This section will teach you about the tools jasypt offers you when the easy utilities found in the easy usage page are not enough for your needs.
Digesters are classes specialised in creating message digests (also called hashes) from input.
Message digests are the results of digest (or hash) functions, and they are unidirectional, this is, starting from a message digest, the original message cannot be reconstructed.
Because of this, message digests are very adequate for password encryption. In fact, in some countries, it is illegal to store a user's password in an unencrypted way, and even encrypted in a reversible (bi-directional) way.
Digesters in jasypt live in the org.jasypt.digest package, which is composed of the following interfaces:
And the following standard implementations:
...with their corresponding pool-based implementations for high performance in multi-processor/multi-core systems:
Using them can be very simple:
...
StandardStringDigester digester = new StandardStringDigester();
digester.setAlgorithm("SHA-1"); // optionally set the algorithm
digester.setIterations(50000); // increase security by performing 50000 hashing iterations
...
String digest = digester.digest(myMessage);
...These digesters, both standard and pooled, implement a coherent and secure set of default configuration values, but they can be additionally configured in two ways:
Improving performance in multi-processor/multi-core systems
Pooled digesters have exactly the same API as their non-pooled Standard relatives --so they can be used interchangeably-- but add a new required configuration method called setPoolSize() which establishes the amount of standard digesters they will internally hold.
...
PooledStringDigester digester = new PooledStringDigester();
digester.setPoolSize(4); // This would be a good value for a 4-core system
digester.setAlgorithm("SHA-1");
digester.setIterations(50000);
...
String digest = digester.digest(myMessage);
...These pooled objects will use their internal Standard* digesters to serve the requests in round-robin, so the amount of thread blocking caused by the synchronised code in the standard artifacts is reduced to a minimum.
These implementations do not create new threads, so they can be safely used in container-controlled environments which do not allow the creation of new threads.
The pool size recommended for a specific application and machine depends on many factors, but will be approximately equal to the number of processors/cores in the machine.
More info
Please refer to the JavaDoc for more information about usage and functionality.
Encryptors are classes specialised in performing bi-directional encryption operations. This is, they can both encrypt plain data and decrypt encrypted data.
The relevant interfaces for encryption in jasypt live in the org.jasypt.encryption package, and are:
Jasypt provides implementations for one type of encryption: Password-Based Encryption (PBE).
Password-Based encryption is performed by means of generating an encryption key from a user-supplied password, and feeding an encryption algorithm with both the input and the generated key. Keys are usually obtained by applying some hash function to the password.
So, all PBE encryptors in jasypt will need to be set a password before being used for encryption or decryption operations.
The relevant interfaces for PBE in jasypt live in the org.jasypt.encryption.pbe package, and are:
And the following standard implementations:
...with their corresponding pool-based implementations for high performance in multi-processor/multi-core systems:
It's basic usage can be very simple:
...
StandardPBEStringEncryptor encryptor = new StandardPBEStringEncryptor();
encryptor.setPassword("jasypt"); // we HAVE TO set a password
encryptor.setAlgorithm("PBEWithHMACSHA512AndAES_256"); // optionally set the algorithm
encryptor.setIvGenerator(new RandomIvGenerator()); // for PBE-AES-based algorithms, the IV generator is MANDATORY
...
String encryptedText = encryptor.encrypt(myText);
...
String plainText = encryptor.decrypt(encryptedText); // myText.equals(plainText)
...As with digesters, Standard*Encryptors implement a coherent and secure set of default configuration values (except for the password), but they can also be additionally configured in two ways:
Improving performance in multi-processor/multi-core systems
Pooled encryptors have exactly the same API as their non-pooled Standard relatives --so they can be used interchangeably-- but add a new required configuration method called setPoolSize() which establishes the amount of standard encryptors they will internally hold.
...
PooledPBEStringEncryptor encryptor = new PooledPBEStringEncryptor();
encryptor.setPoolSize(4); // This would be a good value for a 4-core system
encryptor.setPassword("jasypt");
encryptor.setAlgorithm("PBEWithMD5AndTripleDES");
...
String encryptedText = encryptor.encrypt(myText);
...These pooled objects will use their internal Standard* encryptors to serve the requests in round-robin, so the amount of thread blocking caused by the synchronised code in the standard artifacts is reduced to a minimum.
These implementations do not create new threads, so they can be safely used in container-controlled environments which do not allow the creation of new threads.
The pool size recommended for a specific application and machine depends on many factors, but will be approximately equal to the number of processors/cores in the machine.
More info
Please refer to the JavaDoc for more information about usage and functionality.