Nabble - Jasypt

Re: can't query encrypted hibernate field

2009-12-10T17:56:05Z

+------------------------+
Jasypt Users List
http://www.jasypt.org
+------------------------+
Allan or anybody else,

I actually ran into the problem that you describe below just now.
However, there is one twist - I was hoping to get around the problem
by using a fixed salt instead of a random salt. This is still a
security improvement over storing it in plaintext (especially for my
particular needs), yet, I hoped, would still allow me to use the field
in a WHERE clause.

I'm working with Hibernate, so I'm declaring the encryption in my
Hibernate mapping file, and using a registered encryptor with a fixed
salt that I set up in my startup listener.

The problem I've come across though is that when I try to construct a
HQL query like:
......createQuery("from MyObject where encryptedField = :VAL");
I can't set VAL to be equal to the plaintext that I'm searching for...
because it will keep the plaintext and search for matches on the
encrypted text, which of course it won't find.

Is there any easy way to configure the mapping to enable searches like
this (either by decrypting encryptedField first, or encrypting :VAL
first every time)? Or do I need to programmatically encrypt the
plaintext value every time, before plugging it into HQL queries like
this?

Thanks for any pointers!
Stephen

On Mon, Nov 30, 2009 at 5:47 AM, Allan Lang <lang.allan@...> wrote:

> +------------------------+
> Jasypt Users List
> http://www.jasypt.org
> +------------------------+
>
> As per http://www.jasypt.org/hibernate3.html note that you cannot search on
> an encrypted field:
>
> "...encryption sets a limitation on your Hibernate usage: security standards
> establish that two different encryption operations on the same data should
> not return the same value (due to the use of a random salt). Because of
> this, none of the fields that are set to be encrypted when persisted can be
> a part of a WHERE clause in your search queries for the entity they belong
> to."
>
> You probably need to drop the password from the WHERE clause, and instead
> apply checkPassword() of BasicPasswordEncryptor (or similar) to the result
> row(s?) which are returned.
>
> Hope this helps,
> Allan
>
>
> offbyone wrote:
>>
>> I am using spring 2.5 + hibernate 3. I am trying to encrypt my user
>> password field. I set up an encryptor in spring as such:
>> <bean id="hibernateStringEncryptor"
>>
>> class="org.jasypt.hibernate.encryptor.HibernatePBEStringEncryptor">
>> <property name="registeredName">
>> <value>strongHibernateStringEncryptor</value>
>> </property>
>> <property name="algorithm">
>> <value>PBEWithMD5AndTripleDES</value>
>> </property>
>> <property name="password">
>> <value>mypassword</value>
>> </property>
>> </bean>
>>
>> In my user class mapping I have the following:
>> <hibernate-mapping auto-import="true">
>> <typedef name="encryptedString"
>> class="org.jasypt.hibernate.type.EncryptedStringType">
>> strongHibernateStringEncryptor
>> </typedef>
>> .
>> <class name="User" table="USERS">
>> <id access="field" column="id" name="id" type="int"
>> unsaved-value="-1">
>> <generator class="sequence">
>> SEQ_USERS
>> </generator>
>> </id>
>> <property column="USERNAME" name="username" not-null="true"
>> type="string"/>
>> <property column="PASSWORD" name="password" not-null="true"
>> type="encryptedString"/>
>>
>>
>> When I create a new user, the password is properly encrypted. I can also
>> query users via load or through the object map and I tested that the
>> password is being decrypted.
>>
>> ***However, I can not query a user using the password field:
>>
>> String query = "select user from User user where active=? and
>> username=? and password=?";
>> List results = getHibernateTemplate().find(query, new
>> Object[]{true, userName, password});
>>
>> I get no results whenever I query using the encrypted field. What am I
>> doing wrong?
>> thanks
>> -ryan
>>
>
> --
> View this message in context: http://old.nabble.com/can%27t-query-encrypted-hibernate-field-tp24099606s21332p26572616.html
> Sent from the Jasypt - Users mailing list archive at Nabble.com.
>
>
> ------------------------------------------------------------------------------
> Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
> trial. Simplify your report design, integration and deployment - and focus on
> what you do best, core application coding. Discover what's new with
> Crystal Reports now. http://p.sf.net/sfu/bobj-july
> _______________________________________________
> jasypt-users mailing list
> jasypt-users@...
> https://lists.sourceforge.net/lists/listinfo/jasypt-users
>

------------------------------------------------------------------------------
Return on Information:
Google Enterprise Search pays you back
Get the facts.
http://p.sf.net/sfu/google-dev2dev
_______________________________________________
jasypt-users mailing list
jasypt-users@...
https://lists.sourceforge.net/lists/listinfo/jasypt-users

Nabble - Jasypt

Re: can't query encrypted hibernate field

Re: Spring Security 3.x / Patch

Re: Spring Security 3.x / Patch

HELP! Portability of text encrypted with BasicTextEncryptor

How to use jasypt+spring+c3p0

Operation not possible (Bad input or parameters)

How to use jasypt+spring+c3p0

Re: can't query encrypted hibernate field

Re: Jasypt + Hibernate3 integration + decrypt

Re: Spring Security 3.x / Patch

Re: Spring Security 3.x / Patch

Re: Spring Security 3.x / Patch

SHA-1 SecretKeyFactory not available

Spring Security 3.x / Patch

Re: Spring with Jasypt - Decryption not working

Re: Spring with Jasypt - Decryption not working

Re: cannot find my registered string encryptor

cannot find my registered string encryptor

MD5 issue 1: how to increase interations without impact on the existing

How to encrypt/decrypt creditcard numbers in a database?

NoClassDefFoundError displayed when running encrypt.sh

Decrypting Jasypt PBE encrypted data in a windows app

Re: Database encryption and fields/columns that need to be decrypted

Database encryption and fields/columns that need to be decrypted

HMAC support

using jasypt salt and storing the salt in the db

Re: (no subject)

Re: (no subject)

Re: (no subject)

Re: (no subject)

(no subject)

Jasypt used with Java binding in eXist

Running on AS400 Java1.4 - Jasypt - ExceptionInInitializerError

Re: Encryption using command line

[SOLVED] Encryption using command line