I have a application need authentication to access another application's API, but the API's password  stored in the database was encrypted by 3DES algorithm in Java code. I can access the Key for decrypt the password.
So I had tried some different to get the clear password,
1. Ask for Plain text password
   I got it, for security reason, It can not be used in production.
2. Ask Java team to build a Java WebService  offer the decode service.
   It looks good plan, but need wait for other team's work, I already wait for 1 month.
3. Try to decrypt the password from .net side. 
   I tried, and just proved it not works. So I come here write down what I found.

The reason is simple: the byte array in java and byte in C# are different.
In Java, the byte  is 8 bit signature, value is from -127 to 128.
but in C# the byte is 8 bit non-signature, the correspond Java byte  in C# is sbyte.
I hard code the Key byte array to force all value of key's byte between 0-128 so c# and Java can have same Key.
But unlucky, the same short string "Hello Wei", in Java, the byte array length is 8. but in C# it is 16.

That obviously tell me it is impossible to share key between java and .net application to do de/encryption.

Here are some of my Java  and C# code I wrote in this research.
Java code have BlowFish and 3sdes.

BlowFishAPI.zip (4.16 KB) 
TripleDesFixture.cs (11.38 KB)

Some reference links;
blowfish in .net: http://www.hotpixel.net/software.html
TripleDes Encryption:  click here


 
Friday, 19 August 2011 04:59:22 (Eastern Daylight Time, UTC-04:00)
declaration watches replica tag heuer watches tag heuer Yu longines watches replica watch follies of others。 fake breitling watches replica breitling watches for sale dylan cartier replica fake cartier watches cartier tank watches replica omega replica omega watches rolex watches Sea replica rolex watches for sale rond louis watches.
Friday, 19 August 2011 05:15:59 (Eastern Daylight Time, UTC-04:00)
luxury watches replica cartier replica cartier watches replica omega replica omega replica watches fake rolex watches replica rolex deville watches However fake tag heuer watches tag heuer replica cartier tank watches watches replica gondolo watches zoey breitling replica fake breitling watches.
Comments are closed.