Question

I want to do AES CBC encryption in Java. I’m using javax.crypto. After I have the Cipher initialized, do I only need to call doFinal on the clear bytes to properly encrypt it? Or do I need to do something with update?

Documentation says update:

Continues a multiple-part encryption
or decryption operation

and doFinal

Encrypts or decrypts data in a
single-part operation, or finishes a
multiple-part operation

what exactly do they mean by multiple-part encryption?

Answer 1

doFinal adds the PKCS7 padding in the last block. So you can call update zero to many times, but last call should be an doFinal. Multipart encryption is when the data is not contiguous in memory. Typical example being buffers received from a socket. You set up the cipher and then start calling update to encrypt or decrypt the data, block by block, and build up the encrypted/decrypted data, by appending the blocks returned by update. On last input block you call doFinal and the returned block is the last one to be appended to the output data. On ecnrypting, doFinal will add the padding. On decrypting doFinal will validate and remove the padding.