title: Is this Java encryption code thread safe?
body: <p>I want to use the following code for a high-concurrency application where certain data must be encrypted and decrypted. So I need to know what part of this code should be synchronized, if any, to avoid unpredictable issues.</p>
  
  <pre><code>public class DesEncrypter {
      Cipher ecipher;
      Cipher dcipher;
  
      // 8-byte Salt
      byte[] salt = {
          (byte)0xA9, (byte)0x9B, (byte)0xC8, (byte)0x32,
          (byte)0x56, (byte)0x35, (byte)0xE3, (byte)0x03
      };
  
      int iterationCount = 19;
  
      DesEncrypter(String passPhrase) {
          try {
              // Create the key
              KeySpec keySpec = new PBEKeySpec(passPhrase.toCharArray(), salt, iterationCount);
  
              SecretKey key = SecretKeyFactory.getInstance( "PBEWithMD5AndDES").generateSecret(keySpec);
              ecipher = Cipher.getInstance(key.getAlgorithm());
              dcipher = Cipher.getInstance(key.getAlgorithm());
  
              // Prepare the parameter to the ciphers
              AlgorithmParameterSpec paramSpec = new PBEParameterSpec(salt, iterationCount);
  
              // Create the ciphers
              ecipher.init(Cipher.ENCRYPT_MODE, key, paramSpec);
              dcipher.init(Cipher.DECRYPT_MODE, key, paramSpec);
          } catch (...)
      }
  
      public String encrypt(String str) {
          try {
              // Encode the string into bytes using utf-8
              byte[] utf8 = str.getBytes("UTF8");
              // Encrypt
              byte[] enc = ecipher.doFinal(utf8);
              // Encode bytes to base64 to get a string
              return new sun.misc.BASE64Encoder().encode(enc);
  
          } catch (...)
      }
  
      public String decrypt(String str) {
          try {
              // Decode base64 to get bytes
              byte[] dec = new sun.misc.BASE64Decoder().decodeBuffer(str);
              // Decrypt
              byte[] utf8 = dcipher.doFinal(dec);
              // Decode using utf-8
              return new String(utf8, "UTF8");
          } catch (...)
      }
  }
  </code></pre>
  
  <p>If I create a new cipher in the encrypt() and decrypt() methods for each invocation, then I can avoid concurrency problems, I'm just not sure if there's a lot of overhead in getting a new instance of a cipher for each invocation.</p>
  
  <pre><code>   public String encrypt(String str) {
          try {
              // Encode the string into bytes using utf-8
              byte[] utf8 = str.getBytes("UTF8");
              // Encrypt
              //new cipher instance
              ecipher = Cipher.getInstance(key.getAlgorithm());
  
              byte[] enc = ecipher.doFinal(utf8);
              // Encode bytes to base64 to get a string
              return new sun.misc.BASE64Encoder().encode(enc);
  
          } catch (...)
  </code></pre>