Class CryptoUtil
-
Method Summary
Modifier and TypeMethodDescriptionstatic StringgetSaltedPassword(byte[] password, String algorithm) Creates an RFC 2307-compliant salted, hashed password with the SHA1 or SHA-256 MessageDigest algorithm.static voidConvenience method for hashing and verifying salted SHA-1 or SHA-256 passwords from the command line.static booleanverifySaltedPassword(byte[] password, String entry) Compares a password to a given entry and returns true, if it matches.
-
Method Details
-
main
Convenience method for hashing and verifying salted SHA-1 or SHA-256 passwords from the command line. This method requires
commons-codec-1.3.jar(or a newer version) to be on the classpath. Command line arguments are as follows:--hash password SSHA- hashes password and prints a password digest that looks like this:{SSHA}yfT8SRT/WoOuNuA6KbJeF10OznZmb28=--verify password digest- verifies password by extracting the salt from digest (which is identical to what is printed by--hash) and re-computing the digest again using the password and salt. If the password supplied is the same as the one used to create the original digest,truewill be printed; otherwisefalse
For example, one way to use this utility is to change to JSPWiki's
builddirectory and type the following command:java -cp JSPWiki.jar:../lib/commons-codec-1.3.jar org.apache.wiki.util.CryptoUtil --hash mynewpassword- Parameters:
args- arguments for this method as described above- Throws:
Exception- Catches nothing; throws everything up.
-
getSaltedPassword
public static String getSaltedPassword(byte[] password, String algorithm) throws NoSuchAlgorithmException Creates an RFC 2307-compliant salted, hashed password with the SHA1 or SHA-256 MessageDigest algorithm. After the password is digested, the first 20 or 32 bytes of the digest will be the actual password hash; the remaining bytes will be a randomly generated salt of length
DEFAULT_SALT_SIZE, for example:{SSHA}3cGWem65NCEkF5Ew5AEk45ak8LHUWAwPVXAyyw==In layman's terms, the formula is
digest( secret + salt ) + salt. The resulting digest is Base64-encoded.Note that successive invocations of this method with the same password will result in different hashes! (This, of course, is exactly the point.)
- Parameters:
password- the password to be digested- Returns:
- the Base64-encoded password hash, prepended by
{SSHA}or{SHA256}. - Throws:
NoSuchAlgorithmException- If your JVM does not supply the necessary algorithm. Should not happen.
-
verifySaltedPassword
public static boolean verifySaltedPassword(byte[] password, String entry) throws NoSuchAlgorithmException Compares a password to a given entry and returns true, if it matches.- Parameters:
password- The password in bytes.entry- The password entry, typically starting with {SSHA}.- Returns:
- True, if the password matches.
- Throws:
NoSuchAlgorithmException- If there is no SHA available.
-