#364 Add more tests for encryption algorithms

- Rename getHash() to computeHash(): get.. suggests it's just retrieving some field but it's really doing a computation, which is quite complex depending on the hash algorithm
This commit is contained in:
ljacqu
2015-12-20 23:43:54 +01:00
parent f809d91c45
commit 1f11537b85
42 changed files with 291 additions and 83 deletions
@@ -90,7 +90,7 @@ public class PasswordSecurity {
userSalt.put(playerName, salt);
break;
case SMF:
return method.getHash(password, null, playerName);
return method.computeHash(password, null, playerName);
case PHPBB:
salt = createSalt(16);
userSalt.put(playerName, salt);
@@ -123,7 +123,7 @@ public class PasswordSecurity {
method = event.getMethod();
if (method == null)
throw new NoSuchAlgorithmException("Unknown hash algorithm");
return method.getHash(password, salt, playerName);
return method.computeHash(password, salt, playerName);
}
public static boolean comparePasswordWithHash(String password, String hash,
@@ -508,7 +508,7 @@ public class BCRYPT implements EncryptionMethod {
}
@Override
public String getHash(String password, String salt, String name)
public String computeHash(String password, String salt, String name)
throws NoSuchAlgorithmException {
return hashpw(password, salt);
}
@@ -7,7 +7,7 @@ import java.security.NoSuchAlgorithmException;
public class BCRYPT2Y implements EncryptionMethod {
@Override
public String getHash(String password, String salt, String name)
public String computeHash(String password, String salt, String name)
throws NoSuchAlgorithmException {
if (salt.length() == 22)
salt = "$2y$10$" + salt;
@@ -20,7 +20,7 @@ public class BCRYPT2Y implements EncryptionMethod {
String ok = hash.substring(0, 29);
if (ok.length() != 29)
return false;
return hash.equals(getHash(password, ok, playerName));
return hash.equals(computeHash(password, ok, playerName));
}
}
@@ -22,7 +22,7 @@ public class CRAZYCRYPT1 implements EncryptionMethod {
}
@Override
public String getHash(String password, String salt, String name)
public String computeHash(String password, String salt, String name)
throws NoSuchAlgorithmException {
final String text = "ÜÄaeut//&/=I " + password + "7421€547" + name + "__+IÄIH§%NK " + password;
try {
@@ -37,6 +37,6 @@ public class CRAZYCRYPT1 implements EncryptionMethod {
@Override
public boolean comparePassword(String hash, String password,
String playerName) throws NoSuchAlgorithmException {
return hash.equals(getHash(password, null, playerName));
return hash.equals(computeHash(password, null, playerName));
}
}
@@ -11,7 +11,7 @@ import java.util.Arrays;
public class CryptPBKDF2 implements EncryptionMethod {
@Override
public String getHash(String password, String salt, String name)
public String computeHash(String password, String salt, String name)
throws NoSuchAlgorithmException {
String result = "pbkdf2_sha256$10000$" + salt + "$";
PBKDF2Parameters params = new PBKDF2Parameters("HmacSHA256", "ASCII", salt.getBytes(), 10000);
@@ -11,7 +11,7 @@ import java.security.NoSuchAlgorithmException;
public class CryptPBKDF2Django implements EncryptionMethod {
@Override
public String getHash(String password, String salt, String name)
public String computeHash(String password, String salt, String name)
throws NoSuchAlgorithmException {
String result = "pbkdf2_sha256$15000$" + salt + "$";
PBKDF2Parameters params = new PBKDF2Parameters("HmacSHA256", "ASCII", salt.getBytes(), 15000);
@@ -18,7 +18,7 @@ public class DOUBLEMD5 implements EncryptionMethod {
}
@Override
public String getHash(String password, String salt, String name)
public String computeHash(String password, String salt, String name)
throws NoSuchAlgorithmException {
return getMD5(getMD5(password));
}
@@ -26,7 +26,7 @@ public class DOUBLEMD5 implements EncryptionMethod {
@Override
public boolean comparePassword(String hash, String password,
String playerName) throws NoSuchAlgorithmException {
return hash.equals(getHash(password, "", ""));
return hash.equals(computeHash(password, "", ""));
}
}
@@ -3,36 +3,31 @@ package fr.xephi.authme.security.crypts;
import java.security.NoSuchAlgorithmException;
/**
* <p>
* Public interface for Custom Password encryption method
* </p>
* <p>
* The getHash function is called when we need to crypt the password (/register
* usually)
* </p>
* <p>
* The comparePassword is called when we need to match password (/login usually)
* </p>
* Public interface for custom password encryption methods.
*/
public interface EncryptionMethod {
/**
* @param password
* @param salt (can be an other data like playerName;salt , playerName,
* etc... for customs methods)
* @param name String
* Hash the given password with the given salt for the given player.
*
* @return Hashing password
* @param password The clear-text password to hash
* @param salt The salt to add to the hash
* @param name The player's name (sometimes required for storing the salt separately in the database)
*
* @return The hashed password
*/
String getHash(String password, String salt, String name)
String computeHash(String password, String salt, String name)
throws NoSuchAlgorithmException;
/**
* @param hash
* @param password
* @param playerName
* Check whether a given hash matches the clear-text password.
*
* @return true if password match, false else
* @param hash The hash to verify
* @param password The clear-text password to verify the hash against
* @param playerName The player name to do the check for (sometimes required for retrieving
* the salt from the database)
*
* @return True if the password matches, false otherwise
*/
boolean comparePassword(String hash, String password, String playerName)
throws NoSuchAlgorithmException;
@@ -20,7 +20,7 @@ public class IPB3 implements EncryptionMethod {
}
@Override
public String getHash(String password, String salt, String name)
public String computeHash(String password, String salt, String name)
throws NoSuchAlgorithmException {
return getMD5(getMD5(salt) + getMD5(password));
}
@@ -29,6 +29,6 @@ public class IPB3 implements EncryptionMethod {
public boolean comparePassword(String hash, String password,
String playerName) throws NoSuchAlgorithmException {
String salt = AuthMe.getInstance().database.getAuth(playerName).getSalt();
return hash.equals(getHash(password, salt, playerName));
return hash.equals(computeHash(password, salt, playerName));
}
}
@@ -18,7 +18,7 @@ public class JOOMLA implements EncryptionMethod {
}
@Override
public String getHash(String password, String salt, String name)
public String computeHash(String password, String salt, String name)
throws NoSuchAlgorithmException {
return getMD5(password + salt) + ":" + salt;
}
@@ -18,7 +18,7 @@ public class MD5 implements EncryptionMethod {
}
@Override
public String getHash(String password, String salt, String name)
public String computeHash(String password, String salt, String name)
throws NoSuchAlgorithmException {
return getMD5(password);
}
@@ -26,6 +26,6 @@ public class MD5 implements EncryptionMethod {
@Override
public boolean comparePassword(String hash, String password,
String playerName) throws NoSuchAlgorithmException {
return hash.equals(getHash(password, "", ""));
return hash.equals(computeHash(password, "", ""));
}
}
@@ -18,7 +18,7 @@ public class MD5VB implements EncryptionMethod {
}
@Override
public String getHash(String password, String salt, String name)
public String computeHash(String password, String salt, String name)
throws NoSuchAlgorithmException {
return "$MD5vb$" + salt + "$" + getMD5(getMD5(password) + salt);
}
@@ -27,7 +27,7 @@ public class MD5VB implements EncryptionMethod {
public boolean comparePassword(String hash, String password,
String playerName) throws NoSuchAlgorithmException {
String[] line = hash.split("\\$");
return hash.equals(getHash(password, line[2], ""));
return hash.equals(computeHash(password, line[2], ""));
}
}
@@ -20,7 +20,7 @@ public class MYBB implements EncryptionMethod {
}
@Override
public String getHash(String password, String salt, String name)
public String computeHash(String password, String salt, String name)
throws NoSuchAlgorithmException {
return getMD5(getMD5(salt) + getMD5(password));
}
@@ -29,6 +29,6 @@ public class MYBB implements EncryptionMethod {
public boolean comparePassword(String hash, String password,
String playerName) throws NoSuchAlgorithmException {
String salt = AuthMe.getInstance().database.getAuth(playerName).getSalt();
return hash.equals(getHash(password, salt, playerName));
return hash.equals(computeHash(password, salt, playerName));
}
}
@@ -137,7 +137,7 @@ public class PHPBB implements EncryptionMethod {
}
@Override
public String getHash(String password, String salt, String name)
public String computeHash(String password, String salt, String name)
throws NoSuchAlgorithmException {
return phpbb_hash(password, salt);
}
@@ -24,7 +24,7 @@ public class PHPFUSION implements EncryptionMethod {
}
@Override
public String getHash(String password, String salt, String name)
public String computeHash(String password, String salt, String name)
throws NoSuchAlgorithmException {
String digest = null;
String algo = "HmacSHA256";
@@ -54,7 +54,7 @@ public class PHPFUSION implements EncryptionMethod {
public boolean comparePassword(String hash, String password,
String playerName) throws NoSuchAlgorithmException {
String salt = AuthMe.getInstance().database.getAuth(playerName).getSalt();
return hash.equals(getHash(password, salt, ""));
return hash.equals(computeHash(password, salt, ""));
}
}
@@ -7,7 +7,7 @@ import java.security.NoSuchAlgorithmException;
public class PLAINTEXT implements EncryptionMethod {
@Override
public String getHash(String password, String salt, String name)
public String computeHash(String password, String salt, String name)
throws NoSuchAlgorithmException {
return password;
}
@@ -8,7 +8,7 @@ import java.security.NoSuchAlgorithmException;
public class ROYALAUTH implements EncryptionMethod {
@Override
public String getHash(String password, String salt, String name)
public String computeHash(String password, String salt, String name)
throws NoSuchAlgorithmException {
for (int i = 0; i < 25; i++)
password = hash(password, salt);
@@ -29,7 +29,7 @@ public class ROYALAUTH implements EncryptionMethod {
@Override
public boolean comparePassword(String hash, String password,
String playerName) throws NoSuchAlgorithmException {
return hash.equalsIgnoreCase(getHash(password, "", ""));
return hash.equalsIgnoreCase(computeHash(password, "", ""));
}
}
@@ -20,7 +20,7 @@ public class SALTED2MD5 implements EncryptionMethod {
}
@Override
public String getHash(String password, String salt, String name)
public String computeHash(String password, String salt, String name)
throws NoSuchAlgorithmException {
return getMD5(getMD5(password) + salt);
}
@@ -20,7 +20,7 @@ public class SALTEDSHA512 implements EncryptionMethod {
}
@Override
public String getHash(String password, String salt, String name)
public String computeHash(String password, String salt, String name)
throws NoSuchAlgorithmException {
return getSHA512(password + salt);
}
@@ -29,6 +29,6 @@ public class SALTEDSHA512 implements EncryptionMethod {
public boolean comparePassword(String hash, String password,
String playerName) throws NoSuchAlgorithmException {
String salt = AuthMe.getInstance().database.getAuth(playerName).getSalt();
return hash.equals(getHash(password, salt, ""));
return hash.equals(computeHash(password, salt, ""));
}
}
@@ -18,7 +18,7 @@ public class SHA1 implements EncryptionMethod {
}
@Override
public String getHash(String password, String salt, String name)
public String computeHash(String password, String salt, String name)
throws NoSuchAlgorithmException {
return getSHA1(password);
}
@@ -26,7 +26,7 @@ public class SHA1 implements EncryptionMethod {
@Override
public boolean comparePassword(String hash, String password,
String playerName) throws NoSuchAlgorithmException {
return hash.equals(getHash(password, "", ""));
return hash.equals(computeHash(password, "", ""));
}
}
@@ -18,7 +18,7 @@ public class SHA256 implements EncryptionMethod {
}
@Override
public String getHash(String password, String salt, String name)
public String computeHash(String password, String salt, String name)
throws NoSuchAlgorithmException {
return "$SHA$" + salt + "$" + getSHA256(getSHA256(password) + salt);
}
@@ -27,7 +27,7 @@ public class SHA256 implements EncryptionMethod {
public boolean comparePassword(String hash, String password,
String playerName) throws NoSuchAlgorithmException {
String[] line = hash.split("\\$");
return hash.equals(getHash(password, line[2], ""));
return hash.equals(computeHash(password, line[2], ""));
}
}
@@ -18,7 +18,7 @@ public class SHA512 implements EncryptionMethod {
}
@Override
public String getHash(String password, String salt, String name)
public String computeHash(String password, String salt, String name)
throws NoSuchAlgorithmException {
return getSHA512(password);
}
@@ -26,6 +26,6 @@ public class SHA512 implements EncryptionMethod {
@Override
public boolean comparePassword(String hash, String password,
String playerName) throws NoSuchAlgorithmException {
return hash.equals(getHash(password, "", ""));
return hash.equals(computeHash(password, "", ""));
}
}
@@ -18,7 +18,7 @@ public class SMF implements EncryptionMethod {
}
@Override
public String getHash(String password, String salt, String name)
public String computeHash(String password, String salt, String name)
throws NoSuchAlgorithmException {
return getSHA1(name.toLowerCase() + password);
}
@@ -26,6 +26,6 @@ public class SMF implements EncryptionMethod {
@Override
public boolean comparePassword(String hash, String password,
String playerName) throws NoSuchAlgorithmException {
return hash.equals(getHash(password, null, playerName));
return hash.equals(computeHash(password, null, playerName));
}
}
@@ -20,7 +20,7 @@ public class WBB3 implements EncryptionMethod {
}
@Override
public String getHash(String password, String salt, String name)
public String computeHash(String password, String salt, String name)
throws NoSuchAlgorithmException {
return getSHA1(salt.concat(getSHA1(salt.concat(getSHA1(password)))));
}
@@ -29,6 +29,6 @@ public class WBB3 implements EncryptionMethod {
public boolean comparePassword(String hash, String password,
String playerName) throws NoSuchAlgorithmException {
String salt = AuthMe.getInstance().database.getAuth(playerName).getSalt();
return hash.equals(getHash(password, salt, ""));
return hash.equals(computeHash(password, salt, ""));
}
}
@@ -7,7 +7,7 @@ import java.security.NoSuchAlgorithmException;
public class WBB4 implements EncryptionMethod {
@Override
public String getHash(String password, String salt, String name)
public String computeHash(String password, String salt, String name)
throws NoSuchAlgorithmException {
return BCRYPT.getDoubleHash(password, salt);
}
@@ -382,17 +382,8 @@ public class WHIRLPOOL implements EncryptionMethod {
}
}
/**
* Method getHash.
*
* @param password String
* @param salt String
* @param name String
*
* @return String * @throws NoSuchAlgorithmException * @see fr.xephi.authme.security.crypts.EncryptionMethod#getHash(String, String, String)
*/
@Override
public String getHash(String password, String salt, String name)
public String computeHash(String password, String salt, String name)
throws NoSuchAlgorithmException {
byte[] digest = new byte[DIGESTBYTES];
NESSIEinit();
@@ -404,6 +395,6 @@ public class WHIRLPOOL implements EncryptionMethod {
@Override
public boolean comparePassword(String hash, String password,
String playerName) throws NoSuchAlgorithmException {
return hash.equals(getHash(password, "", ""));
return hash.equals(computeHash(password, "", ""));
}
}
@@ -102,7 +102,7 @@ public class WORDPRESS implements EncryptionMethod {
}
@Override
public String getHash(String password, String salt, String name)
public String computeHash(String password, String salt, String name)
throws NoSuchAlgorithmException {
byte random[] = new byte[6];
this.randomGen.nextBytes(random);
@@ -16,7 +16,7 @@ public class XAUTH implements EncryptionMethod {
}
@Override
public String getHash(String password, String salt, String name)
public String computeHash(String password, String salt, String name)
throws NoSuchAlgorithmException {
String hash = getWhirlpool(salt + password).toLowerCase();
int saltPos = (password.length() >= hash.length() ? hash.length() - 1 : password.length());
@@ -28,7 +28,7 @@ public class XAUTH implements EncryptionMethod {
String playerName) throws NoSuchAlgorithmException {
int saltPos = (password.length() >= hash.length() ? hash.length() - 1 : password.length());
String salt = hash.substring(saltPos, saltPos + 12);
return hash.equals(getHash(password, salt, ""));
return hash.equals(computeHash(password, salt, ""));
}
}
@@ -14,7 +14,7 @@ import java.util.regex.Pattern;
public class XF implements EncryptionMethod {
@Override
public String getHash(String password, String salt, String name)
public String computeHash(String password, String salt, String name)
throws NoSuchAlgorithmException {
return getSha256(getSha256(password) + regmatch("\"salt\";.:..:\"(.*)\";.:.:\"hashFunc\"", salt));
}