StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p> In my experience, defaults are a tremendous and never-ending source of hard-to-find bugs in Java crypto. They can bite anybody but they prey on beginners. A beginner is most likely to choose defaults because, by their very nature, they are confused and are looking to simplify. And they are hard to spot, indeed almost invisible, because they are <em>not</em> there. When you look at <code>String.getBytes()</code> it looks completely innocent. Why would a beginner suspect that <code>new String(s.getBytes())</code> is ever <em>not</em> equal to <code>s</code>? Worst of all, testing seems to indicate it is true. It is only when you transport the <code>byte[]</code> from <code>s.getBytes()</code> to another platform with a different platform default character set that you notice the bug. </p> <p>Never use <a href="http://docs.oracle.com/javase/6/docs/api/java/lang/String.html#getBytes%28%29" rel="nofollow"><code>String.getBytes()</code></a>, always use <a href="http://docs.oracle.com/javase/6/docs/api/java/lang/String.html#getBytes%28java.nio.charset.Charset%29" rel="nofollow"><code>String.getBytes(Charset)</code></a>. Never use the <a href="http://docs.oracle.com/javase/6/docs/api/java/lang/String.html#String%28byte%5B%5D%29" rel="nofollow"><code>String(byte[])</code></a> constructor, always use <a href="http://docs.oracle.com/javase/6/docs/api/java/lang/String.html#String%28byte%5B%5D,%20java.nio.charset.Charset%29" rel="nofollow"><code>String(byte [], Charset)</code></a> constructor. You can always use the UTF-8 charset (<code>Charset.forName("UTF-8")</code>). I use it exclusively.</p> <p>Similarly, always specify all three components <em>algorithm/mode/padding</em> in the <a href="http://docs.oracle.com/javase/6/docs/api/javax/crypto/Cipher.html" rel="nofollow"><code>Cipher.getInstance(String)</code></a> factory method.</p>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload