Welcome!

Industrial IoT Authors: Carmen Gonzalez, Elizabeth White, William Schmarzo, Yeshim Deniz, Liz McMillan

Related Topics: Java IoT, Industrial IoT, Microservices Expo, IoT User Interface, Apache, Cloud Security

Java IoT: Article

Designing a Java Cryptography Header

Encrypt personal files, exchange confidential messages and authenticate the sender

Designing and implementing a hybrid encryption application is a big challenge but without a supporting infrastructure it's almost impossible. There are open source libraries that allow you to encrypt a file but only provide the translation technique. After the information has been encrypted, how do you know what algorithm was used, who you encrypted it, what version did you used, etc. In order to decrypt the protected message or file, a well-defined cryptographic header provides all the information required. This also applies if the encrypted data is digitally signed and the recipient wants to validate the signature.

This article will address one of the critical components of a support infrastructure by providing a design of a cryptographic header used to precede encrypted and/or digitally signed messages and files. The header is used within an application known as DocuArmor that was written using Java and the Cryptography library from the BouncyCastle organization and designed by Logical Answers Inc. The header will store information used when encrypting and/or digitally signing a message or file and allow the recipient to decrypt the information and/or verify the digital signature. With a properly designed header, a person can encrypt their personal files as well as exchange confidential messages and authenticate the sender.

Hybrid Encryption
In order to encrypt personal files and exchange protected data, we use a hybrid technique with two types of encryption, symmetric and asymmetric.

Symmetric encryption uses a single key to hide the message and reveal the message. There are several symmetric algorithms available such as AES (the Advanced Encryption Standard) but the important thing to remember is that the file can be encrypted and decrypted using the same key. An example is the Caesar cipher that shifts the letters of the alphabet by a specific number. If the shift is 2 (single key) then we get the following translation; a=c, b=d, c=e, ..., z=b.

Asymmetric encryption uses a pair of keys (public, private) to hide and reveal the message and the RSA algorithm is most commonly used. The RSA algorithm was credited in 1977 to Ronald Rivest, Adi Shamir, and Leonard Adleman. Sometimes referred to as Public Key Infrastructure (PKI), the pubic key is used to encrypt data and the private key is used to decrypt data.

Figure 1: Public and Private Key Functions

The hybrid technique uses the symmetric key to encrypt a file. The asymmetric public key is used to encrypt the symmetric key and is placed in the header. When the recipient receives an encrypted file, the encrypted symmetric key is extracted from the header. The encrypted symmetric key is decrypted using the private key. The file is decrypted using the symmetric key.

The same pair of keys can be used with digital signatures. The private key is used to generate a digital signature from a file and inserted into the header. The public key is used to verify the authenticity of the signature.

When two people want to exchange encrypted files, they each generate a pair of asymmetric keys and exchange a copy of their public keys. By using the other person's public key, they can encrypt a file, storing the cryptographic information in the header and then e-mail it to the recipient. The recipient will use the header to extract a symmetric key with their private key and decrypt the accompanying file. If a digital signature is included, the recipient can authenticate the sender.

Figure 2: Exchange of Encrypted Files

Cryptographic Header
When a file is encrypted, digitally signed or both, a Cryptographic header is placed in front of the resulting file and has the following structure. The structure consists of two sections, the header and the encrypted/plain file contents.

Figure 3: Encrypted File Structure

The header structure contains information required to reverse the encryption process and decrypt the contents of the file or verify the digital signature. The header contains the total length, an ID, version, and two sections containing encryption and digital signature information. Using Java, you can write out the contents of header within a byte stream as well as read it back in.

Figure 4: Cryptographic Header Structure

  • Total Len: Contains the total length of the header (stored as a 4 byte integer)
  • Header ID: Contains the string "LAHEADER" to identify the file (16 bytes)
  • Header Version: Structural version of the header (stored as a 4 byte integer)
  • Encryption Information: Holds the algorithm, mode, encrypted symmetric key, etc.
  • Digital Signature Information: Holds digital signature

Encryption Information
The Encryption Information structure contains information that was used to encrypt the contents of the file and later decrypt the file. The symmetric key and initialization vector is encrypted with the recipient's asymmetric public key. The recipient could be the owner if you are encrypting a file for yourself or another user you want to send confidential information to.

An additional field has been allocated to allow the encryption of the symmetric key with another set of asymmetric keys. For example, if owner A is sending an encrypted file to another person B, the symmetric key can be encrypted with B's public key as well as A's public key so that either person can decrypt the file.

Alternatively, an employee can encrypt a file with their public key and a corporation could insert an encrypted symmetric key into the header using their asymmetric keys. The corporation's asymmetric keys can be a Certifying Authority (CA), which can be used to issue employee keys.

Figure 5: Encryption Information Structure

  • Encrypt Flag: (Y/N - 2 bytes) specifies whether the file is encrypted.
  • Decrypt ID Length: (integer - 4 bytes) length in chars(bytes) of the Key ID.
  • Decrypt ID: (size varies) an identifier of the RSA keys used in the encryption/decryption process. It is the alias associated to the asymmetric encryption keys (e.g., JaneDoe_12ff).
  • Other Decrypt ID Length: (integer - 4 bytes) length in chars(bytes) of the Key ID.
  • Other Decrypt ID: (size varies) an identifier of the RSA keys used in the encryption/decryption process. It can be the alias or the common name (e.g., JaneDoe_12ff or Logical Answers CA).
  • Symmetric Key Algorithm: (integer - 4 bytes) specifies the symmetric key algorithm used to encrypt the file. The default value is 1=AES.
  • Symmetric Key Mode: (integer - 4 bytes) specifies the symmetric key block cipher mode used to enhance confidentiality. The default value is 5=Segmented Integer Counter mode (CTR).
  • Symmetric Key Padding: (integer - 4 bytes) specifies the type of padding for block cipher. The default value is 1=No Padding
  • Wrapped Symmetric Key Length: (integer - 4 bytes)
  • Wrapped Symmetric Key: (size varies) symmetric key used to encrypt/decrypt the file and encrypted with the asymmetric key.
  • Initialization Vector Length: (integer - 4 bytes)
  • Initialization Vector: (byte[] - size varies) vector used with the symmetric encryption process.
  • Other Wrapped Symmetric Key Length: (integer - 4 bytes)
  • Other Wrapped Symmetric Key: (size varies) symmetric key used to encrypt/decrypt the file and encrypted with another person's asymmetric key.
  • Other Initialization Vector Length: (integer - 4 bytes)
  • Other Initialization Vector: (byte[] - size varies) vector used with the symmetric encryption process.

Digital Signature Information
The Digital Signature Information structure contains information used to add or verify a digital signature generated from the contents of the file. The digital signature is generated with the owner's private key using a specific algorithm and then inserted into the header. When the recipient receives the signed file, they can use the signer's public key to validate its authenticity. If the signature is authenticated, it implies the file has not been altered and the holder of the private key generated the signature.

Figure 6: Digital Signature Information Structure

  • Signed Flag: (Y/N - 2 bytes) specifies whether the file contains a digital signature
  • Signature Algorithm: (integer - 4 bytes) specifies the algorithm used to generate the digital signature. The default value is 12= SHA512WithRSAEncryption
  • Verify Signature Cert Name Length: (integer - 4 bytes) length in chars(bytes) of the filename of the certificate used to verify a digital signature
  • Verify Signature Cert Name: (size varies) filename of the certificate holding the RSA public key used to verify the digital signature of a file (e.g., JaneDoe_fa39.cer).
  • Signature Date/Time: (long - 8 bytes) date the digital signature was generated.
  • Signature Length: (integer - 4 bytes)
  • Signature: (size varies) holds digital signature generated with RSA private key and signature engine

File Naming Conventions
The Cryptographic header holds information that designates which keys were used to encrypt a file but it's not physically accessible without reading it in first. With proper naming conventions, you can determine who the intended recipient is for encrypted files - whether it is for yourself or a colleague. When you generate your pair of asymmetric encryption keys using Java, store them in a file called a key store. The key store holds a pair of asymmetric keys as an entry with a unique alias. The alias typically consists of the initial of your first name and your last name. To make it more unique, you can extract 4 hex digits from your public key and append an underline and the hex digits to the alias. For example, if the person's name was Jane Smith, then the resulting unique alias would be jsmith_ad5e. A certificate holds a person's public key and the alias would be used in the filename, as jsmith_ad5e.cer. Similarly, the key store holding the pair of asymmetric keys would be saved as, jsmith_ad5e.jks.

Following the unique alias analogy, Jane Smith could encrypt files for herself and the file name would be appended with her alias and an appropriate file extension. For example, if Jane encrypted a personal file, myTaxes.txt, then the result would be myTaxes.txt.jsmith_ad5e.aes. If Jane wanted to send her colleague Dick an encrypted document, she would use Dick's certificate to encrypt it. If Dick's certificate is djones_9fa2, Jane could encrypt the file, comments.doc, for Dick and the resulting file would be comments.doc.djones_9fa2.aes. When Dick receives the file, he knows it is for him by recognizing his alias on the file name.

The unique alias is stored within the header. This reinforces the importance of having a well-defined Cryptographic header for implementing encryption within your applications.

Benefits
A well-defined cryptographic header stores the information required to encrypt, decrypt and digitally sign a file. Along with facilitating the implementation of standard cryptographic functions, the header also provides the following benefits:

  • The header allows for the protection of personal files as well as the exchange of confidential data.
  • Using the stored digital signature, the recipient can determine if the sender is valid and whether file has been altered.
  • The header allows either the sender or recipient to decrypt the encrypted file since both would encrypt the symmetric key with their public key.
  • Using the concept of a Certifying Authority pair of asymmetric keys, a corporation, group, or family could issue pairs of asymmetric keys to their employees or members and decipher files encrypted by them in case of emergencies.
  • The header allows for using different combinations of symmetric algorithms, modes, padding and key sizes to be used to encrypt information.
  • The header version allows for enhancements to be added to the structure for implementing new functions and still support older versions.

References and Other Technical Notes
Software requirements:

Recommended Reading:

  • "Beginning Cryptography with Java" by David Hook.
  • "The Code Book" by Simon Singh

More Stories By James H. Wong

James H. Wong has been involved in the technology field for over 30 years and has dual MS degrees in mathematics and computer science from the University of Michigan. He worked for IBM for almost 10 years designing and implementing software. Founding Logical Answers Corp in 1992, he has provided technical consulting/programming services to clients, providing their business with a competitive edge. With his partner they offer a Java developed suite of “Secure Applications” that protect client’s data using the standard RSA (asymmetric) and AES (symmetric) encryption algorithms.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


@ThingsExpo Stories
The Internet of Things will challenge the status quo of how IT and development organizations operate. Or will it? Certainly the fog layer of IoT requires special insights about data ontology, security and transactional integrity. But the developmental challenges are the same: People, Process and Platform and how we integrate our thinking to solve complicated problems. In his session at 19th Cloud Expo, Craig Sproule, CEO of Metavine, demonstrated how to move beyond today's coding paradigm and sh...
What happens when the different parts of a vehicle become smarter than the vehicle itself? As we move toward the era of smart everything, hundreds of entities in a vehicle that communicate with each other, the vehicle and external systems create a need for identity orchestration so that all entities work as a conglomerate. Much like an orchestra without a conductor, without the ability to secure, control, and connect the link between a vehicle’s head unit, devices, and systems and to manage the ...
Financial Technology has become a topic of intense interest throughout the cloud developer and enterprise IT communities. Accordingly, attendees at the upcoming 20th Cloud Expo at the Javits Center in New York, June 6-8, 2017, will find fresh new content in a new track called FinTech.
"We're a cybersecurity firm that specializes in engineering security solutions both at the software and hardware level. Security cannot be an after-the-fact afterthought, which is what it's become," stated Richard Blech, Chief Executive Officer at Secure Channels, in this SYS-CON.tv interview at @ThingsExpo, held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.
"Once customers get a year into their IoT deployments, they start to realize that they may have been shortsighted in the ways they built out their deployment and the key thing I see a lot of people looking at is - how can I take equipment data, pull it back in an IoT solution and show it in a dashboard," stated Dave McCarthy, Director of Products at Bsquare Corporation, in this SYS-CON.tv interview at @ThingsExpo, held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.
Everyone knows that truly innovative companies learn as they go along, pushing boundaries in response to market changes and demands. What's more of a mystery is how to balance innovation on a fresh platform built from scratch with the legacy tech stack, product suite and customers that continue to serve as the business' foundation. In his General Session at 19th Cloud Expo, Michael Chambliss, Head of Engineering at ReadyTalk, discussed why and how ReadyTalk diverted from healthy revenue and mor...
Whether your IoT service is connecting cars, homes, appliances, wearable, cameras or other devices, one question hangs in the balance – how do you actually make money from this service? The ability to turn your IoT service into profit requires the ability to create a monetization strategy that is flexible, scalable and working for you in real-time. It must be a transparent, smoothly implemented strategy that all stakeholders – from customers to the board – will be able to understand and comprehe...
SYS-CON Events has announced today that Roger Strukhoff has been named conference chair of Cloud Expo and @ThingsExpo 2017 New York. The 20th Cloud Expo and 7th @ThingsExpo will take place on June 6-8, 2017, at the Javits Center in New York City, NY. "The Internet of Things brings trillions of dollars of opportunity to developers and enterprise IT, no matter how you measure it," stated Roger Strukhoff. "More importantly, it leverages the power of devices and the Internet to enable us all to im...
The Internet of Things (IoT) promises to simplify and streamline our lives by automating routine tasks that distract us from our goals. This promise is based on the ubiquitous deployment of smart, connected devices that link everything from industrial control systems to automobiles to refrigerators. Unfortunately, comparatively few of the devices currently deployed have been developed with an eye toward security, and as the DDoS attacks of late October 2016 have demonstrated, this oversight can ...
You have great SaaS business app ideas. You want to turn your idea quickly into a functional and engaging proof of concept. You need to be able to modify it to meet customers' needs, and you need to deliver a complete and secure SaaS application. How could you achieve all the above and yet avoid unforeseen IT requirements that add unnecessary cost and complexity? You also want your app to be responsive in any device at any time. In his session at 19th Cloud Expo, Mark Allen, General Manager of...
More and more brands have jumped on the IoT bandwagon. We have an excess of wearables – activity trackers, smartwatches, smart glasses and sneakers, and more that track seemingly endless datapoints. However, most consumers have no idea what “IoT” means. Creating more wearables that track data shouldn't be the aim of brands; delivering meaningful, tangible relevance to their users should be. We're in a period in which the IoT pendulum is still swinging. Initially, it swung toward "smart for smar...
"ReadyTalk is an audio and web video conferencing provider. We've really come to embrace WebRTC as the platform for our future of technology," explained Dan Cunningham, CTO of ReadyTalk, in this SYS-CON.tv interview at WebRTC Summit at 19th Cloud Expo, held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.
Bert Loomis was a visionary. This general session will highlight how Bert Loomis and people like him inspire us to build great things with small inventions. In their general session at 19th Cloud Expo, Harold Hannon, Architect at IBM Bluemix, and Michael O'Neill, Strategic Business Development at Nvidia, discussed the accelerating pace of AI development and how IBM Cloud and NVIDIA are partnering to bring AI capabilities to "every day," on-demand. They also reviewed two "free infrastructure" pr...
WebRTC is the future of browser-to-browser communications, and continues to make inroads into the traditional, difficult, plug-in web communications world. The 6th WebRTC Summit continues our tradition of delivering the latest and greatest presentations within the world of WebRTC. Topics include voice calling, video chat, P2P file sharing, and use cases that have already leveraged the power and convenience of WebRTC.
As data explodes in quantity, importance and from new sources, the need for managing and protecting data residing across physical, virtual, and cloud environments grow with it. Managing data includes protecting it, indexing and classifying it for true, long-term management, compliance and E-Discovery. Commvault can ensure this with a single pane of glass solution – whether in a private cloud, a Service Provider delivered public cloud or a hybrid cloud environment – across the heterogeneous enter...
"At ROHA we develop an app called Catcha. It was developed after we spent a year meeting with, talking to, interacting with senior citizens watching them use their smartphones and talking to them about how they use their smartphones so we could get to know their smartphone behavior," explained Dave Woods, Chief Innovation Officer at ROHA, in this SYS-CON.tv interview at 19th Cloud Expo, held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.
SYS-CON Events announced today that Fusion, a leading provider of cloud services, will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Fusion, a leading provider of integrated cloud solutions to small, medium and large businesses, is the industry’s single source for the cloud. Fusion’s advanced, proprietary cloud service platform enables the integration of leading edge solutions in the cloud, including cloud...
Video experiences should be unique and exciting! But that doesn’t mean you need to patch all the pieces yourself. Users demand rich and engaging experiences and new ways to connect with you. But creating robust video applications at scale can be complicated, time-consuming and expensive. In his session at @ThingsExpo, Zohar Babin, Vice President of Platform, Ecosystem and Community at Kaltura, discussed how VPaaS enables you to move fast, creating scalable video experiences that reach your aud...
With major technology companies and startups seriously embracing IoT strategies, now is the perfect time to attend @ThingsExpo 2016 in New York. Learn what is going on, contribute to the discussions, and ensure that your enterprise is as "IoT-Ready" as it can be! Internet of @ThingsExpo, taking place June 6-8, 2017, at the Javits Center in New York City, New York, is co-located with 20th Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry p...
In his keynote at 18th Cloud Expo, Andrew Keys, Co-Founder of ConsenSys Enterprise, provided an overview of the evolution of the Internet and the Database and the future of their combination – the Blockchain. Andrew Keys is Co-Founder of ConsenSys Enterprise. He comes to ConsenSys Enterprise with capital markets, technology and entrepreneurial experience. Previously, he worked for UBS investment bank in equities analysis. Later, he was responsible for the creation and distribution of life sett...