I have written some code to encrypt XML and then store it on the disk. I want to be sure that the encryption code is secure, so here is the code:package com.application;import java.io.UnsupportedEncodingException;import java.lang.reflect.Field;import java.security.Key;import java.security.MessageDigest;import java.security.NoSuchAlgorithmException;import java.security.spec.AlgorithmParameterSpec;import javax.crypto.BadPaddingException;import javax.crypto.Cipher;import javax.crypto.spec.IvParameterSpec;import javax.crypto.spec.SecretKeySpec;public class Aes {    public Aes() {    }    public String encrypt(String data, String key) {        try {            Cipher cipher = Cipher.getInstance(AES/CBC/PKCS5Padding);            String iv = generateRandomIv();            cipher.init(Cipher.ENCRYPT_MODE, makeKey(key), makeIv(iv));            return iv + System.getProperty(line.separator) + new String(cipher.doFinal(data.getBytes(ISO-8859-1)), ISO-8859-1);        } catch (Exception e) {            throw new RuntimeException(e);        }    }    public String decrypt(String data, String key) throws WrongPasswordException {        String decrypted = ;        try {            Cipher cipher = Cipher.getInstance(AES/CBC/PKCS5Padding);            String iv = getIv(data);            cipher.init(Cipher.DECRYPT_MODE, makeKey(key), makeIv(iv));            decrypted = new String(cipher.doFinal(removeIvFromString(data).getBytes(ISO-8859-1)), ISO-8859-1);        }        catch (BadPaddingException e) {            throw new WrongPasswordException();        }        catch (Exception e) {            throw new RuntimeException(e);        }        return decrypted;    }    private AlgorithmParameterSpec makeIv(String iv) {        try {            return new IvParameterSpec(iv.getBytes(UTF-8));        } catch (UnsupportedEncodingException e) {            e.printStackTrace();        }        return null;    }    private String generateRandomIv() {        return new RandomStringGenerator().randomString(16);    }    private String getIv(String data) {        return data.substring(0, data.indexOf(System.getProperty(line.separator)));    }    private String removeIvFromString(String data) {        return data.substring(data.indexOf(System.getProperty(line.separator)) + 1, data.length());    }    private Key makeKey(String encryptionKey) {        try {            MessageDigest md = MessageDigest.getInstance(SHA-256);            byte[] key = md.digest(encryptionKey.getBytes(UTF-8));            return new SecretKeySpec(key, AES);        } catch (NoSuchAlgorithmException e) {            e.printStackTrace();        } catch (UnsupportedEncodingException e) {            e.printStackTrace();        }        return null;    }}package com.application;import org.apache.commons.lang3.ArrayUtils;import java.util.ArrayList;import java.util.Random;public class RandomStringGenerator {    private char[] vowelLowerCaseLetter = {'a', 'e', 'i', 'o', 'u', 'y'};    private char[] consonantsLowerCaseLetter = {'b','c','d','f','g','h','j','k','l','m','n','p','q','r','s','t','v','w','x','z'};    private char[] numbers = {'1', '2', '3', '4', '5', '6', '7', '8', '9', '0'};    private char[] specialCharacters = {'!', '', '@', '#', '', '', '$', '%', '&', '/', '{', '(', '[', ')', ']', '=', '}', '?', '+', '\\',            '', '', '~', '^', '*', '\'', '-', '_', '.', ':', ',', ';', ' ', '', '', '<', '>'};    public String randomString(int length) {        char[] upperCaseLetter = convertCharsToUpperCase(ArrayUtils.addAll(vowelLowerCaseLetter, consonantsLowerCaseLetter));        char[] lowerCaseLetter = ArrayUtils.addAll(vowelLowerCaseLetter, consonantsLowerCaseLetter);        char[] allowedCharacters = ArrayUtils.addAll(ArrayUtils.addAll(lowerCaseLetter, upperCaseLetter), ArrayUtils.addAll(numbers, specialCharacters));        String randomString = ;        for (int i = 0; i < length; i++) {            randomString += getRandomCharacter(allowedCharacters);        }        return randomString;    }    private char getRandomCharacter(char[] allowedCharacters) {        Random r = new Random();        return allowedCharacters[r.nextInt(allowedCharacters.length)];    }    private char[] convertCharsToUpperCase(char[] lowerCaseLetter) {        char[] upperCaseLetters = new char[lowerCaseLetter.length];        for (int i = 0; i < lowerCaseLetter.length; i++) {            upperCaseLetters[i] = Character.toUpperCase(lowerCaseLetter[i]);        }        return upperCaseLetters;    }}
Encypt XML file with AES and storing on disk
java;security;xml;cryptography
Binary data != stringpublic String encrypt(String data, String key) {    ...        new String(cipher.doFinal(data.getBytes(ISO-8859-1)), ISO-8859-1);    ...}Here you get a byte[] with the input data encrypted. This is arbitrary binary data. Do not treat binary data as strings.It only works because you are using an encoding with a single byte per character.When you want to store binary data as a string you should use Base64 encoding instead:import java.util.Base64;public String encrypt(String data, String key) {    try {        Cipher cipher = Cipher.getInstance(AES/CBC/PKCS5Padding);        String iv = generateRandomIv();        cipher.init(Cipher.ENCRYPT_MODE, makeKey(key), makeIv(iv));        byte[] cipherBytes = cipher.doFinal(data.getBytes(StandardCharsets.UTF_8));        String base64CipherText = Base64.getEncoder().encodeToString(cipherBytes);        return iv + System.getProperty(line.separator) + base64CipherText;    } catch (Exception e) {        throw new RuntimeException(e);    }}public String decrypt(String data, String key) throws WrongPasswordException {    String decrypted = ;    try {        Cipher cipher = Cipher.getInstance(AES/CBC/PKCS5Padding);        String iv = getIv(data);        cipher.init(Cipher.DECRYPT_MODE, makeKey(key), makeIv(iv));        byte[] cipherBytes = Base64.getDecoder().decode(removeIvFromString(data));        decrypted = new String(cipher.doFinal(cipherBytes), StandardCharsets.UTF_8);    }    catch (BadPaddingException e) {        throw new WrongPasswordException();    }    catch (Exception e) {        throw new RuntimeException(e);    }    return decrypted;}Now that the encoding issues are fixed you should consider using UTF-8 (or another portable encoding) for the String.getBytes.