No, it isn&#39;t. The instance is stateful. So you need to store it threadlocal, or to obtain a new instance on every encrypt/decrypt call, or to wrap it in a `synchronized(cipher)` block.

Threadsafety is usually mentioned in javadocs as &quot;[is thread safe][1]&quot; or &quot;[is **not** thread safe][2]&quot;. This is not the case for [`Cipher`][3], so you should not assume it to be threadsafe.


  [1]: https://www.google.com/search?q=%22is%20thread%20safe%22%20site:https://docs.oracle.com/en/java/javase/16/docs/api
  [2]: https://www.google.com/search?q=%22is%20not%20thread%20safe%22%20site:https://docs.oracle.com/en/java/javase/16/docs/api
  [3]: https://docs.oracle.com/en/java/javase/16/docs/api/java.base/javax/crypto/Cipher.html

Even if a Cipher was thread-safe, it would not really be useful to use it from multiple threads concurrently.

The bytes you put into and get out of the Cipher (via its `update` and `finish` methods) are a continuous stream. This means, on the other end, they have to be passed in the same order to make any sense. This is easiest to accomplish if you have only one thread doing this.

If you are using multiple threads, you usually would want to call `reset` between the calls - and then you will need external synchronization anyways.

I wouldn&#39;t use Cipher objects from multiple threads without synchronization. When you look at the API, there are methods which can only work by changing internal state, such as `init()` and `update()`. That makes them implicitly non-thread-safe.

Cipher is not thread safe. 

If you use multithreading for performance and don&#39;t want to do synchronization, you can use Jasypt (http://www.jasypt.org/general-usage.html) it has pooled encryptors: PooledPBEByteEncryptor, PooledPBEStringEncryptor.

If synchronization is ok for you and you use Spring. You can use Encryptors (https://docs.spring.io/spring-security/site/docs/4.2.5.RELEASE/apidocs/org/springframework/security/crypto/encrypt/Encryptors.html). They do synchronization internally to access Cipher.

Ok, as Google search isn&#39;t helping me in a while (even when using the correct keywords).

I have a class extending from TestCase in which I want to have some auxiliary methods that are not going to be executed as part of the test, they&#39;ll be used to generate some mocked objects, etc, auxiliary things for almost any test.

I know I could use the @skip decorator so unittest doesn&#39;t run a particular test method, but I think that&#39;s an ugly hack to use for my purpose, any tips?

Thanks in advance, community :D

Non-test methods in a Python TestCase

I would like to know exactly how the execution of asynchronous signal handlers works on Linux. First, I am unclear as to *which* thread executes the signal handler. Second, I would like to know the steps that are followed to make the thread execute the signal handler.

On the first matter, I have read two different, seemingly conflicting, explanations:

1.  The Linux Kernel, by Andries Brouwer, [&#167;5.2 &quot;Receiving signals&quot; states][1]:

    &gt; When a signal arrives, the process is interrupted, the current registers are saved, and the signal handler is invoked. When the signal handler returns, the interrupted activity is continued.

2.  The [StackOverflow question &quot;Dealing With Asynchronous Signals In Multi Threaded Program&quot;][2] leads me to think that Linux&#39;s behavior is [like SCO Unix&#39;s][3]:

    &gt; When a signal is delivered to a process, if it is being caught, it will be handled by one, and only one, of the threads meeting either of the following conditions:
    &gt; 1. A thread blocked in a [**sigwait**(2)][4] system call whose argument *does* include the type of the caught signal.

    &gt; 2. A thread whose signal mask *does not* include the type of the caught signal.

    &gt; Additional considerations:
    &gt;  * A thread blocked in [**sigwait**(2)][5] is given preference over a thread not blocking the signal type.
    &gt;  * If more than one thread meets these requirements (perhaps two threads are calling [**sigwait**(2)][6]), then one of them will be chosen. This choice is not predictable by application programs.
    &gt;  * If no thread is eligible, the signal will remain \`\`pending&#39;&#39; at the process level until some thread becomes eligible.

    Also, [&quot;The Linux Signals Handling Model&quot; by Moshe Bar states][7] &quot;Asynchronous signals are delivered to the first thread found not blocking the signal.&quot;, which I interpret to mean that the signal is delivered to some thread having its sigmask *not* including the signal.

Which one is correct?

On the second matter, what happens to the stack and register contents for the selected thread?  Suppose the thread-to-run-the-signal-handler *T* is in the middle of executing a `do_stuff()` function. Is thread *T*&#39;s stack used directly to execute the signal handler (i.e. the address of the signal trampoline is pushed onto *T*&#39;s stack and control flow goes to the signal handler)? Alternatively, is a separate stack used? How does it work?


  [1]: http://www.win.tue.nl/~aeb/linux/lk/lk-5.html#ss5.2
  [2]: https://stackoverflow.com/q/6223191/196844
  [3]: http://uw714doc.sco.com/en/SDK_sysprog/PTL_ThdsSigs.html#_Asynch-Generated_Signal
  [4]: http://uw714doc.sco.com/en/man/html.2/sigwait.2.html
  [5]: http://uw714doc.sco.com/en/man/html.2/sigwait.2.html
  [6]: http://uw714doc.sco.com/en/man/html.2/sigwait.2.html
  [7]: http://www.linuxjournal.com/article/3985?page=0,1

How are asynchronous signal handlers executed on Linux?

Quite simply, can one instance of `javax.crypto.Cipher` (e.g. `Cipher.getInstance(&quot;RSA&quot;)`) be used from multiple threads, or do I need to stick multiple of them in a `ThreadLocal` (in my case)?

Is Cipher thread-safe?

<p>Quite simply, can one instance of <code>javax.crypto.Cipher</code> (e.g. <code>Cipher.getInstance("RSA")</code>) be used from multiple threads, or do I need to stick multiple of them in a <code>ThreadLocal</code> (in my case)?</p>


I have a Java collection:

    Collection&lt;CustomObject&gt; list = new ArrayList&lt;CustomObject&gt;();

`CustomObject` has an `id` field now before display list I want to sort this collection by that `id`.

Is there any way I could that do that? 


Sort Java Collection

Which one of the 2 options is better and faster to clear an ArrayList, and why?

    list.clear() 
or

    list = new ArrayList&lt;Integer&gt;();

It happens that I have to, at random times, clear all entries from my ArrayList and I have no way to know how many new entries there will be in the future, there might be 0 or a 1000. Which method is faster and better, and why?

list.clear() vs list = new ArrayList&lt;Integer&gt;();

I am introducing tests in a project that makes heavy use of IO operations (the file system, in this case). The system constantly opens/closes files, checks if files exist, deletes them, etcetera.

It soon became obvious that regular mocking wouldn&#39;t be of much use, as that would make my tests hard to set up and reason about. On the other hand, having a fake file system would be awesome, and I think, pretty easy to set up.

It seems the ruby guys did it again, and there&#39;s exactly what I am asking for in ruby: http://ozmm.org/posts/fakefs.html.

Is there anything remotely similar for Java?

Are there any Fake File System frameworks for Java?

I read about properties and resource bundle. But I was unable to get difference between these. When to use Properties file and when to use Resource bundle.

**To load properties file use the following code**

    Properties tempProp = new Properties();
    FileInputStream propsFile = new FileInputStream(xyz.properties);
    tempProp.load(propsFile);

**To load Resource bundle**

    ResourceBundle labels =
        ResourceBundle.getBundle(&quot;xyz&quot;, currentLocale);
    Enumeration bundleKeys = labels.getKeys();
In both of the cases (in resource bundle and in Properites) we are using properties file. The one difference I found is that to store application specific data we use properties file and to use i18n data we use resource bundle. I don&#39;t know whether i am right or not. 

**I would like to know the use of the above two. What is the difference between these two.**




Properties vs Resource Bundle

I am a little bit confused about the use of [`Thread.yield()`][1] method in Java, specifically in the example code below. I&#39;ve also read that yield() is &#39;used to prevent execution of a thread&#39;.

My questions are:

1. I believe the code below result in the same output both when using `yield()` and when not using it. Is this correct?

2. What are, in fact, the main uses of `yield()`?

3. In what ways is `yield()` different from the `join()` and `interrupt()` methods?

The code example:  

    public class MyRunnable implements Runnable {
    
       public static void main(String[] args) {
          Thread t = new Thread(new MyRunnable());
          t.start();
    
          for(int i=0; i&lt;5; i++) {
              System.out.println(&quot;Inside main&quot;);
          }
       }
    
       public void run() {
          for(int i=0; i&lt;5; i++) {
              System.out.println(&quot;Inside run&quot;);
              Thread.yield();
          }
       }
    }
    
    
I obtain the same output using the code above both with and without using `yield()`:
    
    Inside main
    Inside main
    Inside main
    Inside main
    Inside main
    Inside run
    Inside run
    Inside run
    Inside run
    Inside run


  [1]: https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/lang/Thread.html#yield()

What are the main uses of yield(), and how does it differ from join() and interrupt()?

I got slightly confused about the differences between `Handlers`, `AsyncTask` and `Threads` in Android. I&#39;ve read quite a few blogs and questions here in StackOverflow. 

`Handler` are background threads that provide you to communicate with the UI. Updating a progress bar, for instance, should be done via `Handler`. Using Handlers you have the advantage of `MessagingQueues`, so if you want to schedule messages or update multiple UI elements or have repeating tasks.

`AsyncTask` are similar, in fact, they make use of `Handler`, but doesn&#39;t run in the UI thread, so it&#39;s good for fetching data, for instance fetching web services. Later you can interact with the UI.

`Thread` however can&#39;t interact with the UI, provide more &quot;basic&quot; threading and you miss all the abstractions of `AsyncTask`.

However, I would like to have a socket connection run in service. Should this be run in a handler or a thread, or even an `AsyncTask`? UI interaction is not necessary at all. Does it make a difference in terms of performance which I use?

Meanwhile, the [documentation][1] has been majorly improved.


  [1]: https://developer.android.com/reference/android/os/AsyncTask.html

Handler vs AsyncTask vs Thread

I&#39;ve found myself coding this type of thing  a few times.

    for (int i = 0; i &lt; 10; i++)
    {
       if (Thing.WaitingFor())
       {
          break;
       }
       Thread.Sleep(sleep_time);
    }
    if(!Thing.WaitingFor())
    {
       throw new ItDidntHappenException();
    }

It just looks like bad code, is there a better way of doing this / is it a symptom of bad design? 

Is there a better waiting pattern for c#?

Node.js solves &quot;One Thread per Connection Problem&quot; by putting the event-based model at its core, using an event loop instead of threads. 
All the expensive I/O operations are always executed asynchronously with a callback that gets executed when the initiated operation completes.

The Observation IF any Operation occurs is handled by multiplexing mechanisms like `epoll()`.

My question is now:

 - Why doesn&#39;t NodeJS block while using the blocking Systemcalls
   select/epoll/kqueue? 
   
   
 - Or isn&#39;t NodeJS single threaded at all, so that a second Thread is   
   necessary to observe all the I/O-Operations with select/epoll/kqueue?

Is NodeJS really Single-Threaded?

I am a bit confused on how to declare a recursive mutex using pthread.
What I try to do is have only one thread at a time be able to run a piece of code(including functions) but after scepticism I figured out that the use of mutexes would not work and that instead I should use recursive mutexes. Here is my code:

    pthread_mutex_lock(&amp;mutex);                   // LOCK
    
    item = queue_peek(queue);                     // get last item in queue
    item_buff=item;                               // save item to a buffer
    queue_removelast(queue);                      // remove last item from queue
    
    pthread_mutex_unlock(&amp;mutex);                 // UNLOCK

So what I try to do is just read/remove from the queue serially.

The thing is that there isn&#39;t any example out there on how to declare recursive mutexes. Or there maybe a few but they don&#39;t compile for me.

C: How do you declare a recursive mutex with POSIX threads?

Is a volatile `int` in Java thread-safe? That is, can it be safely read from and written to without locking?

Is a volatile int in Java thread-safe?

I keep getting conflicting opinions on the practice of storing information in the `Thread.current` hash (e.g., the current_user, the current subdomain, etc.). The technique has been proposed as a way to simplify later processing within the model layer (query scoping, auditing, etc.). 

 - https://stackoverflow.com/questions/4217911/why-are-my-thread-variables-intermittent-in-rails
 - https://stackoverflow.com/questions/7509883/alternative-to-using-thread-current-in-api-wrapper-for-rails
 - https://stackoverflow.com/questions/6659221/are-thread-current-values-and-class-level-attributes-safe-to-use-in-rails

Many consider the practice unacceptable because it breaks the MVC pattern.
Others express concerns about reliability/safety of the approach, and my 2-part question focuses on the latter aspect.

1. Is the `Thread.current` hash guaranteed to be available and private to one and only one response, throughout its entire cycle?

2. I understand that a thread, at the end of a response, may well be handed over to other incoming requests, thereby leaking any information stored in `Thread.current`. Would clearing such information before the end of the response (e.g. by executing `Thread.current[:user] = nil` from a controller&#39;s `after_filter`) suffice in preventing such security breach?

Thanks!
Giuseppe

Safety of Thread.current[] usage in rails

I know this is an often asked question, but as there are so many variants, I&#39;d like to re-state it, and hopefully have an answer reflecting the current state. Something like

    Logger&amp; g_logger() {
        static Logger lg;
        return lg;
    }

Is the constructor of variable lg guaranteed to run only once?

I know from previous answers that in C++03, this is not; in C++0x draft, this is enforced. But I&#39;d like a clearer answer to

1. In C++11 standard (not draft), is the thread-safe initialization behavior finalized?
2. If the above is yes, in current latest releases of popular compilers, namely gcc 4.7, vc 2011 and clang 3.0, are they properly implemented?

Is local static variable initialization thread-safe in C++11?

What are some recommended approaches to achieving ***thread-safe*** lazy initialization? For instance,

    // Not thread-safe
    public Foo getInstance(){
        if(INSTANCE == null){
            INSTANCE = new Foo();
        }
    
        return INSTANCE;
    }

How to implement thread-safe lazy initialization?

I want to know which is the best way to stop a thread in Android. I know I can use `AsyncTask` instead of it and that there is a `cancel()` method. I have to use `Thread`s in my situation. Here is how I&#39;m using `Thread`:

    Runnable runnable = new Runnable() {
			@Override
			public void run() {
				//doing some work
			}
		};
    new Thread(runnable).start();

So, does anyone have any idea of which is the best way to stop a thread?

Android - Best and safe way to stop thread

I&#39;m writing a small Python script which will periodically pull information from a 3rd party service using a username and password combo. I don&#39;t need to create something that is 100% bulletproof (does 100% even exist?), but I would like to involve a good measure of security so at the very least it would take a long time for someone to break it. 

This script won&#39;t have a GUI and will be run periodically by `cron`, so entering a password each time it&#39;s run to decrypt things won&#39;t really work, and I&#39;ll have to store the username and password in either an encrypted file or encrypted in a SQLite database, which would be preferable as I&#39;ll be using SQLite anyway, and I _might_ need to edit the password at some point. In addition, I&#39;ll probably be wrapping the whole program in an EXE, as it&#39;s exclusively for Windows at this point. 

How can I securely store the username and password combo to be used periodically via a `cron` job?

I need to securely store a username and password in Python, what are my options?

I did a few google searches and checked out the docs ( https://docs.djangoproject.com/en/dev/ref/settings/#secret-key ), but I was looking for a more in-depth explanation of this, and why it is required. 

For example, what could happen if the key was compromised / others knew what it was?

What&#39;s the purpose of Django setting ‘SECRET_KEY’?

I am trying to implement password based encryption algorithm, but I get this exception:

&gt; javax.crypto.BadPaddingException: Given final block not properly padded

What might be the problem?

Here is my code:

    public class PasswordCrypter {
    
    	private Key key;

    	public PasswordCrypter(String password)  {
			try{
			    KeyGenerator generator;
				generator = KeyGenerator.getInstance(&quot;DES&quot;);
				SecureRandom sec = new SecureRandom(password.getBytes());
				generator.init(sec);
				key = generator.generateKey();
			} catch (Exception e) {
    			e.printStackTrace();
    		}
    	}
    
    	
    	public byte[] encrypt(byte[] array) throws CrypterException {
    		try{
    			Cipher cipher = Cipher.getInstance(&quot;DES/ECB/PKCS5Padding&quot;);
    			cipher.init(Cipher.ENCRYPT_MODE, key);
    			 
			    return cipher.doFinal(array);
    		} catch (Exception e) {	
    			e.printStackTrace();
    		}
    		return null;
    	}
    
    	public byte[] decrypt(byte[] array) throws CrypterException{
        	try{
        		Cipher cipher = Cipher.getInstance(&quot;DES/ECB/PKCS5Padding&quot;);
        	    cipher.init(Cipher.DECRYPT_MODE, key);
        	    
        	    return cipher.doFinal(array);
        	} catch(Exception e ){
        		e.printStackTrace();
        	}
            return null;
    	}
    }
    
    
(The JUnit Test)
     
    public class PasswordCrypterTest {

    	private static final byte[] MESSAGE = &quot;Alpacas are awesome!&quot;.getBytes();
    	private PasswordCrypter[] passwordCrypters;
    	private byte[][] encryptedMessages;
    
    	@Before
    	public void setUp() {
    		passwordCrypters = new PasswordCrypter[] {
    			new PasswordCrypter(&quot;passwd&quot;),
    			new PasswordCrypter(&quot;passwd&quot;),
    			new PasswordCrypter(&quot;otherPasswd&quot;)
    		};
    
    		encryptedMessages = new byte[passwordCrypters.length][];
    		for (int i = 0; i &lt; passwordCrypters.length; i++) {
    			encryptedMessages[i] = passwordCrypters[i].encrypt(MESSAGE);
    		}
    	}
    
    	@Test
    	public void testEncrypt() {
    		for (byte[] encryptedMessage : encryptedMessages) {
    			assertFalse(Arrays.equals(MESSAGE, encryptedMessage));
    		}
    
    		assertFalse(Arrays.equals(encryptedMessages[0], encryptedMessages[2]));
    		assertFalse(Arrays.equals(encryptedMessages[1], encryptedMessages[2]));
    	}
    
    	@Test
    	public void testDecrypt() {
    		for (int i = 0; i &lt; passwordCrypters.length; i++) {
    			assertArrayEquals(MESSAGE, passwordCrypters[i].decrypt(encryptedMessages[i]));
    		}
    
    		assertArrayEquals(MESSAGE, passwordCrypters[0].decrypt(encryptedMessages[1]));
    		assertArrayEquals(MESSAGE, passwordCrypters[1].decrypt(encryptedMessages[0]));
    
    		try {
    			assertFalse(Arrays.equals(MESSAGE, passwordCrypters[0].decrypt(encryptedMessages[2])));
    		} catch (CrypterException e) {
    			// Anything goes as long as the above statement is not true.
    		}
    
    		try {
    			assertFalse(Arrays.equals(MESSAGE, passwordCrypters[2].decrypt(encryptedMessages[1])));
    		} catch (CrypterException e) {
    			// Anything goes as long as the above statement is not true.
    		}
    	}
    }




Given final block not properly padded

I&#39;m looking for a way to encrypt/obfuscate an integer ID into another integer. More precisely, I need a function `int F(int x)`, so that

- x&lt;-&gt;F(x) is one-to-one correspondence (if x != y, F(x) != F(y))
- given F(x), it&#39;s easy to find out x - so F is not a hash function
- given x and F(x) it&#39;s hard/impossible to find out F(y), something like `x ^ 0x1234` won&#39;t work

For clarity, I&#39;m not looking for a strong encryption solution, it&#39;s only obfuscation. Imagine a web application with urls like `example.com/profile/1`, `example.com/profile/2` etc. The profiles themselves are not secret, but I&#39;d like to prevent  casual voyeurs to view/fetch all profiles one after another, so I&#39;d rather hide them behind something like `example.com/profile/23423`, `example.com/profile/80980234` etc. Although database-stored tokens can do the job quite easily, I&#39;m curious if there&#39;s some simple math available for this.

One important requirement I wasn&#39;t clear about is that results should look &quot;random&quot;, that is, given a sequence `x,x+1,...,x+n` , `F(x),F(x+1)...F(x+n)` shouldn&#39;t form a progression of any kind.

Obfuscating an ID

**Why I ask this question:**

I know there have been a lot of questions about AES encryption, even for Android. And there are lots of code snippets if you search the Web. But on every single page, in every Stack Overflow question, I find another implementation with major differences.

So I created this question to find a &quot;best practice&quot;. I hope we can collect a list of the most important requirements and set up an implementation that is really secure!

I read about initialization vectors and salts. Not all implementations I found had these features. So do you need it? Does it increase the security a lot? How do you implement it? Should the algorithm raise exceptions if the encrypted data cannot be decrypted? Or is that insecure and it should just return an unreadable string? Can the algorithm use Bcrypt instead of SHA?

What about these two implementations I found? Are they okay? Perfect or some important things missing? What of these is secure?

The algorithm should take a string and a &quot;password&quot; for encryption and then encrypt the string with that password. The output should be a string (hex or base64?) again. Decryption should be possible as well, of course.

**What is the perfect AES implementation for Android?**

**Implementation #1:**

	import java.security.MessageDigest;
	import java.security.NoSuchAlgorithmException;
	import java.security.NoSuchProviderException;
	import java.security.SecureRandom;

	import javax.crypto.Cipher;
	import javax.crypto.SecretKey;
	import javax.crypto.SecretKeyFactory;
	import javax.crypto.spec.IvParameterSpec;
	import javax.crypto.spec.PBEKeySpec;
	import javax.crypto.spec.SecretKeySpec;

	public class AdvancedCrypto implements ICrypto {

			public static final String PROVIDER = &quot;BC&quot;;
			public static final int SALT_LENGTH = 20;
			public static final int IV_LENGTH = 16;
			public static final int PBE_ITERATION_COUNT = 100;

			private static final String RANDOM_ALGORITHM = &quot;SHA1PRNG&quot;;
			private static final String HASH_ALGORITHM = &quot;SHA-512&quot;;
			private static final String PBE_ALGORITHM = &quot;PBEWithSHA256And256BitAES-CBC-BC&quot;;
			private static final String CIPHER_ALGORITHM = &quot;AES/CBC/PKCS5Padding&quot;;
			private static final String SECRET_KEY_ALGORITHM = &quot;AES&quot;;

			public String encrypt(SecretKey secret, String cleartext) throws CryptoException {
					try {

							byte[] iv = generateIv();
							String ivHex = HexEncoder.toHex(iv);
							IvParameterSpec ivspec = new IvParameterSpec(iv);

							Cipher encryptionCipher = Cipher.getInstance(CIPHER_ALGORITHM, PROVIDER);
							encryptionCipher.init(Cipher.ENCRYPT_MODE, secret, ivspec);
							byte[] encryptedText = encryptionCipher.doFinal(cleartext.getBytes(&quot;UTF-8&quot;));
							String encryptedHex = HexEncoder.toHex(encryptedText);

							return ivHex + encryptedHex;

					} catch (Exception e) {
							throw new CryptoException(&quot;Unable to encrypt&quot;, e);
					}
			}

			public String decrypt(SecretKey secret, String encrypted) throws CryptoException {
					try {
							Cipher decryptionCipher = Cipher.getInstance(CIPHER_ALGORITHM, PROVIDER);
							String ivHex = encrypted.substring(0, IV_LENGTH * 2);
							String encryptedHex = encrypted.substring(IV_LENGTH * 2);
							IvParameterSpec ivspec = new IvParameterSpec(HexEncoder.toByte(ivHex));
							decryptionCipher.init(Cipher.DECRYPT_MODE, secret, ivspec);
							byte[] decryptedText = decryptionCipher.doFinal(HexEncoder.toByte(encryptedHex));
							String decrypted = new String(decryptedText, &quot;UTF-8&quot;);
							return decrypted;
					} catch (Exception e) {
							throw new CryptoException(&quot;Unable to decrypt&quot;, e);
					}
			}

			public SecretKey getSecretKey(String password, String salt) throws CryptoException {
					try {
							PBEKeySpec pbeKeySpec = new PBEKeySpec(password.toCharArray(), HexEncoder.toByte(salt), PBE_ITERATION_COUNT, 256);
							SecretKeyFactory factory = SecretKeyFactory.getInstance(PBE_ALGORITHM, PROVIDER);
							SecretKey tmp = factory.generateSecret(pbeKeySpec);
							SecretKey secret = new SecretKeySpec(tmp.getEncoded(), SECRET_KEY_ALGORITHM);
							return secret;
					} catch (Exception e) {
							throw new CryptoException(&quot;Unable to get secret key&quot;, e);
					}
			}

			public String getHash(String password, String salt) throws CryptoException {
					try {
							String input = password + salt;
							MessageDigest md = MessageDigest.getInstance(HASH_ALGORITHM, PROVIDER);
							byte[] out = md.digest(input.getBytes(&quot;UTF-8&quot;));
							return HexEncoder.toHex(out);
					} catch (Exception e) {
							throw new CryptoException(&quot;Unable to get hash&quot;, e);
					}
			}

			public String generateSalt() throws CryptoException {
					try {
							SecureRandom random = SecureRandom.getInstance(RANDOM_ALGORITHM);
							byte[] salt = new byte[SALT_LENGTH];
							random.nextBytes(salt);
							String saltHex = HexEncoder.toHex(salt);
							return saltHex;
					} catch (Exception e) {
							throw new CryptoException(&quot;Unable to generate salt&quot;, e);
					}
			}

			private byte[] generateIv() throws NoSuchAlgorithmException, NoSuchProviderException {
					SecureRandom random = SecureRandom.getInstance(RANDOM_ALGORITHM);
					byte[] iv = new byte[IV_LENGTH];
					random.nextBytes(iv);
					return iv;
			}

	}

Source: [http://pocket-for-android.1047292.n5.nabble.com/Encryption-method-and-reading-the-Dropbox-backup-td4344194.html][1]

**Implementation #2:**

	import java.security.SecureRandom;

	import javax.crypto.Cipher;
	import javax.crypto.KeyGenerator;
	import javax.crypto.SecretKey;
	import javax.crypto.spec.SecretKeySpec;

	/**
	 * Usage:
	 * &lt;pre&gt;
	 * String crypto = SimpleCrypto.encrypt(masterpassword, cleartext)
	 * ...
	 * String cleartext = SimpleCrypto.decrypt(masterpassword, crypto)
	 * &lt;/pre&gt;
	 * @author ferenc.hechler
	 */
	public class SimpleCrypto {

		public static String encrypt(String seed, String cleartext) throws Exception {
			byte[] rawKey = getRawKey(seed.getBytes());
			byte[] result = encrypt(rawKey, cleartext.getBytes());
			return toHex(result);
		}
		
		public static String decrypt(String seed, String encrypted) throws Exception {
			byte[] rawKey = getRawKey(seed.getBytes());
			byte[] enc = toByte(encrypted);
			byte[] result = decrypt(rawKey, enc);
			return new String(result);
		}

		private static byte[] getRawKey(byte[] seed) throws Exception {
			KeyGenerator kgen = KeyGenerator.getInstance(&quot;AES&quot;);
			SecureRandom sr = SecureRandom.getInstance(&quot;SHA1PRNG&quot;);
			sr.setSeed(seed);
			kgen.init(128, sr); // 192 and 256 bits may not be available
			SecretKey skey = kgen.generateKey();
			byte[] raw = skey.getEncoded();
			return raw;
		}

		
		private static byte[] encrypt(byte[] raw, byte[] clear) throws Exception {
			SecretKeySpec skeySpec = new SecretKeySpec(raw, &quot;AES&quot;);
			Cipher cipher = Cipher.getInstance(&quot;AES&quot;);
			cipher.init(Cipher.ENCRYPT_MODE, skeySpec);
			byte[] encrypted = cipher.doFinal(clear);
			return encrypted;
		}

		private static byte[] decrypt(byte[] raw, byte[] encrypted) throws Exception {
			SecretKeySpec skeySpec = new SecretKeySpec(raw, &quot;AES&quot;);
			Cipher cipher = Cipher.getInstance(&quot;AES&quot;);
			cipher.init(Cipher.DECRYPT_MODE, skeySpec);
			byte[] decrypted = cipher.doFinal(encrypted);
			return decrypted;
		}

		public static String toHex(String txt) {
			return toHex(txt.getBytes());
		}
		public static String fromHex(String hex) {
			return new String(toByte(hex));
		}
		
		public static byte[] toByte(String hexString) {
			int len = hexString.length()/2;
			byte[] result = new byte[len];
			for (int i = 0; i &lt; len; i++)
				result[i] = Integer.valueOf(hexString.substring(2*i, 2*i+2), 16).byteValue();
			return result;
		}

		public static String toHex(byte[] buf) {
			if (buf == null)
				return &quot;&quot;;
			StringBuffer result = new StringBuffer(2*buf.length);
			for (int i = 0; i &lt; buf.length; i++) {
				appendHex(result, buf[i]);
			}
			return result.toString();
		}
		private final static String HEX = &quot;0123456789ABCDEF&quot;;
		private static void appendHex(StringBuffer sb, byte b) {
			sb.append(HEX.charAt((b&gt;&gt;4)&amp;0x0f)).append(HEX.charAt(b&amp;0x0f));
		}
		
	}

Source: [http://www.tutorials-android.com/learn/How_to_encrypt_and_decrypt_strings.rhtml][2]


  [1]: http://pocket-for-android.1047292.n5.nabble.com/Encryption-method-and-reading-the-Dropbox-backup-td4344194.html
  [2]: http://www.tutorials-android.com/learn/How_to_encrypt_and_decrypt_strings.rhtml

Content Type	Original Author	Original Content on Stackoverflow
Question	Bart van Heukelom	View Question on Stackoverflow
Solution 1 - Java	BalusC	View Answer on Stackoverflow
Solution 2 - Java	Paŭlo Ebermann	View Answer on Stackoverflow
Solution 3 - Java	ddso	View Answer on Stackoverflow
Solution 4 - Java	Anton Yuriev	View Answer on Stackoverflow

Is Cipher thread-safe?

Java Problem Overview

Java Solutions

Solution 1 - Java

Solution 2 - Java

Solution 3 - Java

Solution 4 - Java

How are asynchronous signal handlers executed on Linux?

Non-test methods in a Python TestCase

Attributions