0

What's the optimal method to obscure String

For learning purposes I've decided to dig in a bit more into Java Serialization, most of it is fine. However I've been coming across this weird issue when trying to apply simple obscuring to String values.

Situation breakdown: I'm looking to 'obscure' not encrypt certain data that is passed from Profile Creation frame. Adding simple noise to all the profile details such as Profile Username, Password, Name, Surname etc.

The desired result is simple and works at times and sometimes it simply misses certain characters. Example:

Profile name: "John" is then turned into " ~nh#j@o^ " and ofcourse de-obscured back to "John"

The issue presents itself in the obscuring part. I'm printing the results to check if everything is alright, instead of "John" it will lose certain characters(1-2) and continue adding characters, like so:

Profile name: "John" is then turned into " ~n#j@o^ " and then de-obscured back to "Jon"

Which is a strange issue. I've looked around in articles and sort of 'mimicked' the obscuring style so that I wouldn't go way off touch.

Here is an example of how my Profile name is obscured:

                String nFirstCut = p.getName().substring(0, nSplit); //The first 'slice'
                String nSecondCut = p.getName().substring(nSplit+1, nSplit*2); //The second 'slice'
                String nThirdCut = p.getName().substring(nSplit*2+1); //The third 'slice'

                /*
                 * New Obscured name is now - second 'slice' + randomCharacter + first 'slice'
                 * + randomCharacter + third 'slice'
                 */
                String nObcName = nSecondCut + obcChars[q] + nFirstCut
                        + obcChars[r] + nThirdCut + obcChars[s];
                p.setName(nObcName);

Note: nSplit is simple the length of getName() divided by 3(To produce 3 'slices')

Also, wanted to add. This is far worse when trying to obscure the password from a JPasswordField#getPassword() as opposed to JTextField#getText(). Not sure as to why either

Juxhin
  • 5,068
  • 8
  • 29
  • 55
  • 1
    Why isnt a simple base64 encoding scheme applicable here? The distinction between 'obscuring, and encrypting' is poorly defined here at best. – Mark W Jul 28 '14 at 19:00
  • I'm sorry, I'm not as knowledgeable as most and still am learning. Hence why my question title clearly(as opposed to my distinction between obscuring and encryption) states what is the 'optimal' method for this. I have never said your encoding scheme doesn't work, I simply said I don't know what I ought to use. Hope this clears it up – Juxhin Jul 28 '14 at 19:02
  • I believe base64 encoding is provided in the standard JDK. It takes a byte array / string or whatever and returns an encoded array of bytes, and also decodes them. Base64 is just a simple encryption provider. Useful for simple encryption tasks, probably suited well for stuff like this. – Mark W Jul 28 '14 at 19:15
  • Ah very well wasn't aware of that, thanks! I'm currently checking out the link Stanislav left below in the answer. If you do have time I kindly ask you to check it out and give me your thoughts on it, whether I should use Base64 encoding or the method provided in the link - https://gist.github.com/slevental/0c902da60a1f6f931420 – Juxhin Jul 28 '14 at 19:17

1 Answers1

1

Looks like concurrency issue, maybe you could try to extract method call p.getName() into local variable, to be sure that you're working with the same instance of name

Take a look at how Jetty does this : https://gist.github.com/slevental/0c902da60a1f6f931420

Stanislav Levental
  • 2,165
  • 1
  • 14
  • 28
  • Yea I have tried that already. The method is repeated in a for-each whilst iterating through a serialized profile. When debugging it without the noise it was working just fine – Juxhin Jul 28 '14 at 18:56
  • Have you tried to synchronize the method using a lock, to make sure that this is not a race condition? – Stanislav Levental Jul 28 '14 at 18:58
  • I'm giving that link a look. Thanks for posting! – Juxhin Jul 28 '14 at 19:04
  • I've given this a try. So far the obscuring is working greater than I could've possibly asked for. The link was very useful. I still need to deobscure and make sure all the characters are returned properly – Juxhin Jul 28 '14 at 19:28