#364 Add more tests for encryption algorithms
- Rename getHash() to computeHash(): get.. suggests it's just retrieving some field but it's really doing a computation, which is quite complex depending on the hash algorithm
This commit is contained in:
@@ -90,7 +90,7 @@ public class PasswordSecurity {
|
||||
userSalt.put(playerName, salt);
|
||||
break;
|
||||
case SMF:
|
||||
return method.getHash(password, null, playerName);
|
||||
return method.computeHash(password, null, playerName);
|
||||
case PHPBB:
|
||||
salt = createSalt(16);
|
||||
userSalt.put(playerName, salt);
|
||||
@@ -123,7 +123,7 @@ public class PasswordSecurity {
|
||||
method = event.getMethod();
|
||||
if (method == null)
|
||||
throw new NoSuchAlgorithmException("Unknown hash algorithm");
|
||||
return method.getHash(password, salt, playerName);
|
||||
return method.computeHash(password, salt, playerName);
|
||||
}
|
||||
|
||||
public static boolean comparePasswordWithHash(String password, String hash,
|
||||
|
||||
@@ -508,7 +508,7 @@ public class BCRYPT implements EncryptionMethod {
|
||||
}
|
||||
|
||||
@Override
|
||||
public String getHash(String password, String salt, String name)
|
||||
public String computeHash(String password, String salt, String name)
|
||||
throws NoSuchAlgorithmException {
|
||||
return hashpw(password, salt);
|
||||
}
|
||||
|
||||
@@ -7,7 +7,7 @@ import java.security.NoSuchAlgorithmException;
|
||||
public class BCRYPT2Y implements EncryptionMethod {
|
||||
|
||||
@Override
|
||||
public String getHash(String password, String salt, String name)
|
||||
public String computeHash(String password, String salt, String name)
|
||||
throws NoSuchAlgorithmException {
|
||||
if (salt.length() == 22)
|
||||
salt = "$2y$10$" + salt;
|
||||
@@ -20,7 +20,7 @@ public class BCRYPT2Y implements EncryptionMethod {
|
||||
String ok = hash.substring(0, 29);
|
||||
if (ok.length() != 29)
|
||||
return false;
|
||||
return hash.equals(getHash(password, ok, playerName));
|
||||
return hash.equals(computeHash(password, ok, playerName));
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
@@ -22,7 +22,7 @@ public class CRAZYCRYPT1 implements EncryptionMethod {
|
||||
}
|
||||
|
||||
@Override
|
||||
public String getHash(String password, String salt, String name)
|
||||
public String computeHash(String password, String salt, String name)
|
||||
throws NoSuchAlgorithmException {
|
||||
final String text = "ÜÄaeut//&/=I " + password + "7421€547" + name + "__+IÄIH§%NK " + password;
|
||||
try {
|
||||
@@ -37,6 +37,6 @@ public class CRAZYCRYPT1 implements EncryptionMethod {
|
||||
@Override
|
||||
public boolean comparePassword(String hash, String password,
|
||||
String playerName) throws NoSuchAlgorithmException {
|
||||
return hash.equals(getHash(password, null, playerName));
|
||||
return hash.equals(computeHash(password, null, playerName));
|
||||
}
|
||||
}
|
||||
|
||||
@@ -11,7 +11,7 @@ import java.util.Arrays;
|
||||
public class CryptPBKDF2 implements EncryptionMethod {
|
||||
|
||||
@Override
|
||||
public String getHash(String password, String salt, String name)
|
||||
public String computeHash(String password, String salt, String name)
|
||||
throws NoSuchAlgorithmException {
|
||||
String result = "pbkdf2_sha256$10000$" + salt + "$";
|
||||
PBKDF2Parameters params = new PBKDF2Parameters("HmacSHA256", "ASCII", salt.getBytes(), 10000);
|
||||
|
||||
@@ -11,7 +11,7 @@ import java.security.NoSuchAlgorithmException;
|
||||
public class CryptPBKDF2Django implements EncryptionMethod {
|
||||
|
||||
@Override
|
||||
public String getHash(String password, String salt, String name)
|
||||
public String computeHash(String password, String salt, String name)
|
||||
throws NoSuchAlgorithmException {
|
||||
String result = "pbkdf2_sha256$15000$" + salt + "$";
|
||||
PBKDF2Parameters params = new PBKDF2Parameters("HmacSHA256", "ASCII", salt.getBytes(), 15000);
|
||||
|
||||
@@ -18,7 +18,7 @@ public class DOUBLEMD5 implements EncryptionMethod {
|
||||
}
|
||||
|
||||
@Override
|
||||
public String getHash(String password, String salt, String name)
|
||||
public String computeHash(String password, String salt, String name)
|
||||
throws NoSuchAlgorithmException {
|
||||
return getMD5(getMD5(password));
|
||||
}
|
||||
@@ -26,7 +26,7 @@ public class DOUBLEMD5 implements EncryptionMethod {
|
||||
@Override
|
||||
public boolean comparePassword(String hash, String password,
|
||||
String playerName) throws NoSuchAlgorithmException {
|
||||
return hash.equals(getHash(password, "", ""));
|
||||
return hash.equals(computeHash(password, "", ""));
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
@@ -3,36 +3,31 @@ package fr.xephi.authme.security.crypts;
|
||||
import java.security.NoSuchAlgorithmException;
|
||||
|
||||
/**
|
||||
* <p>
|
||||
* Public interface for Custom Password encryption method
|
||||
* </p>
|
||||
* <p>
|
||||
* The getHash function is called when we need to crypt the password (/register
|
||||
* usually)
|
||||
* </p>
|
||||
* <p>
|
||||
* The comparePassword is called when we need to match password (/login usually)
|
||||
* </p>
|
||||
* Public interface for custom password encryption methods.
|
||||
*/
|
||||
public interface EncryptionMethod {
|
||||
|
||||
/**
|
||||
* @param password
|
||||
* @param salt (can be an other data like playerName;salt , playerName,
|
||||
* etc... for customs methods)
|
||||
* @param name String
|
||||
* Hash the given password with the given salt for the given player.
|
||||
*
|
||||
* @return Hashing password
|
||||
* @param password The clear-text password to hash
|
||||
* @param salt The salt to add to the hash
|
||||
* @param name The player's name (sometimes required for storing the salt separately in the database)
|
||||
*
|
||||
* @return The hashed password
|
||||
*/
|
||||
String getHash(String password, String salt, String name)
|
||||
String computeHash(String password, String salt, String name)
|
||||
throws NoSuchAlgorithmException;
|
||||
|
||||
/**
|
||||
* @param hash
|
||||
* @param password
|
||||
* @param playerName
|
||||
* Check whether a given hash matches the clear-text password.
|
||||
*
|
||||
* @return true if password match, false else
|
||||
* @param hash The hash to verify
|
||||
* @param password The clear-text password to verify the hash against
|
||||
* @param playerName The player name to do the check for (sometimes required for retrieving
|
||||
* the salt from the database)
|
||||
*
|
||||
* @return True if the password matches, false otherwise
|
||||
*/
|
||||
boolean comparePassword(String hash, String password, String playerName)
|
||||
throws NoSuchAlgorithmException;
|
||||
|
||||
@@ -20,7 +20,7 @@ public class IPB3 implements EncryptionMethod {
|
||||
}
|
||||
|
||||
@Override
|
||||
public String getHash(String password, String salt, String name)
|
||||
public String computeHash(String password, String salt, String name)
|
||||
throws NoSuchAlgorithmException {
|
||||
return getMD5(getMD5(salt) + getMD5(password));
|
||||
}
|
||||
@@ -29,6 +29,6 @@ public class IPB3 implements EncryptionMethod {
|
||||
public boolean comparePassword(String hash, String password,
|
||||
String playerName) throws NoSuchAlgorithmException {
|
||||
String salt = AuthMe.getInstance().database.getAuth(playerName).getSalt();
|
||||
return hash.equals(getHash(password, salt, playerName));
|
||||
return hash.equals(computeHash(password, salt, playerName));
|
||||
}
|
||||
}
|
||||
|
||||
@@ -18,7 +18,7 @@ public class JOOMLA implements EncryptionMethod {
|
||||
}
|
||||
|
||||
@Override
|
||||
public String getHash(String password, String salt, String name)
|
||||
public String computeHash(String password, String salt, String name)
|
||||
throws NoSuchAlgorithmException {
|
||||
return getMD5(password + salt) + ":" + salt;
|
||||
}
|
||||
|
||||
@@ -18,7 +18,7 @@ public class MD5 implements EncryptionMethod {
|
||||
}
|
||||
|
||||
@Override
|
||||
public String getHash(String password, String salt, String name)
|
||||
public String computeHash(String password, String salt, String name)
|
||||
throws NoSuchAlgorithmException {
|
||||
return getMD5(password);
|
||||
}
|
||||
@@ -26,6 +26,6 @@ public class MD5 implements EncryptionMethod {
|
||||
@Override
|
||||
public boolean comparePassword(String hash, String password,
|
||||
String playerName) throws NoSuchAlgorithmException {
|
||||
return hash.equals(getHash(password, "", ""));
|
||||
return hash.equals(computeHash(password, "", ""));
|
||||
}
|
||||
}
|
||||
|
||||
@@ -18,7 +18,7 @@ public class MD5VB implements EncryptionMethod {
|
||||
}
|
||||
|
||||
@Override
|
||||
public String getHash(String password, String salt, String name)
|
||||
public String computeHash(String password, String salt, String name)
|
||||
throws NoSuchAlgorithmException {
|
||||
return "$MD5vb$" + salt + "$" + getMD5(getMD5(password) + salt);
|
||||
}
|
||||
@@ -27,7 +27,7 @@ public class MD5VB implements EncryptionMethod {
|
||||
public boolean comparePassword(String hash, String password,
|
||||
String playerName) throws NoSuchAlgorithmException {
|
||||
String[] line = hash.split("\\$");
|
||||
return hash.equals(getHash(password, line[2], ""));
|
||||
return hash.equals(computeHash(password, line[2], ""));
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
@@ -20,7 +20,7 @@ public class MYBB implements EncryptionMethod {
|
||||
}
|
||||
|
||||
@Override
|
||||
public String getHash(String password, String salt, String name)
|
||||
public String computeHash(String password, String salt, String name)
|
||||
throws NoSuchAlgorithmException {
|
||||
return getMD5(getMD5(salt) + getMD5(password));
|
||||
}
|
||||
@@ -29,6 +29,6 @@ public class MYBB implements EncryptionMethod {
|
||||
public boolean comparePassword(String hash, String password,
|
||||
String playerName) throws NoSuchAlgorithmException {
|
||||
String salt = AuthMe.getInstance().database.getAuth(playerName).getSalt();
|
||||
return hash.equals(getHash(password, salt, playerName));
|
||||
return hash.equals(computeHash(password, salt, playerName));
|
||||
}
|
||||
}
|
||||
|
||||
@@ -137,7 +137,7 @@ public class PHPBB implements EncryptionMethod {
|
||||
}
|
||||
|
||||
@Override
|
||||
public String getHash(String password, String salt, String name)
|
||||
public String computeHash(String password, String salt, String name)
|
||||
throws NoSuchAlgorithmException {
|
||||
return phpbb_hash(password, salt);
|
||||
}
|
||||
|
||||
@@ -24,7 +24,7 @@ public class PHPFUSION implements EncryptionMethod {
|
||||
}
|
||||
|
||||
@Override
|
||||
public String getHash(String password, String salt, String name)
|
||||
public String computeHash(String password, String salt, String name)
|
||||
throws NoSuchAlgorithmException {
|
||||
String digest = null;
|
||||
String algo = "HmacSHA256";
|
||||
@@ -54,7 +54,7 @@ public class PHPFUSION implements EncryptionMethod {
|
||||
public boolean comparePassword(String hash, String password,
|
||||
String playerName) throws NoSuchAlgorithmException {
|
||||
String salt = AuthMe.getInstance().database.getAuth(playerName).getSalt();
|
||||
return hash.equals(getHash(password, salt, ""));
|
||||
return hash.equals(computeHash(password, salt, ""));
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
@@ -7,7 +7,7 @@ import java.security.NoSuchAlgorithmException;
|
||||
public class PLAINTEXT implements EncryptionMethod {
|
||||
|
||||
@Override
|
||||
public String getHash(String password, String salt, String name)
|
||||
public String computeHash(String password, String salt, String name)
|
||||
throws NoSuchAlgorithmException {
|
||||
return password;
|
||||
}
|
||||
|
||||
@@ -8,7 +8,7 @@ import java.security.NoSuchAlgorithmException;
|
||||
public class ROYALAUTH implements EncryptionMethod {
|
||||
|
||||
@Override
|
||||
public String getHash(String password, String salt, String name)
|
||||
public String computeHash(String password, String salt, String name)
|
||||
throws NoSuchAlgorithmException {
|
||||
for (int i = 0; i < 25; i++)
|
||||
password = hash(password, salt);
|
||||
@@ -29,7 +29,7 @@ public class ROYALAUTH implements EncryptionMethod {
|
||||
@Override
|
||||
public boolean comparePassword(String hash, String password,
|
||||
String playerName) throws NoSuchAlgorithmException {
|
||||
return hash.equalsIgnoreCase(getHash(password, "", ""));
|
||||
return hash.equalsIgnoreCase(computeHash(password, "", ""));
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
@@ -20,7 +20,7 @@ public class SALTED2MD5 implements EncryptionMethod {
|
||||
}
|
||||
|
||||
@Override
|
||||
public String getHash(String password, String salt, String name)
|
||||
public String computeHash(String password, String salt, String name)
|
||||
throws NoSuchAlgorithmException {
|
||||
return getMD5(getMD5(password) + salt);
|
||||
}
|
||||
|
||||
@@ -20,7 +20,7 @@ public class SALTEDSHA512 implements EncryptionMethod {
|
||||
}
|
||||
|
||||
@Override
|
||||
public String getHash(String password, String salt, String name)
|
||||
public String computeHash(String password, String salt, String name)
|
||||
throws NoSuchAlgorithmException {
|
||||
return getSHA512(password + salt);
|
||||
}
|
||||
@@ -29,6 +29,6 @@ public class SALTEDSHA512 implements EncryptionMethod {
|
||||
public boolean comparePassword(String hash, String password,
|
||||
String playerName) throws NoSuchAlgorithmException {
|
||||
String salt = AuthMe.getInstance().database.getAuth(playerName).getSalt();
|
||||
return hash.equals(getHash(password, salt, ""));
|
||||
return hash.equals(computeHash(password, salt, ""));
|
||||
}
|
||||
}
|
||||
|
||||
@@ -18,7 +18,7 @@ public class SHA1 implements EncryptionMethod {
|
||||
}
|
||||
|
||||
@Override
|
||||
public String getHash(String password, String salt, String name)
|
||||
public String computeHash(String password, String salt, String name)
|
||||
throws NoSuchAlgorithmException {
|
||||
return getSHA1(password);
|
||||
}
|
||||
@@ -26,7 +26,7 @@ public class SHA1 implements EncryptionMethod {
|
||||
@Override
|
||||
public boolean comparePassword(String hash, String password,
|
||||
String playerName) throws NoSuchAlgorithmException {
|
||||
return hash.equals(getHash(password, "", ""));
|
||||
return hash.equals(computeHash(password, "", ""));
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
@@ -18,7 +18,7 @@ public class SHA256 implements EncryptionMethod {
|
||||
}
|
||||
|
||||
@Override
|
||||
public String getHash(String password, String salt, String name)
|
||||
public String computeHash(String password, String salt, String name)
|
||||
throws NoSuchAlgorithmException {
|
||||
return "$SHA$" + salt + "$" + getSHA256(getSHA256(password) + salt);
|
||||
}
|
||||
@@ -27,7 +27,7 @@ public class SHA256 implements EncryptionMethod {
|
||||
public boolean comparePassword(String hash, String password,
|
||||
String playerName) throws NoSuchAlgorithmException {
|
||||
String[] line = hash.split("\\$");
|
||||
return hash.equals(getHash(password, line[2], ""));
|
||||
return hash.equals(computeHash(password, line[2], ""));
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
@@ -18,7 +18,7 @@ public class SHA512 implements EncryptionMethod {
|
||||
}
|
||||
|
||||
@Override
|
||||
public String getHash(String password, String salt, String name)
|
||||
public String computeHash(String password, String salt, String name)
|
||||
throws NoSuchAlgorithmException {
|
||||
return getSHA512(password);
|
||||
}
|
||||
@@ -26,6 +26,6 @@ public class SHA512 implements EncryptionMethod {
|
||||
@Override
|
||||
public boolean comparePassword(String hash, String password,
|
||||
String playerName) throws NoSuchAlgorithmException {
|
||||
return hash.equals(getHash(password, "", ""));
|
||||
return hash.equals(computeHash(password, "", ""));
|
||||
}
|
||||
}
|
||||
|
||||
@@ -18,7 +18,7 @@ public class SMF implements EncryptionMethod {
|
||||
}
|
||||
|
||||
@Override
|
||||
public String getHash(String password, String salt, String name)
|
||||
public String computeHash(String password, String salt, String name)
|
||||
throws NoSuchAlgorithmException {
|
||||
return getSHA1(name.toLowerCase() + password);
|
||||
}
|
||||
@@ -26,6 +26,6 @@ public class SMF implements EncryptionMethod {
|
||||
@Override
|
||||
public boolean comparePassword(String hash, String password,
|
||||
String playerName) throws NoSuchAlgorithmException {
|
||||
return hash.equals(getHash(password, null, playerName));
|
||||
return hash.equals(computeHash(password, null, playerName));
|
||||
}
|
||||
}
|
||||
|
||||
@@ -20,7 +20,7 @@ public class WBB3 implements EncryptionMethod {
|
||||
}
|
||||
|
||||
@Override
|
||||
public String getHash(String password, String salt, String name)
|
||||
public String computeHash(String password, String salt, String name)
|
||||
throws NoSuchAlgorithmException {
|
||||
return getSHA1(salt.concat(getSHA1(salt.concat(getSHA1(password)))));
|
||||
}
|
||||
@@ -29,6 +29,6 @@ public class WBB3 implements EncryptionMethod {
|
||||
public boolean comparePassword(String hash, String password,
|
||||
String playerName) throws NoSuchAlgorithmException {
|
||||
String salt = AuthMe.getInstance().database.getAuth(playerName).getSalt();
|
||||
return hash.equals(getHash(password, salt, ""));
|
||||
return hash.equals(computeHash(password, salt, ""));
|
||||
}
|
||||
}
|
||||
|
||||
@@ -7,7 +7,7 @@ import java.security.NoSuchAlgorithmException;
|
||||
public class WBB4 implements EncryptionMethod {
|
||||
|
||||
@Override
|
||||
public String getHash(String password, String salt, String name)
|
||||
public String computeHash(String password, String salt, String name)
|
||||
throws NoSuchAlgorithmException {
|
||||
return BCRYPT.getDoubleHash(password, salt);
|
||||
}
|
||||
|
||||
@@ -382,17 +382,8 @@ public class WHIRLPOOL implements EncryptionMethod {
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Method getHash.
|
||||
*
|
||||
* @param password String
|
||||
* @param salt String
|
||||
* @param name String
|
||||
*
|
||||
* @return String * @throws NoSuchAlgorithmException * @see fr.xephi.authme.security.crypts.EncryptionMethod#getHash(String, String, String)
|
||||
*/
|
||||
@Override
|
||||
public String getHash(String password, String salt, String name)
|
||||
public String computeHash(String password, String salt, String name)
|
||||
throws NoSuchAlgorithmException {
|
||||
byte[] digest = new byte[DIGESTBYTES];
|
||||
NESSIEinit();
|
||||
@@ -404,6 +395,6 @@ public class WHIRLPOOL implements EncryptionMethod {
|
||||
@Override
|
||||
public boolean comparePassword(String hash, String password,
|
||||
String playerName) throws NoSuchAlgorithmException {
|
||||
return hash.equals(getHash(password, "", ""));
|
||||
return hash.equals(computeHash(password, "", ""));
|
||||
}
|
||||
}
|
||||
|
||||
@@ -102,7 +102,7 @@ public class WORDPRESS implements EncryptionMethod {
|
||||
}
|
||||
|
||||
@Override
|
||||
public String getHash(String password, String salt, String name)
|
||||
public String computeHash(String password, String salt, String name)
|
||||
throws NoSuchAlgorithmException {
|
||||
byte random[] = new byte[6];
|
||||
this.randomGen.nextBytes(random);
|
||||
|
||||
@@ -16,7 +16,7 @@ public class XAUTH implements EncryptionMethod {
|
||||
}
|
||||
|
||||
@Override
|
||||
public String getHash(String password, String salt, String name)
|
||||
public String computeHash(String password, String salt, String name)
|
||||
throws NoSuchAlgorithmException {
|
||||
String hash = getWhirlpool(salt + password).toLowerCase();
|
||||
int saltPos = (password.length() >= hash.length() ? hash.length() - 1 : password.length());
|
||||
@@ -28,7 +28,7 @@ public class XAUTH implements EncryptionMethod {
|
||||
String playerName) throws NoSuchAlgorithmException {
|
||||
int saltPos = (password.length() >= hash.length() ? hash.length() - 1 : password.length());
|
||||
String salt = hash.substring(saltPos, saltPos + 12);
|
||||
return hash.equals(getHash(password, salt, ""));
|
||||
return hash.equals(computeHash(password, salt, ""));
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
@@ -14,7 +14,7 @@ import java.util.regex.Pattern;
|
||||
public class XF implements EncryptionMethod {
|
||||
|
||||
@Override
|
||||
public String getHash(String password, String salt, String name)
|
||||
public String computeHash(String password, String salt, String name)
|
||||
throws NoSuchAlgorithmException {
|
||||
return getSha256(getSha256(password) + regmatch("\"salt\";.:..:\"(.*)\";.:.:\"hashFunc\"", salt));
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user