java加密key加密,Java加密替代硬编码密钥

I am new to encryption.

I have looked at the javax.crypto documentation and got encryption of a file to work using this code ...

File saveFile = new File("Settings.set");

saveFile.delete();

FileOutputStream fout = new FileOutputStream(saveFile);

//Encrypt the settings

//Generate a key

byte key[] = "My Encryption Key98".getBytes();

DESKeySpec desKeySpec = new DESKeySpec(key);

SecretKeyFactory keyFactory = SecretKeyFactory.getInstance("DES");

SecretKey skey = keyFactory.generateSecret(desKeySpec);

//Prepare the encrypter

Cipher ecipher = Cipher.getInstance("DES");

ecipher.init(Cipher.ENCRYPT_MODE, skey);

// Seal (encrypt) the object

SealedObject so = new SealedObject(this, ecipher);

ObjectOutputStream o = new ObjectOutputStream(fout);

o.writeObject(so);

o.close();

However if you were a clever hacker ( or maybe even amateur since I figured this out), all you would have to do is open the class file that contains this code, and the encryption key (My Encryption Key98) is plainly visible.

How do you encrypt the encryption key? ...LOL... Can you?

Thanks for your help!

解决方案

If the attacker has access to both the software and the file, it could decrypt it. There are some ways to solve this:

Use asymetric keys. Encrypt the file with the public key, and it can only be decrypted with a private key. This assumes that the software does not need to decrypt the file.

Use Diffie-Hellman exchange. If you want to send an encrypted piece of data over the network, both parties can establish a key without an attacker knowing about it.

If the program needs to both encrypt and decrypt the data, there is nothing you can do. The attacker can simply run the program and look at the decrypted information.