Configuring the Hibernate mapping

The Hibernate mapping file can be configured in two different ways:

1. By extension, declaring the encryptor parameters in the mapping itself (password, algorithm, providerName, etc). This is not very recommended (the mapping file does not seem like a right place for a password) but can be useful in some situations. When this method is selected, the encryptor implementation used is always a StandardPBEStringEncryptor.

     <hibernate-mapping package="myapp">
       ...
       <typedef name="encryptedString" class="org.jasypt.hibernate4.type.EncryptedStringType">
         <param name="algorithm">PBEWithMD5AndTripleDES</param>
         <param name="password">jasypt</param>
         <param name="keyObtentionIterations">1000</param>
       </typedef>
       ...
       <class name="UserData" table="USER_DATA">
         ...
         <property name="address" column="ADDRESS" type="encryptedString" />
         ...
       <class>
       ...
     <hibernate-mapping>

   Note: only "password" is a required parameter.
   If this configuration method is used, it is not necessary to provide an encryptor to Hibernate (like explained below).

2. By using a registered encryptor, which will be registered with a specific name. This way, all we will have to use in the mapping file is this name (encryptorRegisteredName).

     <hibernate-mapping package="myapp">
       ...
       <typedef name="encrypted" class="org.jasypt.hibernate4.type.EncryptedStringType">
         <param name="encryptorRegisteredName">strongHibernateStringEncryptor</param>
       </typedef>
       ...
       <class name="UserData" table="USER_DATA">
         ...
         <property name="address" column="ADDRESS" type="encrypted" />
         ...
       <class>
       ...
     <hibernate-mapping>

Providing the encryptor to Hibernate

If we have chosen to use the encryptorRegisteredName parameter in our Hibernate mapping file, we will need to bind somehow an encryptor object to that name. This can be done in two different manners, depending on whether we are using an IoC container like Spring or not.

Using this way of configuring encryption allows us to use pool-based versions of the encryptor (like org.jasypt.encryption.pbe.PooledPBEStringEncryptor), which will enhance performance in multi-processor/multi-core systems.

• Using Spring we simply need to create our encryptor, and then a HibernatePBEEncryptor object to wrap it and set a registered name for it:

    <bean id="strongEncryptor"
      class="org.jasypt.encryption.pbe.PooledPBEStringEncryptor">
      <property name="algorithm">
          <value>PBEWithMD5AndTripleDES</value>
      </property>
      <property name="password">
          <value>jasypt</value>
      </property>
      <property name="poolSize">
          <value>4</value>
      </property>
    </bean>
    
    <bean id="hibernateStringEncryptor"
      class="org.jasypt.hibernate4.encryptor.HibernatePBEStringEncryptor">
      <property name="registeredName">
          <value>strongHibernateStringEncryptor</value>
      </property>
      <property name="encryptor">
          <ref bean="strongEncryptor" />
      </property>
    </bean>

  Also, we can do it all in the hibernateStringEncryptor declaration, if we don't want to use the strongEncryptor outside of Hibernate and we are OK with the standard encryptor implementation. Also be aware that this approach uses a StandardPBEStringEncryptor instead of a pool-based one, and so performace could be affected in multi-processor systems:

    <bean id="hibernateStringEncryptor"
      class="org.jasypt.hibernate4.encryptor.HibernatePBEStringEncryptor">
      <property name="registeredName">
          <value>strongHibernateStringEncryptor</value>
      </property>
      <property name="algorithm">
          <value>PBEWithMD5AndTripleDES</value>
      </property>
      <property name="password">
          <value>jasypt</value>
      </property>
    </bean>

• Without Spring, we will have to use the HibernatePBEEncryptorRegistry singleton directly, registering our encryptor at application initialization like this (for example, inside a ServletContextListener for a webapp):

    StandardPBEStringEncryptor strongEncryptor = new StandardPBEStringEncryptor();
    ...
    HibernatePBEEncryptorRegistry registry =
        HibernatePBEEncryptorRegistry.getInstance();
    registry.registerPBEStringEncryptor("strongHibernateStringEncryptor", strongEncryptor);

Using annotations

Alternatively, we may have chosen to use annotations for mapping our entities instead of separate XML mapping files. If it has been so, we can still use jasypt to encrypt our data.

All we will have to do is, first, define the encryption type with a @TypeDef annotation, which could be either inside the persisted entity class or inside a @TypeDefs declaration in a separate package-info.java file:

@TypeDef(
    name="encryptedString", 
    typeClass=EncryptedStringType.class, 
    parameters= {
        @Parameter(name="encryptorRegisteredName", value="myHibernateStringEncryptor")
    }
)

...and then simply map our property with the already declared type:

    @Type(type="encryptedString")
    public String getAddress() {
        return address;
    }