#358 Start refactoring PasswordSecurity
- Add new methods temporarily to NewEncrMethod interface - No data source access within EncryptionMethod implementations - Generate the salt within the EncryptionMethod implementation - Deprecate static methods on PasswordSecurity - Adjust AbstractEncryptionMethodTest to test the classes with the new interface - Add getter for data source instead of accessing field directly
This commit is contained in:
@@ -29,11 +29,8 @@ public interface EncryptionMethod {
|
||||
*
|
||||
* @return True if the password matches, false otherwise
|
||||
*/
|
||||
@Deprecated
|
||||
boolean comparePassword(String hash, String password, String playerName)
|
||||
throws NoSuchAlgorithmException;
|
||||
|
||||
// String generateSalt();
|
||||
|
||||
// String computeHash(String password, String name);
|
||||
|
||||
}
|
||||
|
||||
@@ -0,0 +1,26 @@
|
||||
package fr.xephi.authme.security.crypts;
|
||||
|
||||
/**
|
||||
* The result of a hash computation.
|
||||
*/
|
||||
public class HashResult {
|
||||
|
||||
/** The generated hash. */
|
||||
private final String hash;
|
||||
/** The generated salt; may be null if no salt is used or if the salt is included in the hash output. */
|
||||
private final String salt;
|
||||
|
||||
public HashResult(String hash, String salt) {
|
||||
this.hash = hash;
|
||||
this.salt = salt;
|
||||
}
|
||||
|
||||
public String getHash() {
|
||||
return hash;
|
||||
}
|
||||
|
||||
public String getSalt() {
|
||||
return salt;
|
||||
}
|
||||
|
||||
}
|
||||
@@ -0,0 +1,17 @@
|
||||
package fr.xephi.authme.security.crypts;
|
||||
|
||||
/**
|
||||
* Temporary interface for additional methods that will be added to {@link EncryptionMethod}.
|
||||
* TODO #358: Move methods to EncryptionMethod interface and delete this.
|
||||
*/
|
||||
public interface NewEncrMethod extends EncryptionMethod {
|
||||
|
||||
HashResult computeHash(String password, String name);
|
||||
|
||||
String generateSalt();
|
||||
|
||||
boolean hasSeparateSalt();
|
||||
|
||||
boolean comparePassword(String hash, String password, String salt, String name);
|
||||
|
||||
}
|
||||
@@ -1,14 +1,20 @@
|
||||
package fr.xephi.authme.security.crypts;
|
||||
|
||||
import fr.xephi.authme.AuthMe;
|
||||
import fr.xephi.authme.security.RandomString;
|
||||
import fr.xephi.authme.security.crypts.description.HasSalt;
|
||||
import fr.xephi.authme.security.crypts.description.Recommendation;
|
||||
import fr.xephi.authme.security.crypts.description.SaltType;
|
||||
import fr.xephi.authme.security.crypts.description.Usage;
|
||||
import fr.xephi.authme.settings.Settings;
|
||||
|
||||
import java.math.BigInteger;
|
||||
import java.security.MessageDigest;
|
||||
import java.security.NoSuchAlgorithmException;
|
||||
|
||||
/**
|
||||
*/
|
||||
public class SALTED2MD5 implements EncryptionMethod {
|
||||
@Recommendation(Usage.ACCEPTABLE) // presuming that length is something sensible (>= 8)
|
||||
@HasSalt(value = SaltType.TEXT) // length defined by Settings.saltLength
|
||||
public class SALTED2MD5 implements NewEncrMethod {
|
||||
|
||||
private static String getMD5(String message)
|
||||
throws NoSuchAlgorithmException {
|
||||
@@ -25,10 +31,41 @@ public class SALTED2MD5 implements EncryptionMethod {
|
||||
return getMD5(getMD5(password) + salt);
|
||||
}
|
||||
|
||||
@Override
|
||||
public HashResult computeHash(String password, String name) {
|
||||
try {
|
||||
String salt = generateSalt();
|
||||
return new HashResult(computeHash(password, salt, name), salt);
|
||||
} catch (NoSuchAlgorithmException e) {
|
||||
throw new RuntimeException(e); // TODO #358: Remove try-catch clause
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public boolean comparePassword(String hash, String password,
|
||||
String playerName) throws NoSuchAlgorithmException {
|
||||
String salt = AuthMe.getInstance().database.getAuth(playerName).getSalt();
|
||||
return hash.equals(getMD5(getMD5(password) + salt));
|
||||
}
|
||||
|
||||
@Override
|
||||
public boolean comparePassword(String hash, String password, String salt, String name) {
|
||||
try {
|
||||
return hash.equals(computeHash(password, salt, name));
|
||||
} catch (NoSuchAlgorithmException e) {
|
||||
throw new RuntimeException(e);
|
||||
// TODO #358: Remove try-catch
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public String generateSalt() {
|
||||
return RandomString.generateHex(Settings.saltLength);
|
||||
}
|
||||
|
||||
@Override
|
||||
public boolean hasSeparateSalt() {
|
||||
return true;
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user