Java tutorial
/* * $HeadURL: http://juliusdavies.ca/svn/not-yet-commons-ssl/tags/commons-ssl-0.3.16/src/java/org/apache/commons/ssl/OpenSSL.java $ * $Revision: 144 $ * $Date: 2009-05-25 11:14:29 -0700 (Mon, 25 May 2009) $ * * ==================================================================== * Licensed to the Apache Software Foundation (ASF) under one * or more contributor license agreements. See the NOTICE file * distributed with this work for additional information * regarding copyright ownership. The ASF licenses this file * to you under the Apache License, Version 2.0 (the * "License"); you may not use this file except in compliance * with the License. You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, * software distributed under the License is distributed on an * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY * KIND, either express or implied. See the License for the * specific language governing permissions and limitations * under the License. * ==================================================================== * * This software consists of voluntary contributions made by many * individuals on behalf of the Apache Software Foundation. For more * information on the Apache Software Foundation, please see * <http://www.apache.org/>. * */ package org.apache.commons.ssl; import org.apache.kerby.util.Base64; import org.apache.kerby.util.Base64InputStream; import org.apache.kerby.util.Hex; import org.apache.kerby.util.Util; import javax.crypto.Cipher; import javax.crypto.CipherInputStream; import java.io.BufferedInputStream; import java.io.BufferedOutputStream; import java.io.ByteArrayInputStream; import java.io.FileInputStream; import java.io.IOException; import java.io.InputStream; import java.security.GeneralSecurityException; import java.security.MessageDigest; import java.security.NoSuchAlgorithmException; import java.security.SecureRandom; import java.util.StringTokenizer; /** * Class for encrypting or decrypting data with a password (PBE - password * based encryption). Compatible with "openssl enc" unix utility. An OpenSSL * compatible cipher name must be specified along with the password (try "man enc" on a * unix box to see what's possible). Some examples: * <ul><li>des, des3, des-ede3-cbc * <li>aes128, aes192, aes256, aes-256-cbc * <li>rc2, rc4, bf</ul> * <pre> * <em style="color: green;">// Encrypt!</em> * byte[] encryptedData = OpenSSL.encrypt( "des3", password, data ); * </pre> * <p/> * If you want to specify a raw key and iv directly (without using PBE), use * the methods that take byte[] key, byte[] iv. Those byte[] arrays can be * the raw binary, or they can be ascii (hex representation: '0' - 'F'). If * you want to use PBE to derive the key and iv, then use the methods that * take char[] password. * <p/> * This class is able to decrypt files encrypted with "openssl" unix utility. * <p/> * The "openssl" unix utility is able to decrypt files encrypted by this class. * <p/> * This class is also able to encrypt and decrypt its own files. * * @author <a href="mailto:juliusdavies@cucbc.com">juliusdavies@gmail.com</a> * @since 18-Oct-2007 */ public class OpenSSL { /** * Decrypts data using a password and an OpenSSL compatible cipher * name. * * @param cipher The OpenSSL compatible cipher to use (try "man enc" on a * unix box to see what's possible). Some examples: * <ul><li>des, des3, des-ede3-cbc * <li>aes128, aes192, aes256, aes-256-cbc * <li>rc2, rc4, bf</ul> * @param pwd password to use for this PBE decryption * @param encrypted byte array to decrypt. Can be raw, or base64. * @return decrypted bytes * @throws java.io.IOException problems with encrypted bytes (unlikely!) * @throws java.security.GeneralSecurityException problems decrypting */ public static byte[] decrypt(String cipher, char[] pwd, byte[] encrypted) throws IOException, GeneralSecurityException { ByteArrayInputStream in = new ByteArrayInputStream(encrypted); InputStream decrypted = decrypt(cipher, pwd, in); return Util.streamToBytes(decrypted); } /** * Decrypts data using a password and an OpenSSL compatible cipher * name. * * @param cipher The OpenSSL compatible cipher to use (try "man enc" on a * unix box to see what's possible). Some examples: * <ul><li>des, des3, des-ede3-cbc * <li>aes128, aes192, aes256, aes-256-cbc * <li>rc2, rc4, bf</ul> * @param pwd password to use for this PBE decryption * @param encrypted InputStream to decrypt. Can be raw, or base64. * @return decrypted bytes as an InputStream * @throws java.io.IOException problems with InputStream * @throws java.security.GeneralSecurityException problems decrypting */ public static InputStream decrypt(String cipher, char[] pwd, InputStream encrypted) throws IOException, GeneralSecurityException { CipherInfo cipherInfo = lookup(cipher); boolean salted = false; // First 16 bytes of raw binary will hopefully be OpenSSL's // "Salted__[8 bytes of hex]" thing. Might be in Base64, though. byte[] saltLine = Util.streamToBytes(encrypted, 16); if (saltLine.length <= 0) { throw new IOException("encrypted InputStream is empty"); } String firstEightBytes = ""; if (saltLine.length >= 8) { firstEightBytes = new String(saltLine, 0, 8); } if ("SALTED__".equalsIgnoreCase(firstEightBytes)) { salted = true; } else { // Maybe the reason we didn't find the salt is because we're in // base64. if (Base64.isArrayByteBase64(saltLine)) { InputStream head = new ByteArrayInputStream(saltLine); // Need to put that 16 byte "saltLine" back into the Stream. encrypted = new ComboInputStream(head, encrypted); encrypted = new Base64InputStream(encrypted); saltLine = Util.streamToBytes(encrypted, 16); if (saltLine.length >= 8) { firstEightBytes = new String(saltLine, 0, 8); } if ("SALTED__".equalsIgnoreCase(firstEightBytes)) { salted = true; } } } byte[] salt = null; if (salted) { salt = new byte[8]; System.arraycopy(saltLine, 8, salt, 0, 8); } else { // Encrypted data wasn't salted. Need to put the "saltLine" we // extracted back into the stream. InputStream head = new ByteArrayInputStream(saltLine); encrypted = new ComboInputStream(head, encrypted); } int keySize = cipherInfo.keySize; int ivSize = cipherInfo.ivSize; boolean des2 = cipherInfo.des2; DerivedKey dk = deriveKey(pwd, salt, keySize, ivSize, des2); Cipher c = PKCS8Key.generateCipher(cipherInfo.javaCipher, cipherInfo.blockMode, dk, des2, null, true); return new CipherInputStream(encrypted, c); } /** * Encrypts data using a password and an OpenSSL compatible cipher * name. * * @param cipher The OpenSSL compatible cipher to use (try "man enc" on a * unix box to see what's possible). Some examples: * <ul><li>des, des3, des-ede3-cbc * <li>aes128, aes192, aes256, aes-256-cbc * <li>rc2, rc4, bf</ul> * @param pwd password to use for this PBE encryption * @param data byte array to encrypt * @return encrypted bytes as an array in base64. First 16 bytes include the * special OpenSSL "Salted__" info encoded into base64. * @throws java.io.IOException problems with the data byte array * @throws java.security.GeneralSecurityException problems encrypting */ public static byte[] encrypt(String cipher, char[] pwd, byte[] data) throws IOException, GeneralSecurityException { // base64 is the default output format. return encrypt(cipher, pwd, data, true); } /** * Encrypts data using a password and an OpenSSL compatible cipher * name. * * @param cipher The OpenSSL compatible cipher to use (try "man enc" on a * unix box to see what's possible). Some examples: * <ul><li>des, des3, des-ede3-cbc * <li>aes128, aes192, aes256, aes-256-cbc * <li>rc2, rc4, bf</ul> * @param pwd password to use for this PBE encryption * @param data InputStream to encrypt * @return encrypted bytes as an InputStream. First 16 bytes include the * special OpenSSL "Salted__" info encoded into base64. * @throws java.io.IOException problems with the data InputStream * @throws java.security.GeneralSecurityException problems encrypting */ public static InputStream encrypt(String cipher, char[] pwd, InputStream data) throws IOException, GeneralSecurityException { // base64 is the default output format. return encrypt(cipher, pwd, data, true); } /** * Encrypts data using a password and an OpenSSL compatible cipher * name. * * @param cipher The OpenSSL compatible cipher to use (try "man enc" on a * unix box to see what's possible). Some examples: * <ul><li>des, des3, des-ede3-cbc * <li>aes128, aes192, aes256, aes-256-cbc * <li>rc2, rc4, bf</ul> * @param pwd password to use for this PBE encryption * @param data byte array to encrypt * @param toBase64 true if resulting InputStream should contain base64, * <br>false if InputStream should contain raw binary. * @return encrypted bytes as an array. First 16 bytes include the * special OpenSSL "Salted__" info. * @throws java.io.IOException problems with the data byte array * @throws java.security.GeneralSecurityException problems encrypting */ public static byte[] encrypt(String cipher, char[] pwd, byte[] data, boolean toBase64) throws IOException, GeneralSecurityException { // we use a salt by default. return encrypt(cipher, pwd, data, toBase64, true); } /** * Encrypts data using a password and an OpenSSL compatible cipher * name. * * @param cipher The OpenSSL compatible cipher to use (try "man enc" on a * unix box to see what's possible). Some examples: * <ul><li>des, des3, des-ede3-cbc * <li>aes128, aes192, aes256, aes-256-cbc * <li>rc2, rc4, bf</ul> * @param pwd password to use for this PBE encryption * @param data InputStream to encrypt * @param toBase64 true if resulting InputStream should contain base64, * <br>false if InputStream should contain raw binary. * @return encrypted bytes as an InputStream. First 16 bytes include the * special OpenSSL "Salted__" info. * @throws java.io.IOException problems with the data InputStream * @throws java.security.GeneralSecurityException problems encrypting */ public static InputStream encrypt(String cipher, char[] pwd, InputStream data, boolean toBase64) throws IOException, GeneralSecurityException { // we use a salt by default. return encrypt(cipher, pwd, data, toBase64, true); } /** * Encrypts data using a password and an OpenSSL compatible cipher * name. * * @param cipher The OpenSSL compatible cipher to use (try "man enc" on a * unix box to see what's possible). Some examples: * <ul><li>des, des3, des-ede3-cbc * <li>aes128, aes192, aes256, aes-256-cbc * <li>rc2, rc4, bf</ul> * @param pwd password to use for this PBE encryption * @param data byte array to encrypt * @param toBase64 true if resulting InputStream should contain base64, * <br>false if InputStream should contain raw binary. * @param useSalt true if a salt should be used to derive the key. * <br>false otherwise. (Best security practises * always recommend using a salt!). * @return encrypted bytes as an array. First 16 bytes include the * special OpenSSL "Salted__" info if <code>useSalt</code> is true. * @throws java.io.IOException problems with the data InputStream * @throws java.security.GeneralSecurityException problems encrypting */ public static byte[] encrypt(String cipher, char[] pwd, byte[] data, boolean toBase64, boolean useSalt) throws IOException, GeneralSecurityException { ByteArrayInputStream in = new ByteArrayInputStream(data); InputStream encrypted = encrypt(cipher, pwd, in, toBase64, useSalt); return Util.streamToBytes(encrypted); } /** * Encrypts data using a password and an OpenSSL compatible cipher * name. * * @param cipher The OpenSSL compatible cipher to use (try "man enc" on a * unix box to see what's possible). Some examples: * <ul><li>des, des3, des-ede3-cbc * <li>aes128, aes192, aes256, aes-256-cbc * <li>rc2, rc4, bf</ul> * @param pwd password to use for this PBE encryption * @param data InputStream to encrypt * @param toBase64 true if resulting InputStream should contain base64, * <br>false if InputStream should contain raw binary. * @param useSalt true if a salt should be used to derive the key. * <br>false otherwise. (Best security practises * always recommend using a salt!). * @return encrypted bytes as an InputStream. First 16 bytes include the * special OpenSSL "Salted__" info if <code>useSalt</code> is true. * @throws java.io.IOException problems with the data InputStream * @throws java.security.GeneralSecurityException problems encrypting */ public static InputStream encrypt(String cipher, char[] pwd, InputStream data, boolean toBase64, boolean useSalt) throws IOException, GeneralSecurityException { CipherInfo cipherInfo = lookup(cipher); byte[] salt = null; if (useSalt) { SecureRandom rand = SecureRandom.getInstance("SHA1PRNG"); salt = new byte[8]; rand.nextBytes(salt); } int keySize = cipherInfo.keySize; int ivSize = cipherInfo.ivSize; boolean des2 = cipherInfo.des2; DerivedKey dk = deriveKey(pwd, salt, keySize, ivSize, des2); Cipher c = PKCS8Key.generateCipher(cipherInfo.javaCipher, cipherInfo.blockMode, dk, des2, null, false); InputStream cipherStream = new CipherInputStream(data, c); if (useSalt) { byte[] saltLine = new byte[16]; byte[] salted = "Salted__".getBytes(); System.arraycopy(salted, 0, saltLine, 0, salted.length); System.arraycopy(salt, 0, saltLine, salted.length, salt.length); InputStream head = new ByteArrayInputStream(saltLine); cipherStream = new ComboInputStream(head, cipherStream); } if (toBase64) { cipherStream = new Base64InputStream(cipherStream, true); } return cipherStream; } public static byte[] decrypt(String cipher, byte[] key, byte[] iv, byte[] encrypted) throws IOException, GeneralSecurityException { ByteArrayInputStream in = new ByteArrayInputStream(encrypted); InputStream decrypted = decrypt(cipher, key, iv, in); return Util.streamToBytes(decrypted); } public static InputStream decrypt(String cipher, byte[] key, byte[] iv, InputStream encrypted) throws IOException, GeneralSecurityException { CipherInfo cipherInfo = lookup(cipher); byte[] firstLine = Util.streamToBytes(encrypted, 16); if (Base64.isArrayByteBase64(firstLine)) { InputStream head = new ByteArrayInputStream(firstLine); // Need to put that 16 byte "firstLine" back into the Stream. encrypted = new ComboInputStream(head, encrypted); encrypted = new Base64InputStream(encrypted); } else { // Encrypted data wasn't base64. Need to put the "firstLine" we // extracted back into the stream. InputStream head = new ByteArrayInputStream(firstLine); encrypted = new ComboInputStream(head, encrypted); } int keySize = cipherInfo.keySize; int ivSize = cipherInfo.ivSize; // Looks like key is in hex if (key.length == keySize / 4) { key = Hex.decode(key); } // Looks like IV is in hex if (iv.length == ivSize / 4) { iv = Hex.decode(iv); } DerivedKey dk = new DerivedKey(key, iv); Cipher c = PKCS8Key.generateCipher(cipherInfo.javaCipher, cipherInfo.blockMode, dk, cipherInfo.des2, null, true); return new CipherInputStream(encrypted, c); } public static byte[] encrypt(String cipher, byte[] key, byte[] iv, byte[] data) throws IOException, GeneralSecurityException { return encrypt(cipher, key, iv, data, true); } public static byte[] encrypt(String cipher, byte[] key, byte[] iv, byte[] data, boolean toBase64) throws IOException, GeneralSecurityException { ByteArrayInputStream in = new ByteArrayInputStream(data); InputStream encrypted = encrypt(cipher, key, iv, in, toBase64); return Util.streamToBytes(encrypted); } public static InputStream encrypt(String cipher, byte[] key, byte[] iv, InputStream data) throws IOException, GeneralSecurityException { return encrypt(cipher, key, iv, data, true); } public static InputStream encrypt(String cipher, byte[] key, byte[] iv, InputStream data, boolean toBase64) throws IOException, GeneralSecurityException { CipherInfo cipherInfo = lookup(cipher); int keySize = cipherInfo.keySize; int ivSize = cipherInfo.ivSize; if (key.length == keySize / 4) { key = Hex.decode(key); } if (iv.length == ivSize / 4) { iv = Hex.decode(iv); } DerivedKey dk = new DerivedKey(key, iv); Cipher c = PKCS8Key.generateCipher(cipherInfo.javaCipher, cipherInfo.blockMode, dk, cipherInfo.des2, null, false); InputStream cipherStream = new CipherInputStream(data, c); if (toBase64) { cipherStream = new Base64InputStream(cipherStream, true); } return cipherStream; } public static DerivedKey deriveKey(char[] password, byte[] salt, int keySize, boolean des2) throws NoSuchAlgorithmException { return deriveKey(password, salt, keySize, 0, des2); } @SuppressWarnings("PMD.UselessParentheses") public static DerivedKey deriveKey(char[] password, byte[] salt, int keySize, int ivSize, boolean des2) throws NoSuchAlgorithmException { if (des2) { keySize = 128; } MessageDigest md = MessageDigest.getInstance("MD5"); byte[] pwdAsBytes = new byte[password.length]; for (int i = 0; i < password.length; i++) { pwdAsBytes[i] = (byte) password[i]; } md.reset(); byte[] keyAndIv = new byte[(keySize / 8) + (ivSize / 8)]; if (salt == null || salt.length == 0) { // Unsalted! Bad idea! salt = null; } byte[] result; int currentPos = 0; while (currentPos < keyAndIv.length) { md.update(pwdAsBytes); if (salt != null) { // First 8 bytes of salt ONLY! That wasn't obvious to me // when using AES encrypted private keys in "Traditional // SSLeay Format". // // Example: // DEK-Info: AES-128-CBC,8DA91D5A71988E3D4431D9C2C009F249 // // Only the first 8 bytes are salt, but the whole thing is // re-used again later as the IV. MUCH gnashing of teeth! md.update(salt, 0, 8); } result = md.digest(); int stillNeed = keyAndIv.length - currentPos; // Digest gave us more than we need. Let's truncate it. if (result.length > stillNeed) { byte[] b = new byte[stillNeed]; System.arraycopy(result, 0, b, 0, b.length); result = b; } System.arraycopy(result, 0, keyAndIv, currentPos, result.length); currentPos += result.length; if (currentPos < keyAndIv.length) { // Next round starts with a hash of the hash. md.reset(); md.update(result); } } if (des2) { keySize = 192; byte[] buf = new byte[keyAndIv.length + 8]; // Make space where 3rd key needs to go (16th - 24th bytes): System.arraycopy(keyAndIv, 0, buf, 0, 16); if (ivSize > 0) { System.arraycopy(keyAndIv, 16, buf, 24, keyAndIv.length - 16); } keyAndIv = buf; // copy first 8 bytes into last 8 bytes to create 2DES key. System.arraycopy(keyAndIv, 0, keyAndIv, 16, 8); } if (ivSize == 0) { // if ivSize == 0, then "keyAndIv" array is actually all key. // Must be "Traditional SSLeay Format" encrypted private key in // PEM. The "salt" in its entirety (not just first 8 bytes) will // probably be re-used later as the IV (initialization vector). return new DerivedKey(keyAndIv, salt); } else { byte[] key = new byte[keySize / 8]; byte[] iv = new byte[ivSize / 8]; System.arraycopy(keyAndIv, 0, key, 0, key.length); System.arraycopy(keyAndIv, key.length, iv, 0, iv.length); return new DerivedKey(key, iv); } } public static class CipherInfo { public final String javaCipher; public final String blockMode; public final int keySize; public final int ivSize; public final boolean des2; public CipherInfo(String javaCipher, String blockMode, int keySize, int ivSize, boolean des2) { this.javaCipher = javaCipher; this.blockMode = blockMode; this.keySize = keySize; this.ivSize = ivSize; this.des2 = des2; } public String toString() { return javaCipher + "/" + blockMode + " " + keySize + "bit des2=" + des2; } } /** * Converts the way OpenSSL names its ciphers into a Java-friendly naming. * * @param openSSLCipher OpenSSL cipher name, e.g. "des3" or "des-ede3-cbc". * Try "man enc" on a unix box to see what's possible. * @return CipherInfo object with the Java-friendly cipher information. */ public static CipherInfo lookup(String openSSLCipher) { openSSLCipher = openSSLCipher.trim(); if (openSSLCipher.charAt(0) == '-') { openSSLCipher = openSSLCipher.substring(1); } String javaCipher = openSSLCipher.toUpperCase(); String blockMode = "CBC"; int keySize = -1; int ivSize = 64; boolean des2 = false; StringTokenizer st = new StringTokenizer(openSSLCipher, "-"); if (st.hasMoreTokens()) { javaCipher = st.nextToken().toUpperCase(); if (st.hasMoreTokens()) { // Is this the middle token? Or the last token? String tok = st.nextToken(); if (st.hasMoreTokens()) { try { keySize = Integer.parseInt(tok); } catch (NumberFormatException nfe) { // I guess 2nd token isn't an integer String upper = tok.toUpperCase(); if (upper.startsWith("EDE3")) { javaCipher = "DESede"; } else if (upper.startsWith("EDE")) { javaCipher = "DESede"; des2 = true; } } blockMode = st.nextToken().toUpperCase(); } else { try { keySize = Integer.parseInt(tok); } catch (NumberFormatException nfe) { // It's the last token, so must be mode (usually "CBC"). blockMode = tok.toUpperCase(); if (blockMode.startsWith("EDE3")) { javaCipher = "DESede"; blockMode = "ECB"; } else if (blockMode.startsWith("EDE")) { javaCipher = "DESede"; blockMode = "ECB"; des2 = true; } } } } } if (javaCipher.startsWith("BF")) { javaCipher = "Blowfish"; } else if (javaCipher.startsWith("TWOFISH")) { javaCipher = "Twofish"; ivSize = 128; } else if (javaCipher.startsWith("IDEA")) { javaCipher = "IDEA"; } else if (javaCipher.startsWith("CAST6")) { javaCipher = "CAST6"; ivSize = 128; } else if (javaCipher.startsWith("CAST")) { javaCipher = "CAST5"; } else if (javaCipher.startsWith("GOST")) { keySize = 256; } else if (javaCipher.startsWith("DESX")) { javaCipher = "DESX"; } else if ("DES3".equals(javaCipher)) { javaCipher = "DESede"; } else if ("DES2".equals(javaCipher)) { javaCipher = "DESede"; des2 = true; } else if (javaCipher.startsWith("RIJNDAEL")) { javaCipher = "Rijndael"; ivSize = 128; } else if (javaCipher.startsWith("SEED")) { javaCipher = "SEED"; ivSize = 128; } else if (javaCipher.startsWith("SERPENT")) { javaCipher = "Serpent"; ivSize = 128; } else if (javaCipher.startsWith("Skipjack")) { javaCipher = "Skipjack"; ivSize = 128; } else if (javaCipher.startsWith("RC6")) { javaCipher = "RC6"; ivSize = 128; } else if (javaCipher.startsWith("TEA")) { javaCipher = "TEA"; } else if (javaCipher.startsWith("XTEA")) { javaCipher = "XTEA"; } else if (javaCipher.startsWith("AES")) { if (javaCipher.startsWith("AES128")) { keySize = 128; } else if (javaCipher.startsWith("AES192")) { keySize = 192; } else if (javaCipher.startsWith("AES256")) { keySize = 256; } javaCipher = "AES"; ivSize = 128; } else if (javaCipher.startsWith("CAMELLIA")) { if (javaCipher.startsWith("CAMELLIA128")) { keySize = 128; } else if (javaCipher.startsWith("CAMELLIA192")) { keySize = 192; } else if (javaCipher.startsWith("CAMELLIA256")) { keySize = 256; } javaCipher = "CAMELLIA"; ivSize = 128; } if (keySize == -1) { if (javaCipher.startsWith("DESede")) { keySize = 192; } else if (javaCipher.startsWith("DES")) { keySize = 64; } else { // RC2, RC4, RC5 and Blowfish ? keySize = 128; } } return new CipherInfo(javaCipher, blockMode, keySize, ivSize, des2); } /** * @param args command line arguments: [password] [cipher] [file-to-decrypt] * <br>[cipher] == OpenSSL cipher name, e.g. "des3" or "des-ede3-cbc". * Try "man enc" on a unix box to see what's possible. * @throws java.io.IOException problems with the [file-to-decrypt] * @throws java.security.GeneralSecurityException decryption problems */ public static void main(String[] args) throws IOException, GeneralSecurityException { if (args.length < 3) { System.out.println(Version.versionString()); System.out.println("Pure-java utility to decrypt files previously encrypted by \'openssl enc\'"); System.out.println(); System.out.println("Usage: java -cp commons-ssl.jar org.apache.commons.ssl.OpenSSL [args]"); System.out.println(" [args] == [password] [cipher] [file-to-decrypt]"); System.out.println(" [cipher] == des, des3, des-ede3-cbc, aes256, rc2, rc4, bf, bf-cbc, etc..."); System.out.println(" Try 'man enc' on a unix box to see what's possible."); System.out.println(); System.out.println("This utility can handle base64 or raw, salted or unsalted."); System.out.println(); System.exit(1); } char[] password = args[0].toCharArray(); InputStream in = new FileInputStream(args[2]); in = decrypt(args[1], password, in); // in = encrypt( args[ 1 ], pwdAsBytes, in, true ); in = new BufferedInputStream(in); BufferedOutputStream bufOut = new BufferedOutputStream(System.out); Util.pipeStream(in, bufOut, false); bufOut.flush(); System.out.flush(); } }