# Which is better: “serialize and then encrypt” or “encrypt and then serialize”?

Let say in a simple Java program, Considering all the facts, like security and performance, Which is the best way to follow. I tried searching for a answer but proper answer is not out there.

Which is better: “serialize and then encrypt” or “encrypt and then serialize”?

• How would you encrypt the data before serialization? – otus Nov 21 '15 at 5:40
• by using sealedObject in javax.crypto . we can pass an already sealedObject to a byte array stream and then Serialize it. – Raveen Athapaththu Nov 21 '15 at 6:37
• The SealedObject class serializes and then encrypts the object. What's your alternative? – otus Nov 21 '15 at 9:05
• Note that you should keep in mind that SealedObject only claims confidentiality, and that there are several attacks on de-serialization of Java objects possible. I.e. if you use it, make sure that you aren't vulnerable against attackers being able to alter the encrypted objects before you try to unseal them. – Maarten Bodewes Nov 21 '15 at 14:38
• Two remarks: if you use SealedObject you need to perform serialization of the SealedObject instance if you require a binary representation. This is of course a nicely standardized way of doing things, but it also adds overhead you may want to avoid. Oh, and you can use GCM to seal objects, but I'm not sure this is secure if you serialize / de-serialize the SealedObject itself (I sure hope this was considered, but SealedObject only claims confidentiality and the de-serialization of SealedObject happens before decryption). – Maarten Bodewes Nov 21 '15 at 15:13