Servlets 在WebApp中加密密码

我正在使用JavaEE（servlet+JSP）开发一个WebApp

当我想在我的应用程序中写入一些密码（如SMTP密码）时，我发现了一个问题。当我调试的时候，我已经用普通的代码或者属性文件编写了它，但是我想以某种方式对它们进行加密

我在开发阶段所做的工作：

private static final String SMTP_PASS = "my_pass";

我怎么能这么做？有什么想法/例子吗

private static final String SMTP_PASS = "my_pass_identifier"; //here my_pass_identifier is not the actual password its just an identifier to identify the SMTP password

创建一个属性文件，用于以密钥/值对的加密形式存储密码。注意：您可以使用下面提到的EncryptDecrypt类加密密码，并在属性文件中传递加密密码

SMTP_PASS = nPDHgg/DYzcL2+HsvYZruw==javaxMQyYxBZUsf7c0gh+vkisQA==javax0w+9tvuLzY04TA5FyTVSPw==

public class CredentialUtilities {
    static PasswordEncrypt pe = new PasswordEncrypt();
    public static String  getCredentials(String identifier) throws Exception{

        String credential = "";
        Properties prop = new Properties();
        InputStream input = null;

        try {
           String filename = "password.properties";
            input = CredentialUtilities.class.getClassLoader().getResourceAsStream(filename);
            prop.load(input);
            String property = prop.getProperty(identifier);
            credential = pe.decrypt(property); 
        } catch (IOException ex) {
            ex.printStackTrace();
        } finally{
            if(input!=null){
                try {
                input.close();
            } catch (IOException e) {
                e.printStackTrace();
            }
            }
        }
        return credential;

    }
}

创建一个类CredentialUtilities，该类将通过读取password.properties文件来解密密码

SMTP_PASS = nPDHgg/DYzcL2+HsvYZruw==javaxMQyYxBZUsf7c0gh+vkisQA==javax0w+9tvuLzY04TA5FyTVSPw==

public class CredentialUtilities {
    static PasswordEncrypt pe = new PasswordEncrypt();
    public static String  getCredentials(String identifier) throws Exception{

        String credential = "";
        Properties prop = new Properties();
        InputStream input = null;

        try {
           String filename = "password.properties";
            input = CredentialUtilities.class.getClassLoader().getResourceAsStream(filename);
            prop.load(input);
            String property = prop.getProperty(identifier);
            credential = pe.decrypt(property); 
        } catch (IOException ex) {
            ex.printStackTrace();
        } finally{
            if(input!=null){
                try {
                input.close();
            } catch (IOException e) {
                e.printStackTrace();
            }
            }
        }
        return credential;

    }
}

创建一个将为您加密/解密密码的类

import java.security.NoSuchAlgorithmException;
import java.util.Base64;
import java.util.HashMap;
import java.util.Map;

import javax.crypto.Cipher;
import javax.crypto.KeyGenerator;
import javax.crypto.SecretKey;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;

public class EncryptDecrypt {
    public static String ALGORITHM = "AES";
    private static String AES_CBS_PADDING = "AES/CBC/PKCS5Padding";
    private static int AES_128 = 128;


    private static byte[] encryptDecrypt(final int mode, final byte[] key, final byte[] IV, final byte[] message)
            throws Exception {
        final Cipher cipher = Cipher.getInstance(AES_CBS_PADDING);
        final SecretKeySpec keySpec = new SecretKeySpec(key, ALGORITHM);
        final IvParameterSpec ivSpec = new IvParameterSpec(IV);
        cipher.init(mode, keySpec, ivSpec);
        return cipher.doFinal(message);
    }

    public static Map<String, SecretKey> keyGenerator() throws NoSuchAlgorithmException{
        Map<String, SecretKey> map = new HashMap<String, SecretKey>();
         KeyGenerator keyGenerator = KeyGenerator.getInstance(EncryptDecrypt.ALGORITHM);
         keyGenerator.init(AES_128);
         SecretKey key = keyGenerator.generateKey();
         map.put("key", key);
         SecretKey IV = keyGenerator.generateKey();
         map.put("iv", IV);
         return map;

    }


    public static String encrypt(String message) throws Exception{
        Map<String , SecretKey> map = keyGenerator();
        SecretKey key = map.get("key");
        SecretKey IV = map.get("iv");
        byte[] cipherText = encryptDecrypt(Cipher.ENCRYPT_MODE, key.getEncoded(), IV.getEncoded(), message.getBytes());
        String encrypted_message =  Base64.getEncoder().encodeToString(cipherText);
        String encodedKey = Base64.getEncoder().encodeToString(map.get("key").getEncoded());
        String encodedIV = Base64.getEncoder().encodeToString(map.get("iv").getEncoded());

        return encrypted_message+"javax"+encodedIV+"javax"+encodedKey;



    }

    public static String decrypt(String encryptedMessage) throws Exception{
        String[] result = encryptedMessage.split("javax");
        byte[] decodedIV = Base64.getDecoder().decode(result[1]);
        byte[] decodedKey = Base64.getDecoder().decode(result[2]);
        byte[] cipher_text = Base64.getDecoder().decode(result[0]);
        SecretKey IV = new SecretKeySpec(decodedIV, 0, decodedIV.length, "AES");
        SecretKey key = new SecretKeySpec(decodedKey, 0, decodedKey.length, "AES");    
        byte[] decryptedString = encryptDecrypt(Cipher.DECRYPT_MODE, key.getEncoded(), IV.getEncoded(), cipher_text);
        String decryptedMessage = new String(decryptedString);
        return decryptedMessage;

    }


    public static void main(String[] args) throws Exception {
        EncryptDecrypt cu = new EncryptDecrypt();
        String encryptedmessage =  cu.encrypt("usrpswd");
        System.out.println(encryptedmessage);
        String decryptedMessage = cu.decrypt(encryptedmessage);
        System.out.println(decryptedMessage);
    }

}

---

加密密码只不过是踢了踢易拉罐；现在您必须保护加密密钥而不是密码。你想保护什么？加密真的解决了这个问题吗？A有一些建议。但说到这里，@Peter让它在某种程度上改变了问题。像AWS这样的服务有更好的管理方法，但最终你需要明文密码。@Peter问题是。。。我必须把我的SMTP密码放在任何地方，那么，在哪里写下它是最好的？Rajendra Gupta，你知道如何提高算法的安全性吗？它是128位，如果我修改数量，它会抛出错误。