Crypto Best Practices

@Configuration
public class PasswordConfig {
    
    @Bean
    public PasswordEncoder passwordEncoder() {
        // BCrypt with strength 12 (2^12 = 4096 rounds)
        return new BCryptPasswordEncoder(12);
    }
}

@Service
public class UserService {
    
    @Autowired
    private PasswordEncoder passwordEncoder;
    
    @Autowired
    private UserRepository userRepository;
    
    public void createUser(String username, String plainPassword) {
        // Hash password before storing
        String hashedPassword = passwordEncoder.encode(plainPassword);
        
        User user = new User();
        user.setUsername(username);
        user.setPassword(hashedPassword);  // Never store plain text!
        
        userRepository.save(user);
    }
    
    public boolean authenticate(String username, String plainPassword) {
        User user = userRepository.findByUsername(username)
            .orElseThrow(() -> new UsernameNotFoundException("User not found"));
        
        // Verify password
        return passwordEncoder.matches(plainPassword, user.getPassword());
    }
    
    public void changePassword(String username, String oldPassword, String newPassword) {
        User user = userRepository.findByUsername(username)
            .orElseThrow(() -> new UsernameNotFoundException("User not found"));
        
        // Verify old password
        if (!passwordEncoder.matches(oldPassword, user.getPassword())) {
            throw new BadCredentialsException("Current password is incorrect");
        }
        
        // Hash and store new password
        user.setPassword(passwordEncoder.encode(newPassword));
        userRepository.save(user);
    }
}

@Component
public class PasswordValidator {
    
    private static final int MIN_LENGTH = 12;
    private static final Pattern UPPERCASE = Pattern.compile("[A-Z]");
    private static final Pattern LOWERCASE = Pattern.compile("[a-z]");
    private static final Pattern DIGIT = Pattern.compile("[0-9]");
    private static final Pattern SPECIAL = Pattern.compile("[!@#$%^&*(),.?\":{}|<>]");
    
    public void validatePassword(String password) throws ValidationException {
        List<String> errors = new ArrayList<>();
        
        if (password == null || password.length() < MIN_LENGTH) {
            errors.add("Password must be at least " + MIN_LENGTH + " characters");
        }
        
        if (!UPPERCASE.matcher(password).find()) {
            errors.add("Password must contain at least one uppercase letter");
        }
        
        if (!LOWERCASE.matcher(password).find()) {
            errors.add("Password must contain at least one lowercase letter");
        }
        
        if (!DIGIT.matcher(password).find()) {
            errors.add("Password must contain at least one digit");
        }
        
        if (!SPECIAL.matcher(password).find()) {
            errors.add("Password must contain at least one special character");
        }
        
        // Check against common passwords
        if (isCommonPassword(password)) {
            errors.add("Password is too common, choose a stronger password");
        }
        
        if (!errors.isEmpty()) {
            throw new ValidationException("Password validation failed: " + 
                String.join(", ", errors));
        }
    }
    
    private boolean isCommonPassword(String password) {
        // Check against list of 10,000 most common passwords
        Set<String> commonPasswords = loadCommonPasswords();
        return commonPasswords.contains(password.toLowerCase());
    }
}

@Configuration
public class EncryptionConfig {
    
    @Bean
    public TextEncryptor textEncryptor() {
        String encryptionKey = System.getenv("ENCRYPTION_KEY");
        String salt = System.getenv("ENCRYPTION_SALT");
        
        return Encryptors.text(encryptionKey, salt);
    }
    
    @Bean
    public BytesEncryptor bytesEncryptor() {
        String encryptionKey = System.getenv("ENCRYPTION_KEY");
        String salt = System.getenv("ENCRYPTION_SALT");
        
        return Encryptors.stronger(encryptionKey, salt);
    }
}

@Service
public class DataEncryptionService {
    
    @Autowired
    private BytesEncryptor encryptor;
    
    /**
     * Encrypt sensitive data before storing in database
     */
    public byte[] encrypt(String plaintext) {
        if (plaintext == null) return null;
        return encryptor.encrypt(plaintext.getBytes(StandardCharsets.UTF_8));
    }
    
    /**
     * Decrypt data retrieved from database
     */
    public String decrypt(byte[] ciphertext) {
        if (ciphertext == null) return null;
        byte[] decrypted = encryptor.decrypt(ciphertext);
        return new String(decrypted, StandardCharsets.UTF_8);
    }
}

// Entity with encrypted fields
@Entity
@Table(name = "politician")
public class Politician {
    
    @Id
    private String id;
    
    private String firstName;  // Public data - not encrypted
    
    private String lastName;   // Public data - not encrypted
    
    // Sensitive field - encrypted in database
    @Column(name = "personal_id_encrypted")
    private byte[] personalIdEncrypted;
    
    @Column(name = "email_encrypted")
    private byte[] emailEncrypted;
    
    @Transient
    private transient DataEncryptionService encryptionService;
    
    // Getter/Setter for encrypted field
    public String getPersonalId() {
        return encryptionService.decrypt(personalIdEncrypted);
    }
    
    public void setPersonalId(String personalId) {
        this.personalIdEncrypted = encryptionService.encrypt(personalId);
    }
    
    public String getEmail() {
        return encryptionService.decrypt(emailEncrypted);
    }
    
    public void setEmail(String email) {
        this.emailEncrypted = encryptionService.encrypt(email);
    }
}

@Service
public class AesGcmEncryption {
    
    private static final String ALGORITHM = "AES/GCM/NoPadding";
    private static final int GCM_TAG_LENGTH = 128;
    private static final int GCM_IV_LENGTH = 12;
    private static final int AES_KEY_SIZE = 256;
    
    private final SecretKey secretKey;
    
    public AesGcmEncryption() throws Exception {
        // Load key from secure key management system
        this.secretKey = loadKey();
    }
    
    public byte[] encrypt(byte[] plaintext) throws Exception {
        // Generate random IV (nonce)
        byte[] iv = generateIV();
        
        Cipher cipher = Cipher.getInstance(ALGORITHM);
        GCMParameterSpec spec = new GCMParameterSpec(GCM_TAG_LENGTH, iv);
        cipher.init(Cipher.ENCRYPT_MODE, secretKey, spec);
        
        byte[] ciphertext = cipher.doFinal(plaintext);
        
        // Prepend IV to ciphertext (IV doesn't need to be secret)
        byte[] result = new byte[iv.length + ciphertext.length];
        System.arraycopy(iv, 0, result, 0, iv.length);
        System.arraycopy(ciphertext, 0, result, iv.length, ciphertext.length);
        
        return result;
    }
    
    public byte[] decrypt(byte[] encrypted) throws Exception {
        // Extract IV from beginning
        byte[] iv = new byte[GCM_IV_LENGTH];
        System.arraycopy(encrypted, 0, iv, 0, GCM_IV_LENGTH);
        
        // Extract ciphertext
        byte[] ciphertext = new byte[encrypted.length - GCM_IV_LENGTH];
        System.arraycopy(encrypted, GCM_IV_LENGTH, ciphertext, 0, ciphertext.length);
        
        Cipher cipher = Cipher.getInstance(ALGORITHM);
        GCMParameterSpec spec = new GCMParameterSpec(GCM_TAG_LENGTH, iv);
        cipher.init(Cipher.DECRYPT_MODE, secretKey, spec);
        
        return cipher.doFinal(ciphertext);
    }
    
    private byte[] generateIV() {
        byte[] iv = new byte[GCM_IV_LENGTH];
        SecureRandom random = new SecureRandom();
        random.nextBytes(iv);
        return iv;
    }
    
    private SecretKey loadKey() throws Exception {
        // Load from AWS Secrets Manager, Vault, or secure keystore
        // NEVER hardcode encryption keys!
        String base64Key = System.getenv("AES_ENCRYPTION_KEY");
        byte[] decodedKey = Base64.getDecoder().decode(base64Key);
        return new SecretKeySpec(decodedKey, "AES");
    }
}

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
           maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
           clientAuth="false" sslProtocol="TLS"
           sslEnabledProtocols="TLSv1.3,TLSv1.2"
           ciphers="TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
           keystoreFile="${SSL_KEYSTORE_PATH}"
           keystorePass="${SSL_KEYSTORE_PASSWORD}"
           keystoreType="PKCS12"
           keyAlias="cia-server"/>

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .requiresChannel()
                .anyRequest().requiresSecure()
                .and()
            .headers()
                .httpStrictTransportSecurity()
                    .includeSubDomains(true)
                    .maxAgeInSeconds(31536000)
                    .and()
                .contentSecurityPolicy("default-src 'self'; script-src 'self'; style-src 'self'");
    }
}

# nginx.conf
server {
    listen 443 ssl http2;
    
    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/key.pem;
    
    ssl_protocols TLSv1.3 TLSv1.2;
    ssl_ciphers 'TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384';
    ssl_prefer_server_ciphers on;
    
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    
    location / {
        proxy_pass http://localhost:8080;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}