Our security department wants us to use 256-bit encryption to encrypt SSN, Names of Users etc, so we decided to go with JASYPT with the sample code below:

encryptor = new StandardPBEStringEncryptor();
encryptor.setProvider(new BouncyCastleProvider());
encryptor.setAlgorithm("PBEWITHSHA256AND256BITAES-CBC-BC");
encryptor.setPassword(OUR_KEY)
encryptor.encrypt("TEXT TO ECNCRYPT")

The problem we noticed is when our application creates an encrypted record from our local machine, the application on the app-dev server cannot decrypt it and vice versa even though the key is same. It seems like JASYPT is adding some machine specific information in the salt (Mac address etc).

Even using FixedStringSaltGenerator or ZeroSaltGenerator does not help. This creates a problem for us because if we ever migrated our production server to another machine, or refreshed pre-prod data with the prod data, we may need a couple of million years to recover the information.

The security department wants us to use a well know library and not brew an in-house solution. Can someone please throw some light on this issue on how we can generate encrypted string that can be decrypted across different machines using jasypt 256 bit encryption, or when we refresh pre-prod database with prod data, how we would be able to recover names etc that were encrypted through a different server?

Any useful insights will be greatly appreciated.

解决方案

your key might be containing some special characters which shell substitute with something else. do a echo "yourkey" > file and check the content of this file. then use this content as a key to decrypt; it should be able to decrypt the encrypted string.