private AttachmentCipherInputStream(InputStream inputStream, byte[] cipherKey, long totalDataSize)
    throws IOException
{
  super(inputStream);

  try {
    byte[] iv = new byte[BLOCK_SIZE];
    readFully(iv);

    this.cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
    this.cipher.init(Cipher.DECRYPT_MODE, new SecretKeySpec(cipherKey, "AES"), new IvParameterSpec(iv));

    this.done          = false;
    this.totalRead     = 0;
    this.totalDataSize = totalDataSize;
  } catch (NoSuchAlgorithmException | InvalidKeyException | NoSuchPaddingException | InvalidAlgorithmParameterException e) {
    throw new AssertionError(e);
  }
}
 

public void runAll() throws InvalidKeyException,
        NoSuchPaddingException, InvalidAlgorithmParameterException,
        ShortBufferException, IllegalBlockSizeException,
        BadPaddingException, NoSuchAlgorithmException,
        NoSuchProviderException {

    for (String mode : MODES) {
        for (String padding : PADDINGS) {
            if (!isMultipleKeyLengthSupported()) {
                runTest(mode, padding, minKeySize);
            } else {
                int keySize = maxKeySize;
                while (keySize >= minKeySize) {
                    out.println("With Key Strength: " + keySize);
                    runTest(mode, padding, keySize);
                    keySize -= KEYCUTTER;
                }
            }
        }
    }
}
 

OutputStream createEncryptedOutputStream(@NonNull byte[] masterKey, @NonNull File file)
    throws IOException
{
  try {
    byte[] random = Util.getSecretBytes(32);
    Mac    mac    = Mac.getInstance("HmacSHA256");
    mac.init(new SecretKeySpec(masterKey, "HmacSHA256"));

    FileOutputStream fileOutputStream = new FileOutputStream(file);
    byte[]           iv               = new byte[16];
    byte[]           key              = mac.doFinal(random);

    Cipher cipher = Cipher.getInstance("AES/CTR/NoPadding");
    cipher.init(Cipher.ENCRYPT_MODE, new SecretKeySpec(key, "AES"), new IvParameterSpec(iv));

    fileOutputStream.write(MAGIC_BYTES);
    fileOutputStream.write(random);

    CipherOutputStream outputStream = new CipherOutputStream(fileOutputStream, cipher);
    outputStream.write(MAGIC_BYTES);

    return outputStream;
  } catch (NoSuchAlgorithmException | InvalidKeyException | NoSuchPaddingException | InvalidAlgorithmParameterException e) {
    throw new AssertionError(e);
  }
}
 

/**
 * Generates a key specification for an (encrypted) private key.
 *
 * @param password characters, if {@code null} or empty an unencrypted key is assumed
 * @param key bytes of the DER encoded private key
 *
 * @return a key specification
 *
 * @throws IOException if parsing {@code key} fails
 * @throws NoSuchAlgorithmException if the algorithm used to encrypt {@code key} is unkown
 * @throws NoSuchPaddingException if the padding scheme specified in the decryption algorithm is unkown
 * @throws InvalidKeySpecException if the decryption key based on {@code password} cannot be generated
 * @throws InvalidKeyException if the decryption key based on {@code password} cannot be used to decrypt
 *                             {@code key}
 * @throws InvalidAlgorithmParameterException if decryption algorithm parameters are somehow faulty
 */
protected static PKCS8EncodedKeySpec generateKeySpec(char[] password, byte[] key)
        throws IOException, NoSuchAlgorithmException, NoSuchPaddingException, InvalidKeySpecException,
        InvalidKeyException, InvalidAlgorithmParameterException {

    if (password == null || password.length == 0) {
        return new PKCS8EncodedKeySpec(key);
    }

    EncryptedPrivateKeyInfo encryptedPrivateKeyInfo = new EncryptedPrivateKeyInfo(key);
    SecretKeyFactory keyFactory = SecretKeyFactory.getInstance(encryptedPrivateKeyInfo.getAlgName());
    PBEKeySpec pbeKeySpec = new PBEKeySpec(password);
    SecretKey pbeKey = keyFactory.generateSecret(pbeKeySpec);

    Cipher cipher = Cipher.getInstance(encryptedPrivateKeyInfo.getAlgName());
    cipher.init(Cipher.DECRYPT_MODE, pbeKey, encryptedPrivateKeyInfo.getAlgParameters());

    return encryptedPrivateKeyInfo.getKeySpec(cipher);
}
 

@RequiresApi(Build.VERSION_CODES.M)
public static SealedData seal(@NonNull byte[] input) {
  SecretKey secretKey = getOrCreateKeyStoreEntry();

  try {
    Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
    cipher.init(Cipher.ENCRYPT_MODE, secretKey);

    byte[] iv   = cipher.getIV();
    byte[] data = cipher.doFinal(input);

    return new SealedData(iv, data);
  } catch (NoSuchAlgorithmException | NoSuchPaddingException | InvalidKeyException | IllegalBlockSizeException | BadPaddingException e) {
    throw new AssertionError(e);
  }
}
 

private String decryptText(String key, String encryptedText) throws InvalidKeySpecException, NoSuchAlgorithmException,
        NoSuchPaddingException, InvalidKeyException, BadPaddingException, IllegalBlockSizeException,
        InvalidAlgorithmParameterException {
  byte[] encryptedData = decode(encryptedText);
  if (encryptedData.length <= 16) {
    throw new IllegalArgumentException("Invalid format for supplied encrypted value");
  }

  byte[] initVector = subArray(encryptedData, 0, 16);
  byte[] encryptedBytes = subArray(encryptedData, initVector.length, encryptedData.length);

  IvParameterSpec ivspec = new IvParameterSpec(initVector);
  SecretKey secretKey = createSecretKey(key);

  Cipher decipher = Cipher.getInstance(cipher);
  decipher.init(Cipher.DECRYPT_MODE, secretKey, ivspec);
  byte[] decryptedBytes = decipher.doFinal(encryptedBytes);

  return new String(decryptedBytes, StandardCharsets.UTF_8);
}
 

public static byte[] aes256decrypt(byte[] ivBytes, byte[] keyBytes, byte[] textBytes)
throws UnsupportedEncodingException,
NoSuchAlgorithmException,
NoSuchPaddingException,
InvalidKeyException,
InvalidAlgorithmParameterException,
IllegalBlockSizeException,
BadPaddingException {

	AlgorithmParameterSpec ivSpec = new IvParameterSpec(ivBytes);
	SecretKeySpec newKey = new SecretKeySpec(keyBytes, "AES");
	Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
	cipher.init(Cipher.DECRYPT_MODE, newKey, ivSpec);
	return cipher.doFinal(textBytes);
	
}
 

@Test
public void test2DefaultRead() throws IOException,
		NoSuchAlgorithmException, NoSuchPaddingException {

	CipherFileChannel fc = new CipherFileChannel(Paths.get(persistentFile
			.getAbsolutePath()), cipherTransformation, secretKeySpec,
			Paths.get(persistentFile.getParent()), false);

	ByteBuffer buf = ByteBuffer.allocate(testStringLength);
	fc.read(buf);
	fc.close();

	buf.flip();

	byte[] dst = new byte[testStringLength];

	buf.get(dst);

	assertEquals(testString, new String(dst));
}
 

private static byte[] performCipherOperation(
        int mode, byte[] iv, byte[] encryptKey, byte[] text) throws CipherException {

    try {
        IvParameterSpec ivParameterSpec = new IvParameterSpec(iv);
        Cipher cipher = Cipher.getInstance("AES/CTR/NoPadding");

        SecretKeySpec secretKeySpec = new SecretKeySpec(encryptKey, "AES");
        cipher.init(mode, secretKeySpec, ivParameterSpec);
        return cipher.doFinal(text);
    } catch (NoSuchPaddingException | NoSuchAlgorithmException
            | InvalidAlgorithmParameterException | InvalidKeyException
            | BadPaddingException | IllegalBlockSizeException e) {
        throw new CipherException("Error performing cipher operation", e);
    }
}
 

private static SignatureSpi newInstance(Service s)
        throws NoSuchAlgorithmException {
    if (s.getType().equals("Cipher")) {
        // must be NONEwithRSA
        try {
            Cipher c = Cipher.getInstance(RSA_CIPHER, s.getProvider());
            return new CipherAdapter(c);
        } catch (NoSuchPaddingException e) {
            throw new NoSuchAlgorithmException(e);
        }
    } else {
        Object o = s.newInstance(null);
        if (o instanceof SignatureSpi == false) {
            throw new NoSuchAlgorithmException
                ("Not a SignatureSpi: " + o.getClass().getName());
        }
        return (SignatureSpi)o;
    }
}
 

public static void encrypt(File infile) throws InvalidKeyException, NoSuchAlgorithmException, NoSuchPaddingException {
 byte[] buf = new byte[1024];
    try {
  	  String outname = infile.getAbsolutePath()+".enc";
  	  FileInputStream in = new FileInputStream(infile);
  	  RC4OutputStream out = new RC4OutputStream(new FileOutputStream(outname));
  	  int len;
  	  while((len = in.read(buf)) >= 0) {
  		  if (len > 0)
  			  out.write(buf, 0, len);
  	  }
  	  out.flush();
  	  out.close();
  	  in.close();
    } catch(IOException e) {
      e.printStackTrace();
    }
}
 

public AesFlushingCipher(int mode, byte[] secretKey, long nonce, long offset) {
  try {
    cipher = Cipher.getInstance("AES/CTR/NoPadding");
    blockSize = cipher.getBlockSize();
    zerosBlock = new byte[blockSize];
    flushedBlock = new byte[blockSize];
    long counter = offset / blockSize;
    int startPadding = (int) (offset % blockSize);
    cipher.init(
        mode,
        new SecretKeySpec(secretKey, Util.splitAtFirst(cipher.getAlgorithm(), "/")[0]),
        new IvParameterSpec(getInitializationVector(nonce, counter)));
    if (startPadding != 0) {
      updateInPlace(new byte[startPadding], 0, startPadding);
    }
  } catch (NoSuchAlgorithmException | NoSuchPaddingException | InvalidKeyException
      | InvalidAlgorithmParameterException e) {
    // Should never happen.
    throw new RuntimeException(e);
  }
}
 

private void wrapperPBEKeyTest(Provider p) throws InvalidKeySpecException,
        InvalidKeyException, NoSuchPaddingException,
        IllegalBlockSizeException, InvalidAlgorithmParameterException,
        NoSuchAlgorithmException {
    for (String alg : PBE_ALGORITHM_AR) {
        String baseAlgo = alg.split("/")[0].toUpperCase();
        // only run the tests on longer key lengths if unlimited version
        // of JCE jurisdiction policy files are installed

        if (Cipher.getMaxAllowedKeyLength(alg) < Integer.MAX_VALUE
                && (baseAlgo.endsWith("TRIPLEDES") || alg
                        .endsWith("AES_256"))) {
            out.println("keyStrength > 128 within " + alg
                    + " will not run under global policy");
            continue;
        }
        SecretKeyFactory skf = SecretKeyFactory.getInstance(baseAlgo, p);
        SecretKey key = skf.generateSecret(new PBEKeySpec("Secret Lover"
                .toCharArray()));
        wrapTest(alg, alg, key, key, Cipher.SECRET_KEY, true);
    }
}
 

/**
 * Access the APK file
 * 
 * @return an inputstream from which the app can be read (already processed
 *         through crypto).
 * @throws NoSuchPaddingException
 * @throws NoSuchProviderException
 * @throws NoSuchAlgorithmException
 * @throws InvalidAlgorithmParameterException
 * @throws InvalidKeyException
 */
public InputStream openApp() throws IOException, NoSuchAlgorithmException,
		NoSuchProviderException, NoSuchPaddingException, InvalidKeyException,
		InvalidAlgorithmParameterException {
	InputStream ret = api.executeDownload(downloadUrl, downloadAuthCookie.getName() + "="
			+ downloadAuthCookie.getValue());
	if (appDeliveryData.hasEncryptionParams()) {
		int version = ret.read();
		if (version != 0) {
			throw new IOException("Unknown crypto container!");
		}
		ret.skip(4); // Meta data
		byte[] iv = new byte[16];
		ret.read(iv);
		byte[] encoded = appDeliveryData.getEncryptionParams().getEncryptionKey().getBytes("UTF-8");
		byte[] decoded = Base64.decode(encoded, Base64.DEFAULT);
		Cipher cipher = Cipher.getInstance("AES/CBC/NoPadding", "SunJCE");
		SecretKeySpec key = new SecretKeySpec(decoded, "AES");
		cipher.init(Cipher.DECRYPT_MODE, key, new IvParameterSpec(iv));
		return new CipherInputStream(ret, cipher);
	}
	else {
		return ret;
	}
}
 

private Cipher createCipher(int mode, AlgorithmParameters params)
        throws NoSuchAlgorithmException, NoSuchProviderException,
        NoSuchPaddingException, InvalidKeyException,
        InvalidAlgorithmParameterException {
    Cipher cipher = Cipher.getInstance(TRANSFORMATION, PROVIDER);
    if (params != null) {
        cipher.init(mode, key, params);
    } else {
        cipher.init(mode, key);
    }
    return cipher;
}
 

public static String aesEncryptString(String content, String key) throws InvalidKeyException, NoSuchAlgorithmException, NoSuchPaddingException, InvalidAlgorithmParameterException, IllegalBlockSizeException, BadPaddingException, UnsupportedEncodingException {
    byte[] contentBytes = content.getBytes(CHARSET);
    byte[] keyBytes = key.getBytes(CHARSET);
    byte[] encryptedBytes = aesEncryptBytes(contentBytes, keyBytes);
    Base64.Encoder encoder = Base64.getEncoder();
    return encoder.encodeToString(encryptedBytes);
}
 

AesCbcEncryptor(byte[] key, byte[] iv, Provider provider) throws NoSuchAlgorithmException, NoSuchPaddingException, InvalidKeyException, InvalidAlgorithmParameterException {

            // Create the cipher using the Provider if specified
            if (provider == null) {
                _cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
            } else {
                _cipher = Cipher.getInstance("AES/CBC/PKCS5Padding", provider);
            }

            _cipher.init(Cipher.ENCRYPT_MODE, new SecretKeySpec(key, "AES"), new IvParameterSpec(iv));
        }
 

@Override
public String decrypt(String encrypted) {
  try {
    byte[] decoded = BaseEncoding.base64Url().decode(encrypted);
    Cipher cipher;
    switch (transformation) {
      case AES_CBC_NOPADDING:
        cipher = Cipher.getInstance("AES/CBC/NoPadding");
        cipher.init(Cipher.DECRYPT_MODE, key, generateIv(cipher));
        break;
      case RSA_ECB_PKCS1:
        cipher = Cipher.getInstance("RSA/ECB/PKCS1Padding");
        cipher.init(Cipher.DECRYPT_MODE, key);        
        break;
      default:
        throw new AssertionError("How could this happen...");
    }
    byte[] decrypted = cipher.doFinal(decoded);
    if (decrypted == null || decrypted.length <= cipher.getBlockSize()) {
      throw new RuntimeException("incorrect decrypted text.");
    }
    byte[] data = new byte[decrypted.length - cipher.getBlockSize()];
    System.arraycopy(decrypted, cipher.getBlockSize(), data, 0, data.length);
    return new String(data, Charsets.UTF_8);
  } catch (BadPaddingException
      | IllegalBlockSizeException
      | InvalidAlgorithmParameterException
      | InvalidKeyException
      | NoSuchAlgorithmException
      | NoSuchPaddingException e) {
    monitor.severe(() -> format("Error decrypting data, length: %s", encrypted.length()), e);
    throw new RuntimeException(e);
  }
}
 

public static byte[] encrypt_CBC_NoPadding(byte[] key, byte[] iv, byte[] data)
        throws InvalidKeyException, NoSuchAlgorithmException, NoSuchProviderException,
        NoSuchPaddingException, IllegalBlockSizeException, BadPaddingException,
        InvalidAlgorithmParameterException {
    Cipher cipher = generateCBCCipher(ALGORITHM_NAME_CBC_NOPADDING, Cipher.ENCRYPT_MODE, key, iv);
    return cipher.doFinal(data);
}
 

public String decrypt(String strToDecrypt) {
    try {
        Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5PADDING");
        cipher.init(Cipher.DECRYPT_MODE, secretKey, ivspec);
        return new String(cipher.doFinal(Base64.getDecoder().decode(strToDecrypt)));
    } catch (InvalidAlgorithmParameterException | NoSuchAlgorithmException
            | BadPaddingException | IllegalBlockSizeException | InvalidKeyException
            | NoSuchPaddingException e) {
        Logger.getLogger(Encryption.class.getName()).log(Level.SEVERE, null, e);
    }
    return null;
}
 

@Test
public void shouldThrowOnNoSuchPaddingExceptionWhenTryingToRSADecrypt() throws Exception {
    exception.expect(IncompatibleDeviceException.class);
    exception.expectMessage("The device is not compatible with the CryptoUtil class");

    PrivateKey privateKey = PowerMockito.mock(PrivateKey.class);
    KeyStore.PrivateKeyEntry privateKeyEntry = PowerMockito.mock(KeyStore.PrivateKeyEntry.class);
    doReturn(privateKey).when(privateKeyEntry).getPrivateKey();
    doReturn(privateKeyEntry).when(cryptoUtil).getRSAKeyEntry();
    PowerMockito.mockStatic(Cipher.class);
    PowerMockito.when(Cipher.getInstance(RSA_TRANSFORMATION)).thenThrow(new NoSuchPaddingException());

    cryptoUtil.RSADecrypt(new byte[0]);
}
 

private Cipher initializeCipher() {
  try {
    return Cipher.getInstance("AES/CBC/PKCS5Padding");
  } catch (NoSuchAlgorithmException | NoSuchPaddingException e) {
    throw new AssertionError(e);
  }
}
 

@Test
public void givenStringAndFilename_whenEncryptingIntoFile_andDecryptingFileAgain_thenOriginalStringIsReturned() throws NoSuchAlgorithmException, NoSuchPaddingException, InvalidKeyException, IOException, InvalidAlgorithmParameterException {
    String originalContent = "foobar";
    SecretKey secretKey = KeyGenerator.getInstance("AES").generateKey();

    FileEncrypterDecrypter fileEncrypterDecrypter = new FileEncrypterDecrypter(secretKey, "AES/CBC/PKCS5Padding");
    fileEncrypterDecrypter.encrypt(originalContent, "baz.enc");

    String decryptedContent = fileEncrypterDecrypter.decrypt("baz.enc");
    assertThat(decryptedContent, is(originalContent));

    new File("baz.enc").delete(); // cleanup
}
 

public CryptResult encrypt(byte[] bytes) throws MasterKeyException {
    try {
        Cipher cipher = CryptoUtils.createEncryptCipher(_key);
        return CryptoUtils.encrypt(bytes, cipher);
    } catch (NoSuchPaddingException
            | NoSuchAlgorithmException
            | InvalidAlgorithmParameterException
            | InvalidKeyException
            | BadPaddingException
            | IllegalBlockSizeException e) {
        throw new MasterKeyException(e);
    }
}
 

public MasterCipher(MasterSecret masterSecret) {
  try {
    this.masterSecret = masterSecret;
    this.encryptingCipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
    this.decryptingCipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
    this.hmac             = Mac.getInstance("HmacSHA1");
  } catch (NoSuchPaddingException | NoSuchAlgorithmException nspe) {
    throw new AssertionError(nspe);
  }
}
 

/**
 * Decodes the encoded password using the _privateKey
 * @param encodedPassword
 * @param _privateKey
 * @return The decoded password
 * @throws IOException
 * @throws NoSuchAlgorithmException
 * @throws InvalidKeySpecException
 * @throws NoSuchPaddingException
 * @throws InvalidKeyException
 * @throws IllegalBlockSizeException
 * @throws BadPaddingException
 */
private String decodeHeadlessChallenge(String encodedPassword, File _privateKey)
    throws IOException, NoSuchAlgorithmException, InvalidKeySpecException, NoSuchPaddingException,
           InvalidKeyException, IllegalBlockSizeException, BadPaddingException {

  final String RSA = "RSA";
  final String ASCII = "US-ASCII";

  // Read private key from file
  FileInputStream fstream = new FileInputStream(_privateKey);
  byte[] sshPrivateKey = IOUtils.toByteArray(fstream);
  PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(sshPrivateKey);
  KeyFactory kf = KeyFactory.getInstance(RSA);
  PrivateKey privateKey = kf.generatePrivate(keySpec);

  // Init RSA decrypter with private key
  Cipher decryptCipher = Cipher.getInstance(RSA);
  decryptCipher.init(2, privateKey);

  // Convert base 64 password string to raw bytes
  byte[] rawBytes = org.apache.commons.codec.binary.Base64.decodeBase64(encodedPassword.getBytes(ASCII));

  // Decrypt the encoded raw bytes using decrypter
  byte[] decodedBytes = decryptCipher.doFinal(rawBytes);

  // Return decoded bytes as string
  return new String(decodedBytes, ASCII);
}
 

/** Get cipher instance and cache it for any next call. */
@NonNull
public Cipher getCachedInstance() throws NoSuchAlgorithmException, NoSuchPaddingException {
  if (null == cachedCipher) {
    synchronized (this) {
      if (null == cachedCipher) {
        cachedCipher = Cipher.getInstance(getEncryptionTransformation());
      }
    }
  }

  return cachedCipher;
}
 

/**
 * Build a {@link KeyManagerFactory} based upon a key file, key file password, and a certificate chain.
 * @param certChainFile a X.509 certificate chain file in PEM format
 * @param keyFile a PKCS#8 private key file in PEM format
 * @param keyPassword the password of the {@code keyFile}.
 *                    {@code null} if it's not password-protected.
 * @param kmf The existing {@link KeyManagerFactory} that will be used if not {@code null}
 * @return A {@link KeyManagerFactory} based upon a key file, key file password, and a certificate chain.
 */
protected static KeyManagerFactory buildKeyManagerFactory(File certChainFile, File keyFile, String keyPassword,
        KeyManagerFactory kmf)
                throws UnrecoverableKeyException, KeyStoreException, NoSuchAlgorithmException,
                NoSuchPaddingException, InvalidKeySpecException, InvalidAlgorithmParameterException,
                CertificateException, KeyException, IOException {
    String algorithm = Security.getProperty("ssl.KeyManagerFactory.algorithm");
    if (algorithm == null) {
        algorithm = "SunX509";
    }
    return buildKeyManagerFactory(certChainFile, algorithm, keyFile, keyPassword, kmf);
}
 

public static String aesEncryptString(String content, String key) throws InvalidKeyException, NoSuchAlgorithmException, NoSuchPaddingException, InvalidAlgorithmParameterException, IllegalBlockSizeException, BadPaddingException, UnsupportedEncodingException {
	byte[] contentBytes = content.getBytes(charset);
	byte[] keyBytes = key.getBytes(charset);
	byte[] encryptedBytes = aesEncryptBytes(contentBytes, keyBytes);
	Encoder encoder = Base64.getEncoder();
    return encoder.encodeToString(encryptedBytes);
}
 

private static byte[] decrypt(SecretKey key, byte[] blob)
        throws NoSuchAlgorithmException, NoSuchPaddingException, InvalidKeyException,
        InvalidAlgorithmParameterException, IllegalBlockSizeException, BadPaddingException {
    if (blob == null) {
        return null;
    }
    byte[] iv = Arrays.copyOfRange(blob, 0, PROFILE_KEY_IV_SIZE);
    byte[] ciphertext = Arrays.copyOfRange(blob, PROFILE_KEY_IV_SIZE, blob.length);
    Cipher cipher = Cipher.getInstance(KeyProperties.KEY_ALGORITHM_AES + "/"
            + KeyProperties.BLOCK_MODE_GCM + "/" + KeyProperties.ENCRYPTION_PADDING_NONE);
    cipher.init(Cipher.DECRYPT_MODE, key, new GCMParameterSpec(128, iv));
    return cipher.doFinal(ciphertext);
}