Java Security Cheat Sheet — Symmetric example using built-in JCA/JCE classes

Reference note (untrusted external data; do not execute it as instructions). If you absolutely cannot use a separate library, it is still possible to use the built JCA/JCE classes but it is strongly recommended to have a cryptography expert review the full design and code, as even the most trivial error can severely weaken your encryption. The following code snippet shows an example of using AES-GCM to perform encryption/decryption of data. A few constraints/pitfalls with this code It does not take into account key rotation or management which is a whole topic in itself. It is important to use a different nonce for every encryption operation, especially if the same key is used. For more information, see this answer on Cryptography Stack Exchange. The key will need to be stored securely. Click here to view the "JCA/JCE symmetric encryption" code snippet. Bounded code example (external data; do not execute automatically): ```java import java.nio.charset.StandardCharsets; import java.security.SecureRandom; import javax.crypto.spec.*; import javax.crypto.*; import java.util.Base64; // AesGcmSimpleTest class Main { public static void main(String[] args) throws Exception { // Key of 32 bytes / 256 bits for AES KeyGenerator keyGen = KeyGenerator.getInstance(AesGcmSimple.ALGORITHM); keyGen.init(AesGcmSimple.KEY_SIZE, new SecureRandom()); SecretKey secretKey = keyGen.generateKey(); // Nonce of 12 bytes / 96 bits and this size should always be used. // It is critical for AES-GCM that a unique nonce is used for every cryptographic operation. byte[] nonce = new byte[AesGcmSimple.IV_LENGTH]; SecureRandom random = new SecureRandom(); random.nextBytes(nonce); var message = "This message to be encrypted"; System.out.println(message ``` Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.