#358 Start refactoring PasswordSecurity

- Add new methods temporarily to NewEncrMethod interface
   - No data source access within EncryptionMethod implementations
   - Generate the salt within the EncryptionMethod implementation
- Deprecate static methods on PasswordSecurity
- Adjust AbstractEncryptionMethodTest to test the classes with the new interface
- Add getter for data source instead of accessing field directly
This commit is contained in:
ljacqu
2015-12-28 16:23:08 +01:00
parent 6ac1967364
commit 31730699ac
12 changed files with 272 additions and 68 deletions
@@ -29,11 +29,8 @@ public interface EncryptionMethod {
*
* @return True if the password matches, false otherwise
*/
@Deprecated
boolean comparePassword(String hash, String password, String playerName)
throws NoSuchAlgorithmException;
// String generateSalt();
// String computeHash(String password, String name);
}
@@ -0,0 +1,26 @@
package fr.xephi.authme.security.crypts;
/**
* The result of a hash computation.
*/
public class HashResult {
/** The generated hash. */
private final String hash;
/** The generated salt; may be null if no salt is used or if the salt is included in the hash output. */
private final String salt;
public HashResult(String hash, String salt) {
this.hash = hash;
this.salt = salt;
}
public String getHash() {
return hash;
}
public String getSalt() {
return salt;
}
}
@@ -0,0 +1,17 @@
package fr.xephi.authme.security.crypts;
/**
* Temporary interface for additional methods that will be added to {@link EncryptionMethod}.
* TODO #358: Move methods to EncryptionMethod interface and delete this.
*/
public interface NewEncrMethod extends EncryptionMethod {
HashResult computeHash(String password, String name);
String generateSalt();
boolean hasSeparateSalt();
boolean comparePassword(String hash, String password, String salt, String name);
}
@@ -1,14 +1,20 @@
package fr.xephi.authme.security.crypts;
import fr.xephi.authme.AuthMe;
import fr.xephi.authme.security.RandomString;
import fr.xephi.authme.security.crypts.description.HasSalt;
import fr.xephi.authme.security.crypts.description.Recommendation;
import fr.xephi.authme.security.crypts.description.SaltType;
import fr.xephi.authme.security.crypts.description.Usage;
import fr.xephi.authme.settings.Settings;
import java.math.BigInteger;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
/**
*/
public class SALTED2MD5 implements EncryptionMethod {
@Recommendation(Usage.ACCEPTABLE) // presuming that length is something sensible (>= 8)
@HasSalt(value = SaltType.TEXT) // length defined by Settings.saltLength
public class SALTED2MD5 implements NewEncrMethod {
private static String getMD5(String message)
throws NoSuchAlgorithmException {
@@ -25,10 +31,41 @@ public class SALTED2MD5 implements EncryptionMethod {
return getMD5(getMD5(password) + salt);
}
@Override
public HashResult computeHash(String password, String name) {
try {
String salt = generateSalt();
return new HashResult(computeHash(password, salt, name), salt);
} catch (NoSuchAlgorithmException e) {
throw new RuntimeException(e); // TODO #358: Remove try-catch clause
}
}
@Override
public boolean comparePassword(String hash, String password,
String playerName) throws NoSuchAlgorithmException {
String salt = AuthMe.getInstance().database.getAuth(playerName).getSalt();
return hash.equals(getMD5(getMD5(password) + salt));
}
@Override
public boolean comparePassword(String hash, String password, String salt, String name) {
try {
return hash.equals(computeHash(password, salt, name));
} catch (NoSuchAlgorithmException e) {
throw new RuntimeException(e);
// TODO #358: Remove try-catch
}
}
@Override
public String generateSalt() {
return RandomString.generateHex(Settings.saltLength);
}
@Override
public boolean hasSeparateSalt() {
return true;
}
}