How to Encrypt a String Using AES with a Custom Key in Java?

Question

How can I encrypt a string using AES in Java with a custom key while addressing key length issues?

public static void main(String[] args) throws Exception {
    // Your code here
}

Answer

AES (Advanced Encryption Standard) is a symmetric encryption algorithm that requires specific key lengths - 128, 192, or 256 bits. Using an incorrect key length will lead to exceptions such as 'Invalid AES key length.' The following sections will guide you on how to correctly generate a valid key and perform AES encryption in Java.

import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.util.Arrays;

public class AesEncryption {
    public static void main(String[] args) throws Exception {
        String username = "[email protected]";
        String password = "Password1";
        String secretID = "BlahBlahBlah";
        String SALT2 = "deliciously salty";

        // Generate a secure key
        MessageDigest digest = MessageDigest.getInstance("SHA-256");
        byte[] key = Arrays.copyOf(digest.digest((SALT2 + username + password).getBytes(StandardCharsets.UTF_8)), 16); // for AES-128

        // Generate the secret key specs.
        SecretKeySpec secretKeySpec = new SecretKeySpec(key, "AES");

        // Instantiate the cipher
        Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5Padding"); // Optionally use CBC mode
        cipher.init(Cipher.ENCRYPT_MODE, secretKeySpec);

        byte[] encrypted = cipher.doFinal(secretID.getBytes(StandardCharsets.UTF_8));
        System.out.println("Encrypted string: " + bytesToHex(encrypted));

        cipher.init(Cipher.DECRYPT_MODE, secretKeySpec);
        byte[] original = cipher.doFinal(encrypted);
        String originalString = new String(original, StandardCharsets.UTF_8);
        System.out.println("Original string: " + originalString);
    }

    public static String bytesToHex(byte[] bytes) {
        StringBuilder sb = new StringBuilder();
        for (byte b : bytes) {
            sb.append(String.format("%02X", b));
        }
        return sb.toString();
    }
}

Causes

The key length is not a valid size for AES. Allowed lengths are 16 bytes (128 bits), 24 bytes (192 bits), or 32 bytes (256 bits).
The combined length of SALT, username, and password exceeds the required key size for AES.

Solutions

To create a valid AES key, you can derive it from your input using a hashing algorithm like SHA-256, ensuring the byte length matches the required AES key size.
Use `Arrays.copyOf()` to trim the byte array to the necessary size before creating the `SecretKeySpec`.
It is critical to choose a secure AES mode (like CBC) and padding scheme (like PKCS5Padding).

Common Mistakes

Mistake: Not using a hashing algorithm to derive the key, leading to an invalid key size.

Solution: Use SHA-256 to ensure the key length is appropriate for AES.

Mistake: Using ECB mode may expose the data to risk of pattern analysis.

Solution: Prefer CBC mode for secure encryption.

Helpers

Java AES encryption
AES custom key
Java encryption example
AES key length
Java encryption tutorial