title: What algorithm to use when creating an encrypting log4j appender
body: <p>I've created a RollingFileAppender which encrypts the output to a log4j log file.
  Currently it uses AES/ECB/NoPadding, and it works fine.</p>
  
  <p>Here is how we create the cipher</p>
  
  <pre><code>public static Cipher getCipher(boolean encrypt) throws Exception {
      //https://en.wikipedia.org/wiki/Stream_cipher       
      byte[] key = ("sometestkey").getBytes("UTF-8");
      MessageDigest sha = MessageDigest.getInstance("SHA-1");
      key = sha.digest(key);
      key = Arrays.copyOf(key, 16); // use only first 128 bit
  
      Key k = new SecretKeySpec(key,"AES");
      Cipher cipher = Cipher.getInstance("AES/ECB/NoPadding");
      if (encrypt) {
          cipher.init(Cipher.ENCRYPT_MODE, k);
      } else {
          cipher.init(Cipher.DECRYPT_MODE, k);
      }
      return cipher;
  }
  </code></pre>
  
  <p>Here's how we create the appender :</p>
  
  <pre><code>public class EncryptingRollingFileAppender extends RollingFileAppender {
      private CipherOutputStream s;
      private Cipher cipher; 
      public EncryptingRollingFileAppender() {super();}
      public EncryptingRollingFileAppender(Layout layout, String filename, boolean append) throws IOException {super(layout, filename, append);}
      public EncryptingRollingFileAppender(Layout layout, String filename) throws IOException {super(layout, filename);}
  
      @Override
      protected OutputStreamWriter createWriter(OutputStream outputStream) {
          if (cipher==null) {
              try {
                  cipher = DecryptionTools.getCipher(true);
                  s = new CipherOutputStream(outputStream, cipher);
              } catch (Throwable t) {
                  throw new RuntimeException("failed to initialise encrypting file appender",t);
              }
          }
          OutputStreamWriter out = super.createWriter(s);
          return out;
      }   
  }
  </code></pre>
  
  <p>We can decrypt the file by using </p>
  
  <blockquote>
    <p>getCipher(false)</p>
  </blockquote>
  
  <p>to create an appropriate decryption stream.</p>
  
  <p>The issue is that our security team are haggling about key management.
  They don't like the use symetric key encryption, and would prefer us to use a key pair rather than a simple password that we have to manage in some way.</p>
  
  <p><strong>Does anyone know of a non-padding ECB encryption technique that would use a key pair, and would be appropriate for this kind of stream encryption and decryption?</strong></p>