security - How do I import a raw AES key to a JCEKS keystore?

07
2014-07
  • Brian Clements

    I have some test data that is encrypted with 256 bit AES. The customer supplied the key as a 256 bit file. The application uses a java key store for decryption keys. The keytool options I've found only support generating new keys or importing them from another store. Is there any way to get this key in the store using keytool?

    • Answers
  • Brian Clements

    Looks like this isn't an option with keytool. But there is another program that can do it at http://code.google.com/p/keytool-iui


    • Related Question

    security - How to decrypt a file given the encryption key and the file but not the algorithm?
  • InvertedAcceleration

    I am trying to backup some files that have been encrypted by a 3rd party solution we use in work. I would like to back them up in their unencrypted state as our backup solution has robust encryption option. It's also worth noting that the files do not need the 3rd party software to be of use to us.

    The 3rd party solution has very little documentation on their encryption process but I have the key which is stored in the database that indexes the encrypted files. I also have access to the files which the databases references.

    The only problem is that I don't know what encryption algorithm the 3rd party company used to encrypt the data.

    Is there any technique I can use to determining the type of encryption used or is there a software tool that would allow me to easily try a number of different decryption routines and a set password?


    • Related Answers
  • Gilles

    The first thing I'd try is to dump the symbols on the application executable and look for likely words like “encrypt”, “AES”, etc. Given your description, they might have resorted to obfuscation, which by design makes your task a lot harder. Worst comes to worst, they've been stupid enough to design their own cryptographic algorithm!

    Note that even if you can determine the algorithm, that may not be enough. Many symmetric encryption algorithm use an initializatoin vector, and the manner in which the IV is chosen is not standard.

    If the simple ways to reverse engineer the application don't work, it may be easier to trick the application into not performing the encryption by hooking into it and bypassing the encryption code. In other words, if you don't find any simpler method than locating the part of the application than perform the encryption, it's likely to be easier to bypass that part than understand it.

  • PhantomAct

    If the key length is not a clue, then brute force decrypt using popular algorithms. Let's just hope salting wasn't used, otherwise bummer...