Code reviewHardcr-g443

Subject Crypto misuseLevel Senior–Staff~22 minCommon in Security interviewsIndustries Software development

Question

Review this Java field-encryption helper used to store PII columns.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix — specific and kind.

Learn the concepts

Talk through your review

Code to reviewjava

1public class FieldCrypto {2    private final SecretKey key; // AES-256, loaded from KMS3 4    public FieldCrypto(SecretKey key) {5        this.key = key;6    }7 8    public byte[] encrypt(byte[] plaintext) throws Exception {9        Cipher c = Cipher.getInstance("AES");10        c.init(Cipher.ENCRYPT_MODE, key);11        return c.doFinal(plaintext);12    }13 14    public String encryptField(String value) throws Exception {15        return Base64.getEncoder().encodeToString(encrypt(value.getBytes(StandardCharsets.UTF_8)));16    }17}

Run or narrate your approach, then ask the coach.