Weak Encryption: Byte Array to String Conversion

Converting an encryption key to a String can lead to a significant loss of entropy.

Weak Encryption: Byte Array to String Conversion issues occur when:

1. An encryption key is created as a byte array


2. The data is converted to a StringExample 1: The following code creates an encryption key and then converts it into a String.

import javax.crypto.KeyGenerator;
import javax.crypto.SecretKey;
  ...
  KeyGenerator keygen = KeyGenerator.newInstance("AES");
  ...
  SecretKey cryptoKey = keygen.generateKey();
  byte[] rawCryptoKey = cryptoKey.getEncoded();
  ...
  String key = new String(rawCryptoKey);
  ...

This converts a cryptographic key into a String using the default system character set, however it is unspecified as to what happens when the constructor is given bytes outside the valid range of this character set. As it is, key will likely have a significant loss of entropy compared to the original encryption key rawCryptoKey.