Package org.springframework.security.crypto.encrypt

Class AesCbcBytesEncryptor

java.lang.Object

org.springframework.security.crypto.encrypt.AesCbcBytesEncryptor

All Implemented Interfaces:

BytesEncryptor

public final class AesCbcBytesEncryptor
extends Object
implements BytesEncryptor

BytesEncryptor that uses 256-bit AES/CBC/PKCS5Padding with a random 16-byte initialization vector. The IV is prepended to the ciphertext on encrypt and stripped on decrypt.

Note that CBC mode provides confidentiality but not integrity or authenticity. Applications that require authenticated encryption should prefer AesGcmBytesEncryptor. See the OWASP Cryptographic Storage Cheat Sheet for guidance on choosing a cipher mode.

When key derivation is used via withPassword(String, CharSequence), the key is derived using PBKDF2WithHmacSHA256 with DEFAULT_PBKDF2_ITERATIONS iterations per the OWASP Password Storage Cheat Sheet. Because derivation is intentionally expensive, the encryptor instance should be created once and reused rather than constructed per-operation.

Since:

5.7.26

See Also:

• AesGcmBytesEncryptor
• AesBytesEncryptor

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final class	AesCbcBytesEncryptor.Builder	A Builder for AesCbcBytesEncryptor.

Method Summary

Modifier and Type	Method	Description
byte[]	decrypt(byte[] encryptedBytes)	Decrypt the byte array.
byte[]	encrypt(byte[] bytes)	Encrypt the byte array.
static AesCbcBytesEncryptor.Builder	withPassword(String password, CharSequence salt)	Creates an encryptor that derives its key from the given password and hex-encoded salt using PBKDF2WithHmacSHA1.
static AesCbcBytesEncryptor.Builder	withSecretKey(SecretKey secretKey)	Creates an encryptor using the supplied SecretKey.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

withPassword

public static AesCbcBytesEncryptor.Builder withPassword(String password,
 CharSequence salt)

Creates an encryptor that derives its key from the given password and hex-encoded salt using PBKDF2WithHmacSHA1.

Parameters:

password - the password value

salt - the hex-encoded salt value

withSecretKey

public static AesCbcBytesEncryptor.Builder withSecretKey(SecretKey secretKey)

Creates an encryptor using the supplied SecretKey.

Parameters:

secretKey - the secret (symmetric) key

encrypt

public byte[] encrypt(byte[] bytes)

Description copied from interface: BytesEncryptor

Encrypt the byte array.

Specified by:

encrypt in interface BytesEncryptor

decrypt

public byte[] decrypt(byte[] encryptedBytes)

Description copied from interface: BytesEncryptor

Decrypt the byte array.

Specified by:

decrypt in interface BytesEncryptor