public static void main String[ ] args throws Exception {
get plain text from input if args.length =1 {
System.err.println“Please provide the text parameter”; System.exit1;
} byte [ ] plaintext = args[0].getBytes“UTF8”;
crete a message digest object by using the MD5 algorithm MessageDigest fingerprint = MessageDigest.getInstance“MD5”;
calculate the digest and print it out fingerprint.update plaintext;
System.out.println“\Digest: “; System.out.printlnnew String fingerprint.digest ,”UTF8”;
}
Security Concern Refactoring – Putu Ashintya Widhiartha Katsuhisa Maruyama
ISSN 1858-1633 2005 ICTS 99
figure 10 Convert Message refactoring in Encrypting a message.
Figure 11 Convert Message refactoring in Decrypting a message.
before refactoring
this is a class which is using DES private key for encryption of a message import java.security.;
import javax.crypto.; public class EncryptExample {
public static void mainString[ ] args throws Exception { get the plain text
if args.length =1 { System.err.println“Please provide the text”; System.exit1; }
byte[] MessageText = args [0].getBytes“UTF8”; get a DES key
KeyGenerator KeyGene = KeyGenerator.getInstance“DES”; KeyGene.init56;
Key kagi = KeyGene.generateKey ; Cipher cipher = Cipher.getInstance“DESECBPKCS5Padding”;
starting encryption cipher.initCipher.ENCRYPT_MODE, kagi;
byte[ ] cipherText = cipher.doFinalMessageText; System.out.printlnnew StringcipherText,”UTF8”;
} }
after refactoring this is a class which is using RSA public key for encryption of a message
import java.security.; import javax.crypto.;
public class EncryptExample { public static void mainString[ ] args throws Exception {
get the plain text if args.length =1 {
System.err.println“Please provide the text”; System.exit1;
} byte[] MessageText = args [0].getBytes“UTF8”;
get a RSA key KeyPairGenerator KeyGene = KeyPairGenerator.getInstance“RSA”;
KeyGene.initialize1024; KeyPair kagi = KeyGene.generateKeyPair ;
Cipher cipher = Cipher.getInstance“RSAECBPKCS1Padding”; starting encryption
cipher.initCipher.ENCRYPT_MODE, kagi.getPublic ; byte[ ] cipherText = cipher.doFinalMessageText;
System.out.printlnnew StringcipherText,”UTF8”; }
}
applying refactoring into decryption lines before refactoring
cipher.initCipher.DECRYPT_MODE,kagi; byte[] newMessageText = cipher.dofinalcipherText;
System.out.printlnnew StringnewMessageText, “UTF8”;
after refactoring
cipher.initCipher.DECRYPT_MODE,kagi.getPrivate; byte[] newMessageText = cipher.dofinalcipherText;
System.out.printlnnew StringnewMessageText, “UTF8”;
Information and Communication Technology Seminar, Vol. 1 No. 1, August 2005
ISSN 1858-1633 2005 ICTS 100
4. CURRENT STATUS
