I am trying to serialize a Message object using ObjectOutputStream ,take the byte[ ] output of the serializer,encrypt it using an encryption tool and then trying to de-serialize it and cast it as an object. It gives an error - invalid stream header. Is it not possible to modify the OutputStream after serializing it and then de-serialize it? Excuse me if I am doing something atrocious, I am a novice to Java. Code for the serializer - serialMsg():

ByteArrayOutputStream bos = new ByteArrayOutputStream();
ObjectOutputStream out = new ObjectOutputStream(bos);
bytes = bos.toByteArray();

The output of the serializer is then used as below:

byte[] data = this.serialMsg(); // This is where I serialize the Message object
byte[] out = util.Encrypt(data, fromsk , to.toString(), param); // This is where I encrypt the byte[ ] - data and obtain an encrypted byte [ ] - out

The object is then de-serialised as:

ByteArrayInputStream in = new ByteArrayInputStream(out);
ObjectInputStream objin = new ObjectInputStream(in) ;
msg = (Message)objin.readObject(); // This is where I cast the output of readObject into the type Message - the original type of the object that was serialized.

I hope the objective behind this is clear. I am trying to modify the output stream and then trying to cast it back into the original type.


The serialization API makes a specific promise: If you save the bytes created by a serialize() call, you can later feed them into a deserialize() call, and your object will be reconstructed. That is all it does.

You are doing something different: you are feeding a different stream of data to the deserializer. That isn't in its job description, so unsurprisingly it fails. It doesn't matter that the new data stream is intimately related to the original one; all that matters is that it isn't the same one.

To achieve what you want, you would have to understand how the serialization process works and custom-craft your transformation so that the reverse operation would succeed. That is technically possible, but it would mean that you basically have to do all the work that the library is supposed to do for you. At that point, there is no longer much point in using it at all, and you're better off using a different mechanism that serializes and encrypts data the way you want to.

Luckily, there are solutions that do both. See https://stackoverflow.com/questions/16950833/is-there-an-easy-way-to-encrypt-a-java-object for an example of a previous question about similar requirements.

  • @ Kilian Foth. Thanks. But I don't think I will be able to use the suggestions given in the link posted. I need to encrypt it but retain the type as Message only. It has several other dependencies so changing the output type will be a difficult proposition. – Hashtag Apr 14 '15 at 12:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.