[Jasypt] properties파일 암호화

Jasypt : http://www.jasypt.org/bouncy-castle.html

eGovFramework 가이드 : http://www.egovframe.go.kr/wiki/doku.php?id=egovframework:rte2:fdl:encryption_decryption

1. Jasypt JAR파일 추가(필수)

(1) Maven repository를 사용할경우.

아래 소스와 같이 spring 3.0x 에 맞는 라이브러리가 있다. 그리고 icu4j는 Java 5 SE 이하 버전일 경우에만 추가하고 Java 6 SE 버전 이상일 경우에는 내장된 Normalizer 패키지를 사용하므로 하단의 com.ibm.icu 라이브러리를 추가하지 않는다.

    <!-- JASYPT: Spring 3.0x Simplified Encryption -->
    <dependency>
        <groupId>org.jasypt</groupId>
        <artifactId>jasypt-spring3</artifactId>
        <version>1.9.0</version>
    </dependency>
 
    <!-- JASYPT: com.ibm.icu.text.Normalizer -->
    <dependency>
        <groupId>com.ibm.icu</groupId>
        <artifactId>icu4j</artifactId>
        <version>49.1</version>
    </dependency>

(2) maven이 아닐경우 jar파일을 다운받아서 추가.

http://www.jasypt.org/download.html

jasypt-1.7.jar

jasypt-spring3-1.9.0.jar

나중에 적용된걸 보니 버전이 다른 jar파일을 추가했었다..(1.7, 1.9.0) 

근데 호환이 되는듯하고 암/복호화에는 이상이 없어 그냥 사용하기도 했다.

2. BouncyCastleProvider JAR Library 추가(PBEWITHSHA256AND128BITAES-CBC-BC을 사용할경우우에만 추가한다. MD5AndDES을 사용할경우 생략한다.)

http://www.bouncycastle.org/latest_releases.html 참조

bcprov-ext-jdk15on-152.jar

bcprov-jdk15on-152.jar

3. DataSource Configuration (XML) 설정

(1) PBEWithMD5AndDES일경우

    <bean id="environmentVariablesConfiguration" class="org.jasypt.encryption.pbe.config.EnvironmentStringPBEConfig">
        <property name="algorithm" value="PBEWithMD5AndDES" />
        <property name="passwordEnvName" value="APP_ENCRYPTION_PASSWORD" />
    </bean>
  
    <bean id="configurationEncryptor" class="org.jasypt.encryption.pbe.StandardPBEStringEncryptor">
        <property name="config" ref="environmentVariablesConfiguration" />
        <property name="password" value="jasyptPass" />
    </bean>
 
<!--     <bean id="propertyConfig" class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer"> -->
    <bean id="propertyConfig" class="org.jasypt.spring3.properties.EncryptablePropertyPlaceholderConfigurer">
        <constructor-arg ref="configurationEncryptor" />
        <property name="locations">
            <list>
                <value>classpath:property/${server.type}/jdbc.properties</value>
            </list>
        </property>
    </bean>

(2) PBEWITHSHA256AND128BITAES-CBC-BC일경우(또는 PBEWITHSHA256AND256BITAES-CBC-BC)

    <bean id="bouncyCastleProvider" class="org.bouncycastle.jce.provider.BouncyCastleProvider"/>
    
       <bean id="environmentVariablesConfiguration" class="org.jasypt.encryption.pbe.config.EnvironmentStringPBEConfig">
        <property name="provider"          ref="bouncyCastleProvider" />
        <property name="algorithm"          value="PBEWITHSHA256AND128BITAES-CBC-BC" />
        <property name="passwordEnvName" value="APP_ENCRYPTION_PASSWORD" />
    </bean>
  
    <bean id="configurationEncryptor" class="org.jasypt.encryption.pbe.StandardPBEStringEncryptor">
        <property name="config" ref="environmentVariablesConfiguration" />
        <property name="password" value="jasyptPass" />
    </bean>
 
<!--     <bean id="propertyConfig" class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer"> -->
    <bean id="propertyConfig" class="org.jasypt.spring3.properties.EncryptablePropertyPlaceholderConfigurer">
        <constructor-arg ref="configurationEncryptor" />
        <property name="locations">
            <list>
                <value>classpath:property/${server.type}/jdbc.properties</value>
            </list>
        </property>
    </bean>

4. 암호화값 생성

(1) PBEWithMD5AndDES일경우

public class TestClass {
    public static void main(String[] args) {
        
        StandardPBEStringEncryptor pbeEnc = new StandardPBEStringEncryptor();
        
        pbeEnc.setAlgorithm("PBEWithMD5AndDES");
        pbeEnc.setPassword("jasyptPass"); // PBE 값(XML PASSWORD설정)
        
        String url = pbeEnc.encrypt("jdbc:oracle:thin:@127.0.0.1:1521:XE");
        String username = pbeEnc.encrypt("system");
        String password = pbeEnc.encrypt("bogogt");
        
        System.out.println(url);
        System.out.println(username);
        System.out.println(password);
    }
}

(2) PBEWITHSHA256AND128BITAES-CBC-BC일경우(또는 PBEWITHSHA256AND256BITAES-CBC-BC)

public class TestClass {
    public static void main(String[] args) {
        Security.addProvider(new BouncyCastleProvider());
        StandardPBEStringEncryptor pbeEnc = new StandardPBEStringEncryptor();
        
        pbeEnc.setProviderName("BC"); // jce provider name
        pbeEnc.setAlgorithm("PBEWITHSHA256AND128BITAES-CBC-BC"); // AES 256bit도 가능
        pbeEnc.setPassword("com.korail");
         
        String url = pbeEnc.encrypt("jdbc:oracle:thin:@127.0.0.1:1521:XE");
        String username = pbeEnc.encrypt("system");
        
        System.out.println(url);
        System.out.println(username);
        
        System.out.println(pbeEnc.decrypt(url));
        System.out.println(pbeEnc.decrypt(username));
        
        System.out.println(pbeEnc.decrypt("2iOnc1A4VlTLHq01iaQLzxDGnCeF1gi/a0YcuZWZsr/97vmcEXH+Ziylq6GCZbiWSySzUdBJoKvBAu+7d5ND0g=="));
        System.out.println(pbeEnc.decrypt("WmAFQNWpOYHpkZV7BrArP9YDrTO4vVxKBexlYgudCCB7gFQXW3n7VEKhhdexuHfN8xcW4uM2UekaIAdjy2vMeg=="));
    }
}

※ main프로그램을 돌렸는데 아래와같은 에러가 발생한경우.

Caused by: org.jasypt.exceptions.EncryptionOperationNotPossibleException: Encryption raised an exception. A possible cause is you are using strong encryption algorithms and you have not installed the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files in this Java Virtual Machine

1. 아래경로에 접속해서 파일을 다운받은 후

http://www.oracle.com/technetwork/java/javase/downloads/jce-7-download-432124.html

2. local_policy.jar, US_export_policy.jar파일을 아래경로에 붙여넣기한다.(덮어쓰기)

Window : 'java jdk파일이 설치된 경로'/jre/lib/security/

그외(예시) : /Library/Java/JavaVirtualMachines/jdk1.7.0_09.jdk/Contents/Home/jre/lib/security/

참조 : http://gomp.tistory.com/218

5. jdbc.properties 파일값 암호화

이때 유의할 점은 ENC를 빼고 값을 대입하면 Jasypt에서 일반 문자열로 인식을 하게 되므로 암호화한 문자열 값 앞에 ENC로 감싸도록 한다.

jdbc.class=core.log.jdbc.driver.OracleDriver
jdbc.url=ENC(Gy4gVR9Avw3UT5VY+PazSk6sbtj2fQ7O/UWFK/8L9kdt2yu+KUlblP9T9ZfC7YbOfDddtJKtcu2ZJ3LdlnA4CA==)
jdbc.username=ENC(Bn99RC2G5TfZTIvnKohrDWZIolbPwzPJ8xBk8CRMj6w=)
jdbc.password=ENC(61svOxQ6MM6NYoBkX7gYwJGRL4IX4SdXSQ39qn30b0A=)