Jazz Forum Welcome to the Jazz Community Forum Connect and collaborate with IBM Engineering experts and users

The passwords in the passwordfile cannot decrypt

 We created encrypted passwords file using jbe. Tried to decrypt using ObfuscationHelper.decryptString() to use in our javacode. But it is failing. Is there any other encryption algorithm used or has anyone used the password file in the API calls?

0 votes



One answer

Permanent link

"But it is failing" is not an actionable description. This is just another example for how to not ask a question. 


The JBE provides a capability to create a password file. It is possible to use this password file with the JBE to authenticate to the system. This works, as far as I understand, because the JBE uses the same keys to obfuscate and de-obfuscate. Because of this, obfuscating your password using this techniques is not safe. Anyone with enough will or need, can hack into this. I cite the documentation: 

/
  Helper class for obfuscating strings. The solution uses symmetric encryption
  and decryption. It is <b>not</b> secure because the key used for encryption
  and decryption is hardcoded in this class.
  <p>
  For example, the solution can be used to keep passwords out of obvious clear
  view, but not to stop an attacker from discovering a password.
  </p>
 

But it is enough to work and not have to have your passwords on disk without encryption as plain text.
I do not have the JBE code available, however, the ObfuscationHelper is part of the Jazz Foundation/Repository code. It is completely unclear, if the code is used in the JBE. I think the JBE uses at least a different internal key to encode passwords. This is why the helper might not be able to recreate the password. I am not aware of any documentation that you should use the class in your API. My assumptions is, if you want to use the helper to decrypt, you would have to use the helper to create the crypted password as well. Or you use the code as an example and put in your own keys.

 The helper is just good enough to not have to store passwords in plain text. It will never be a secure solution. If you want secure solutions, use your own libraries for this.

It is also sometimes a good idea to use these a search engine. Here similar posts: https://www.google.com/search?q=decrypt+JBE+site%3Ajazz.net  . The answers seem to show that the way you try to use the ObfuscationHelper did never work.

0 votes

Your answer

Register or log in to post your answer.

Dashboards and work items are no longer publicly available, so some links may be invalid. We now provide similar information through other means. Learn more here.

Search context
Follow this question

By Email: 

Once you sign in you will be able to subscribe for any updates here.

By RSS:

Answers
Answers and Comments
Question details

Question asked: Apr 20 '23, 3:23 p.m.

Question was seen: 889 times

Last updated: Apr 21 '23, 4:04 a.m.

Confirmation Cancel Confirm