Stuff from the common floobits workspace
Author: AuthMe-Team <AuthMeTeam@123NoEmail.com>
This commit is contained in:
@@ -26,7 +26,7 @@ package fr.xephi.authme.security.pbkdf2;
|
||||
* href="http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html"
|
||||
* >http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html</a>.
|
||||
* </p>
|
||||
*
|
||||
*
|
||||
* @author Matthias Gärtner
|
||||
* @version 1.0
|
||||
*/
|
||||
@@ -36,12 +36,11 @@ public class BinTools {
|
||||
|
||||
/**
|
||||
* Simple binary-to-hexadecimal conversion.
|
||||
*
|
||||
* @param b
|
||||
* Input bytes. May be <code>null</code>.
|
||||
|
||||
*
|
||||
* @param b Input bytes. May be <code>null</code>.
|
||||
* @return Hexadecimal representation of b. Uppercase A-F, two characters
|
||||
* per byte. Empty string on <code>null</code> input. */
|
||||
* per byte. Empty string on <code>null</code> input.
|
||||
*/
|
||||
public static String bin2hex(final byte[] b) {
|
||||
if (b == null) {
|
||||
return "";
|
||||
@@ -57,14 +56,12 @@ public class BinTools {
|
||||
|
||||
/**
|
||||
* Convert hex string to array of bytes.
|
||||
*
|
||||
* @param s
|
||||
* String containing hexadecimal digits. May be <code>null</code>
|
||||
* . On odd length leading zero will be assumed.
|
||||
|
||||
|
||||
*
|
||||
* @param s String containing hexadecimal digits. May be <code>null</code>
|
||||
* . On odd length leading zero will be assumed.
|
||||
* @return Array on bytes, non-<code>null</code>. * @throws IllegalArgumentException
|
||||
* when string contains non-hex character */
|
||||
* when string contains non-hex character
|
||||
*/
|
||||
public static byte[] hex2bin(final String s) {
|
||||
String m = s;
|
||||
if (s == null) {
|
||||
@@ -85,13 +82,11 @@ public class BinTools {
|
||||
|
||||
/**
|
||||
* Convert hex digit to numerical value.
|
||||
*
|
||||
* @param c
|
||||
* 0-9, a-f, A-F allowd.
|
||||
|
||||
|
||||
*
|
||||
* @param c 0-9, a-f, A-F allowd.
|
||||
* @return 0-15 * @throws IllegalArgumentException
|
||||
* on non-hex character */
|
||||
* on non-hex character
|
||||
*/
|
||||
public static int hex2bin(char c) {
|
||||
if (c >= '0' && c <= '9') {
|
||||
return (c - '0');
|
||||
@@ -107,6 +102,7 @@ public class BinTools {
|
||||
|
||||
/**
|
||||
* Method main.
|
||||
*
|
||||
* @param args String[]
|
||||
*/
|
||||
public static void main(String[] args) {
|
||||
|
||||
@@ -1,15 +1,14 @@
|
||||
package fr.xephi.authme.security.pbkdf2;
|
||||
|
||||
import javax.crypto.Mac;
|
||||
import javax.crypto.spec.SecretKeySpec;
|
||||
import java.security.InvalidKeyException;
|
||||
import java.security.NoSuchAlgorithmException;
|
||||
import java.security.NoSuchProviderException;
|
||||
|
||||
import javax.crypto.Mac;
|
||||
import javax.crypto.spec.SecretKeySpec;
|
||||
|
||||
/**
|
||||
* Default PRF implementation based on standard javax.crypt.Mac mechanisms.
|
||||
*
|
||||
* <p>
|
||||
* <hr />
|
||||
* <p>
|
||||
* A free Java implementation of Password Based Key Derivation Function 2 as
|
||||
@@ -52,8 +51,7 @@ public class MacBasedPRF implements PRF {
|
||||
/**
|
||||
* Create Mac-based Pseudo Random Function.
|
||||
*
|
||||
* @param macAlgorithm
|
||||
* Mac algorithm to use, i.e. HMacSHA1 or HMacMD5.
|
||||
* @param macAlgorithm Mac algorithm to use, i.e. HMacSHA1 or HMacMD5.
|
||||
*/
|
||||
public MacBasedPRF(String macAlgorithm) {
|
||||
this.macAlgorithm = macAlgorithm;
|
||||
@@ -67,8 +65,9 @@ public class MacBasedPRF implements PRF {
|
||||
|
||||
/**
|
||||
* Constructor for MacBasedPRF.
|
||||
*
|
||||
* @param macAlgorithm String
|
||||
* @param provider String
|
||||
* @param provider String
|
||||
*/
|
||||
public MacBasedPRF(String macAlgorithm, String provider) {
|
||||
this.macAlgorithm = macAlgorithm;
|
||||
@@ -82,10 +81,10 @@ public class MacBasedPRF implements PRF {
|
||||
|
||||
/**
|
||||
* Method doFinal.
|
||||
*
|
||||
* @param M byte[]
|
||||
|
||||
|
||||
* @return byte[] * @see fr.xephi.authme.security.pbkdf2.PRF#doFinal(byte[]) */
|
||||
* @return byte[] * @see fr.xephi.authme.security.pbkdf2.PRF#doFinal(byte[])
|
||||
*/
|
||||
public byte[] doFinal(byte[] M) {
|
||||
byte[] r = mac.doFinal(M);
|
||||
return r;
|
||||
@@ -93,18 +92,19 @@ public class MacBasedPRF implements PRF {
|
||||
|
||||
/**
|
||||
* Method getHLen.
|
||||
|
||||
|
||||
* @return int * @see fr.xephi.authme.security.pbkdf2.PRF#getHLen() */
|
||||
*
|
||||
* @return int * @see fr.xephi.authme.security.pbkdf2.PRF#getHLen()
|
||||
*/
|
||||
public int getHLen() {
|
||||
return hLen;
|
||||
}
|
||||
|
||||
/**
|
||||
* Method init.
|
||||
*
|
||||
* @param P byte[]
|
||||
|
||||
* @see fr.xephi.authme.security.pbkdf2.PRF#init(byte[]) */
|
||||
* @see fr.xephi.authme.security.pbkdf2.PRF#init(byte[])
|
||||
*/
|
||||
public void init(byte[] P) {
|
||||
try {
|
||||
mac.init(new SecretKeySpec(P, macAlgorithm));
|
||||
|
||||
@@ -27,7 +27,7 @@ package fr.xephi.authme.security.pbkdf2;
|
||||
* href="http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html"
|
||||
* >http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html</a>.
|
||||
* </p>
|
||||
*
|
||||
*
|
||||
* @author Matthias Gärtner
|
||||
* @version 1.0
|
||||
*/
|
||||
@@ -36,64 +36,59 @@ public interface PBKDF2 {
|
||||
/**
|
||||
* Convert String-based input to internal byte array, then invoke PBKDF2.
|
||||
* Desired key length defaults to Pseudo Random Function block size.
|
||||
*
|
||||
* @param inputPassword
|
||||
* Candidate password to compute the derived key for.
|
||||
|
||||
* @return internal byte array */
|
||||
*
|
||||
* @param inputPassword Candidate password to compute the derived key for.
|
||||
* @return internal byte array
|
||||
*/
|
||||
public abstract byte[] deriveKey(String inputPassword);
|
||||
|
||||
/**
|
||||
* Convert String-based input to internal byte array, then invoke PBKDF2.
|
||||
*
|
||||
* @param inputPassword
|
||||
* Candidate password to compute the derived key for.
|
||||
* @param dkLen
|
||||
* Specify desired key length
|
||||
|
||||
* @return internal byte array */
|
||||
*
|
||||
* @param inputPassword Candidate password to compute the derived key for.
|
||||
* @param dkLen Specify desired key length
|
||||
* @return internal byte array
|
||||
*/
|
||||
public abstract byte[] deriveKey(String inputPassword, int dkLen);
|
||||
|
||||
/**
|
||||
* Convert String-based input to internal byte arrays, then invoke PBKDF2
|
||||
* and verify result against the reference data that is supplied in the
|
||||
* PBKDF2Parameters.
|
||||
*
|
||||
* @param inputPassword
|
||||
* Candidate password to compute the derived key for.
|
||||
|
||||
*
|
||||
* @param inputPassword Candidate password to compute the derived key for.
|
||||
* @return <code>true</code> password match; <code>false</code> incorrect
|
||||
* password */
|
||||
* password
|
||||
*/
|
||||
public abstract boolean verifyKey(String inputPassword);
|
||||
|
||||
/**
|
||||
* Allow reading of configured parameters.
|
||||
*
|
||||
|
||||
* @return Currently set parameters. */
|
||||
*
|
||||
* @return Currently set parameters.
|
||||
*/
|
||||
public abstract PBKDF2Parameters getParameters();
|
||||
|
||||
/**
|
||||
* Allow setting of configured parameters.
|
||||
*
|
||||
*
|
||||
* @param parameters
|
||||
*/
|
||||
public abstract void setParameters(PBKDF2Parameters parameters);
|
||||
|
||||
/**
|
||||
* Get currently set Pseudo Random Function.
|
||||
*
|
||||
|
||||
* @return Currently set Pseudo Random Function */
|
||||
*
|
||||
* @return Currently set Pseudo Random Function
|
||||
*/
|
||||
public abstract PRF getPseudoRandomFunction();
|
||||
|
||||
/**
|
||||
* Set the Pseudo Random Function to use. Note that deriveKeys/getPRF does
|
||||
* init this object using the supplied candidate password. If this is
|
||||
* undesired, one has to override getPRF.
|
||||
*
|
||||
* @param prf
|
||||
* Pseudo Random Function to set.
|
||||
*
|
||||
* @param prf Pseudo Random Function to set.
|
||||
*/
|
||||
public abstract void setPseudoRandomFunction(PRF prf);
|
||||
}
|
||||
|
||||
@@ -10,17 +10,17 @@ import java.security.SecureRandom;
|
||||
* Request for Comments: 2898 PKCS #5: Password-Based Cryptography Specification
|
||||
* <p>
|
||||
* Version 2.0
|
||||
*
|
||||
* <p>
|
||||
* <p>
|
||||
* PBKDF2 (P, S, c, dkLen)
|
||||
*
|
||||
* <p>
|
||||
* <p>
|
||||
* Options:
|
||||
* <ul>
|
||||
* <li>PRF underlying pseudorandom function (hLen denotes the length in octets
|
||||
* of the pseudorandom function output). PRF is pluggable.</li>
|
||||
* </ul>
|
||||
*
|
||||
* <p>
|
||||
* <p>
|
||||
* Input:
|
||||
* <ul>
|
||||
@@ -30,13 +30,13 @@ import java.security.SecureRandom;
|
||||
* <li>dkLen intended length in octets of the derived key, a positive integer,
|
||||
* at most (2^32 - 1) * hLen</li>
|
||||
* </ul>
|
||||
*
|
||||
* <p>
|
||||
* <p>
|
||||
* Output:
|
||||
* <ul>
|
||||
* <li>DK derived key, a dkLen-octet string</li>
|
||||
* </ul>
|
||||
*
|
||||
* <p>
|
||||
* <hr />
|
||||
* <p>
|
||||
* A free Java implementation of Password Based Key Derivation Function 2 as
|
||||
@@ -64,10 +64,10 @@ import java.security.SecureRandom;
|
||||
* <a href="http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html" >http://www.
|
||||
* gnu.org/licenses/old-licenses/lgpl-2.1.html</a>.
|
||||
* </p>
|
||||
*
|
||||
* @see <a href="http://tools.ietf.org/html/rfc2898">RFC 2898</a>
|
||||
*
|
||||
* @author Matthias Gärtner
|
||||
* @version 1.0
|
||||
* @see <a href="http://tools.ietf.org/html/rfc2898">RFC 2898</a>
|
||||
*/
|
||||
public class PBKDF2Engine implements PBKDF2 {
|
||||
|
||||
@@ -88,9 +88,8 @@ public class PBKDF2Engine implements PBKDF2 {
|
||||
* Constructor for PBKDF2 implementation object. PBKDF2 parameters are
|
||||
* passed so that this implementation knows iteration count, method to use
|
||||
* and String encoding.
|
||||
*
|
||||
* @param parameters
|
||||
* Data holder for iteration count, method to use et cetera.
|
||||
*
|
||||
* @param parameters Data holder for iteration count, method to use et cetera.
|
||||
*/
|
||||
public PBKDF2Engine(PBKDF2Parameters parameters) {
|
||||
this.parameters = parameters;
|
||||
@@ -101,262 +100,26 @@ public class PBKDF2Engine implements PBKDF2 {
|
||||
* Constructor for PBKDF2 implementation object. PBKDF2 parameters are
|
||||
* passed so that this implementation knows iteration count, method to use
|
||||
* and String encoding.
|
||||
*
|
||||
* @param parameters
|
||||
* Data holder for iteration count, method to use et cetera.
|
||||
* @param prf
|
||||
* Supply customer Pseudo Random Function.
|
||||
*
|
||||
* @param parameters Data holder for iteration count, method to use et cetera.
|
||||
* @param prf Supply customer Pseudo Random Function.
|
||||
*/
|
||||
public PBKDF2Engine(PBKDF2Parameters parameters, PRF prf) {
|
||||
this.parameters = parameters;
|
||||
this.prf = prf;
|
||||
}
|
||||
|
||||
/**
|
||||
* Method deriveKey.
|
||||
* @param inputPassword String
|
||||
|
||||
|
||||
* @return byte[] * @see fr.xephi.authme.security.pbkdf2.PBKDF2#deriveKey(String) */
|
||||
public byte[] deriveKey(String inputPassword) {
|
||||
return deriveKey(inputPassword, 0);
|
||||
}
|
||||
|
||||
/**
|
||||
* Method deriveKey.
|
||||
* @param inputPassword String
|
||||
* @param dkLen int
|
||||
|
||||
|
||||
* @return byte[] * @see fr.xephi.authme.security.pbkdf2.PBKDF2#deriveKey(String, int) */
|
||||
public byte[] deriveKey(String inputPassword, int dkLen) {
|
||||
byte[] r = null;
|
||||
byte P[] = null;
|
||||
String charset = parameters.getHashCharset();
|
||||
if (inputPassword == null) {
|
||||
inputPassword = "";
|
||||
}
|
||||
try {
|
||||
if (charset == null) {
|
||||
P = inputPassword.getBytes();
|
||||
} else {
|
||||
P = inputPassword.getBytes(charset);
|
||||
}
|
||||
} catch (UnsupportedEncodingException e) {
|
||||
throw new RuntimeException(e);
|
||||
}
|
||||
assertPRF(P);
|
||||
if (dkLen == 0) {
|
||||
dkLen = prf.getHLen();
|
||||
}
|
||||
r = PBKDF2(prf, parameters.getSalt(), parameters.getIterationCount(), dkLen);
|
||||
return r;
|
||||
}
|
||||
|
||||
/**
|
||||
* Method verifyKey.
|
||||
* @param inputPassword String
|
||||
|
||||
|
||||
* @return boolean * @see fr.xephi.authme.security.pbkdf2.PBKDF2#verifyKey(String) */
|
||||
public boolean verifyKey(String inputPassword) {
|
||||
byte[] referenceKey = getParameters().getDerivedKey();
|
||||
if (referenceKey == null || referenceKey.length == 0) {
|
||||
return false;
|
||||
}
|
||||
byte[] inputKey = deriveKey(inputPassword, referenceKey.length);
|
||||
|
||||
if (inputKey == null || inputKey.length != referenceKey.length) {
|
||||
return false;
|
||||
}
|
||||
for (int i = 0; i < inputKey.length; i++) {
|
||||
if (inputKey[i] != referenceKey[i]) {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Factory method. Default implementation is (H)MAC-based. To be overridden
|
||||
* in derived classes.
|
||||
*
|
||||
* @param P
|
||||
* User-supplied candidate password as array of bytes.
|
||||
*/
|
||||
protected void assertPRF(byte[] P) {
|
||||
if (prf == null) {
|
||||
prf = new MacBasedPRF(parameters.getHashAlgorithm());
|
||||
}
|
||||
prf.init(P);
|
||||
}
|
||||
|
||||
/**
|
||||
* Method getPseudoRandomFunction.
|
||||
|
||||
|
||||
* @return PRF * @see fr.xephi.authme.security.pbkdf2.PBKDF2#getPseudoRandomFunction() */
|
||||
public PRF getPseudoRandomFunction() {
|
||||
return prf;
|
||||
}
|
||||
|
||||
/**
|
||||
* Core Password Based Key Derivation Function 2.
|
||||
*
|
||||
|
||||
* @param prf
|
||||
* Pseudo Random Function (i.e. HmacSHA1)
|
||||
* @param S
|
||||
* Salt as array of bytes. <code>null</code> means no salt.
|
||||
* @param c
|
||||
* Iteration count (see RFC 2898 4.2)
|
||||
* @param dkLen
|
||||
* desired length of derived key.
|
||||
|
||||
* @return internal byte array * @see <a href="http://tools.ietf.org/html/rfc2898">RFC 2898 5.2</a> */
|
||||
protected byte[] PBKDF2(PRF prf, byte[] S, int c, int dkLen) {
|
||||
if (S == null) {
|
||||
S = new byte[0];
|
||||
}
|
||||
int hLen = prf.getHLen();
|
||||
int l = ceil(dkLen, hLen);
|
||||
int r = dkLen - (l - 1) * hLen;
|
||||
byte T[] = new byte[l * hLen];
|
||||
int ti_offset = 0;
|
||||
for (int i = 1; i <= l; i++) {
|
||||
_F(T, ti_offset, prf, S, c, i);
|
||||
ti_offset += hLen;
|
||||
}
|
||||
if (r < hLen) {
|
||||
// Incomplete last block
|
||||
byte DK[] = new byte[dkLen];
|
||||
System.arraycopy(T, 0, DK, 0, dkLen);
|
||||
return DK;
|
||||
}
|
||||
return T;
|
||||
}
|
||||
|
||||
/**
|
||||
* Integer division with ceiling function.
|
||||
*
|
||||
|
||||
* @param a
|
||||
* @param b
|
||||
|
||||
* @return ceil(a/b) * @see <a href="http://tools.ietf.org/html/rfc2898">RFC 2898 5.2 Step
|
||||
* 2.</a> */
|
||||
protected int ceil(int a, int b) {
|
||||
int m = 0;
|
||||
if (a % b > 0) {
|
||||
m = 1;
|
||||
}
|
||||
return a / b + m;
|
||||
}
|
||||
|
||||
/**
|
||||
* Function F.
|
||||
*
|
||||
|
||||
* @param dest
|
||||
* Destination byte buffer
|
||||
* @param offset
|
||||
* Offset into destination byte buffer
|
||||
* @param prf
|
||||
* Pseudo Random Function
|
||||
* @param S
|
||||
* Salt as array of bytes
|
||||
* @param c
|
||||
* Iteration count
|
||||
* @param blockIndex
|
||||
* @see <a href="http://tools.ietf.org/html/rfc2898">RFC 2898 5.2 Step
|
||||
* 3.</a> */
|
||||
protected void _F(byte[] dest, int offset, PRF prf, byte[] S, int c,
|
||||
int blockIndex) {
|
||||
int hLen = prf.getHLen();
|
||||
byte U_r[] = new byte[hLen];
|
||||
|
||||
// U0 = S || INT (i);
|
||||
byte U_i[] = new byte[S.length + 4];
|
||||
System.arraycopy(S, 0, U_i, 0, S.length);
|
||||
INT(U_i, S.length, blockIndex);
|
||||
|
||||
for (int i = 0; i < c; i++) {
|
||||
U_i = prf.doFinal(U_i);
|
||||
xor(U_r, U_i);
|
||||
}
|
||||
System.arraycopy(U_r, 0, dest, offset, hLen);
|
||||
}
|
||||
|
||||
/**
|
||||
* Block-Xor. Xor source bytes into destination byte buffer. Destination
|
||||
* buffer must be same length or less than source buffer.
|
||||
*
|
||||
* @param dest
|
||||
* @param src
|
||||
*/
|
||||
protected void xor(byte[] dest, byte[] src) {
|
||||
for (int i = 0; i < dest.length; i++) {
|
||||
dest[i] ^= src[i];
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Four-octet encoding of the integer i, most significant octet first.
|
||||
*
|
||||
|
||||
* @param dest
|
||||
* @param offset
|
||||
* @param i
|
||||
* @see <a href="http://tools.ietf.org/html/rfc2898">RFC 2898 5.2 Step
|
||||
* 3.</a> */
|
||||
protected void INT(byte[] dest, int offset, int i) {
|
||||
dest[offset + 0] = (byte) (i / (256 * 256 * 256));
|
||||
dest[offset + 1] = (byte) (i / (256 * 256));
|
||||
dest[offset + 2] = (byte) (i / (256));
|
||||
dest[offset + 3] = (byte) (i);
|
||||
}
|
||||
|
||||
/**
|
||||
* Method getParameters.
|
||||
|
||||
|
||||
* @return PBKDF2Parameters * @see fr.xephi.authme.security.pbkdf2.PBKDF2#getParameters() */
|
||||
public PBKDF2Parameters getParameters() {
|
||||
return parameters;
|
||||
}
|
||||
|
||||
/**
|
||||
* Method setParameters.
|
||||
* @param parameters PBKDF2Parameters
|
||||
|
||||
* @see fr.xephi.authme.security.pbkdf2.PBKDF2#setParameters(PBKDF2Parameters) */
|
||||
public void setParameters(PBKDF2Parameters parameters) {
|
||||
this.parameters = parameters;
|
||||
}
|
||||
|
||||
/**
|
||||
* Method setPseudoRandomFunction.
|
||||
* @param prf PRF
|
||||
|
||||
* @see fr.xephi.authme.security.pbkdf2.PBKDF2#setPseudoRandomFunction(PRF) */
|
||||
public void setPseudoRandomFunction(PRF prf) {
|
||||
this.prf = prf;
|
||||
}
|
||||
|
||||
/**
|
||||
* Convenience client function. Convert supplied password with random 8-byte
|
||||
* salt and 1000 iterations using HMacSHA1. Assume that password is in
|
||||
* ISO-8559-1 encoding. Output result as
|
||||
* "Salt:iteration-count:PBKDF2" with binary data in hexadecimal
|
||||
* encoding.
|
||||
*
|
||||
* <p>
|
||||
* Example: Password "password" (without the quotes) leads to
|
||||
* 48290A0B96C426C3:1000:973899B1D4AFEB3ED371060D0797E0EE0142BD04
|
||||
*
|
||||
* @param args
|
||||
* Supply the password as argument.
|
||||
|
||||
|
||||
*
|
||||
* @param args Supply the password as argument.
|
||||
* @throws IOException * @throws NoSuchAlgorithmException * @throws NoSuchAlgorithmException
|
||||
*/
|
||||
public static void main(String[] args)
|
||||
@@ -394,4 +157,225 @@ public class PBKDF2Engine implements PBKDF2 {
|
||||
System.exit(verifyOK ? 0 : 1);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Method deriveKey.
|
||||
*
|
||||
* @param inputPassword String
|
||||
* @return byte[] * @see fr.xephi.authme.security.pbkdf2.PBKDF2#deriveKey(String)
|
||||
*/
|
||||
public byte[] deriveKey(String inputPassword) {
|
||||
return deriveKey(inputPassword, 0);
|
||||
}
|
||||
|
||||
/**
|
||||
* Method deriveKey.
|
||||
*
|
||||
* @param inputPassword String
|
||||
* @param dkLen int
|
||||
* @return byte[] * @see fr.xephi.authme.security.pbkdf2.PBKDF2#deriveKey(String, int)
|
||||
*/
|
||||
public byte[] deriveKey(String inputPassword, int dkLen) {
|
||||
byte[] r = null;
|
||||
byte P[] = null;
|
||||
String charset = parameters.getHashCharset();
|
||||
if (inputPassword == null) {
|
||||
inputPassword = "";
|
||||
}
|
||||
try {
|
||||
if (charset == null) {
|
||||
P = inputPassword.getBytes();
|
||||
} else {
|
||||
P = inputPassword.getBytes(charset);
|
||||
}
|
||||
} catch (UnsupportedEncodingException e) {
|
||||
throw new RuntimeException(e);
|
||||
}
|
||||
assertPRF(P);
|
||||
if (dkLen == 0) {
|
||||
dkLen = prf.getHLen();
|
||||
}
|
||||
r = PBKDF2(prf, parameters.getSalt(), parameters.getIterationCount(), dkLen);
|
||||
return r;
|
||||
}
|
||||
|
||||
/**
|
||||
* Method verifyKey.
|
||||
*
|
||||
* @param inputPassword String
|
||||
* @return boolean * @see fr.xephi.authme.security.pbkdf2.PBKDF2#verifyKey(String)
|
||||
*/
|
||||
public boolean verifyKey(String inputPassword) {
|
||||
byte[] referenceKey = getParameters().getDerivedKey();
|
||||
if (referenceKey == null || referenceKey.length == 0) {
|
||||
return false;
|
||||
}
|
||||
byte[] inputKey = deriveKey(inputPassword, referenceKey.length);
|
||||
|
||||
if (inputKey == null || inputKey.length != referenceKey.length) {
|
||||
return false;
|
||||
}
|
||||
for (int i = 0; i < inputKey.length; i++) {
|
||||
if (inputKey[i] != referenceKey[i]) {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Factory method. Default implementation is (H)MAC-based. To be overridden
|
||||
* in derived classes.
|
||||
*
|
||||
* @param P User-supplied candidate password as array of bytes.
|
||||
*/
|
||||
protected void assertPRF(byte[] P) {
|
||||
if (prf == null) {
|
||||
prf = new MacBasedPRF(parameters.getHashAlgorithm());
|
||||
}
|
||||
prf.init(P);
|
||||
}
|
||||
|
||||
/**
|
||||
* Method getPseudoRandomFunction.
|
||||
*
|
||||
* @return PRF * @see fr.xephi.authme.security.pbkdf2.PBKDF2#getPseudoRandomFunction()
|
||||
*/
|
||||
public PRF getPseudoRandomFunction() {
|
||||
return prf;
|
||||
}
|
||||
|
||||
/**
|
||||
* Method setPseudoRandomFunction.
|
||||
*
|
||||
* @param prf PRF
|
||||
* @see fr.xephi.authme.security.pbkdf2.PBKDF2#setPseudoRandomFunction(PRF)
|
||||
*/
|
||||
public void setPseudoRandomFunction(PRF prf) {
|
||||
this.prf = prf;
|
||||
}
|
||||
|
||||
/**
|
||||
* Core Password Based Key Derivation Function 2.
|
||||
*
|
||||
* @param prf Pseudo Random Function (i.e. HmacSHA1)
|
||||
* @param S Salt as array of bytes. <code>null</code> means no salt.
|
||||
* @param c Iteration count (see RFC 2898 4.2)
|
||||
* @param dkLen desired length of derived key.
|
||||
* @return internal byte array * @see <a href="http://tools.ietf.org/html/rfc2898">RFC 2898 5.2</a>
|
||||
*/
|
||||
protected byte[] PBKDF2(PRF prf, byte[] S, int c, int dkLen) {
|
||||
if (S == null) {
|
||||
S = new byte[0];
|
||||
}
|
||||
int hLen = prf.getHLen();
|
||||
int l = ceil(dkLen, hLen);
|
||||
int r = dkLen - (l - 1) * hLen;
|
||||
byte T[] = new byte[l * hLen];
|
||||
int ti_offset = 0;
|
||||
for (int i = 1; i <= l; i++) {
|
||||
_F(T, ti_offset, prf, S, c, i);
|
||||
ti_offset += hLen;
|
||||
}
|
||||
if (r < hLen) {
|
||||
// Incomplete last block
|
||||
byte DK[] = new byte[dkLen];
|
||||
System.arraycopy(T, 0, DK, 0, dkLen);
|
||||
return DK;
|
||||
}
|
||||
return T;
|
||||
}
|
||||
|
||||
/**
|
||||
* Integer division with ceiling function.
|
||||
*
|
||||
* @param a
|
||||
* @param b
|
||||
* @return ceil(a/b) * @see <a href="http://tools.ietf.org/html/rfc2898">RFC 2898 5.2 Step
|
||||
* 2.</a>
|
||||
*/
|
||||
protected int ceil(int a, int b) {
|
||||
int m = 0;
|
||||
if (a % b > 0) {
|
||||
m = 1;
|
||||
}
|
||||
return a / b + m;
|
||||
}
|
||||
|
||||
/**
|
||||
* Function F.
|
||||
*
|
||||
* @param dest Destination byte buffer
|
||||
* @param offset Offset into destination byte buffer
|
||||
* @param prf Pseudo Random Function
|
||||
* @param S Salt as array of bytes
|
||||
* @param c Iteration count
|
||||
* @param blockIndex
|
||||
* @see <a href="http://tools.ietf.org/html/rfc2898">RFC 2898 5.2 Step
|
||||
* 3.</a>
|
||||
*/
|
||||
protected void _F(byte[] dest, int offset, PRF prf, byte[] S, int c,
|
||||
int blockIndex) {
|
||||
int hLen = prf.getHLen();
|
||||
byte U_r[] = new byte[hLen];
|
||||
|
||||
// U0 = S || INT (i);
|
||||
byte U_i[] = new byte[S.length + 4];
|
||||
System.arraycopy(S, 0, U_i, 0, S.length);
|
||||
INT(U_i, S.length, blockIndex);
|
||||
|
||||
for (int i = 0; i < c; i++) {
|
||||
U_i = prf.doFinal(U_i);
|
||||
xor(U_r, U_i);
|
||||
}
|
||||
System.arraycopy(U_r, 0, dest, offset, hLen);
|
||||
}
|
||||
|
||||
/**
|
||||
* Block-Xor. Xor source bytes into destination byte buffer. Destination
|
||||
* buffer must be same length or less than source buffer.
|
||||
*
|
||||
* @param dest
|
||||
* @param src
|
||||
*/
|
||||
protected void xor(byte[] dest, byte[] src) {
|
||||
for (int i = 0; i < dest.length; i++) {
|
||||
dest[i] ^= src[i];
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Four-octet encoding of the integer i, most significant octet first.
|
||||
*
|
||||
* @param dest
|
||||
* @param offset
|
||||
* @param i
|
||||
* @see <a href="http://tools.ietf.org/html/rfc2898">RFC 2898 5.2 Step
|
||||
* 3.</a>
|
||||
*/
|
||||
protected void INT(byte[] dest, int offset, int i) {
|
||||
dest[offset + 0] = (byte) (i / (256 * 256 * 256));
|
||||
dest[offset + 1] = (byte) (i / (256 * 256));
|
||||
dest[offset + 2] = (byte) (i / (256));
|
||||
dest[offset + 3] = (byte) (i);
|
||||
}
|
||||
|
||||
/**
|
||||
* Method getParameters.
|
||||
*
|
||||
* @return PBKDF2Parameters * @see fr.xephi.authme.security.pbkdf2.PBKDF2#getParameters()
|
||||
*/
|
||||
public PBKDF2Parameters getParameters() {
|
||||
return parameters;
|
||||
}
|
||||
|
||||
/**
|
||||
* Method setParameters.
|
||||
*
|
||||
* @param parameters PBKDF2Parameters
|
||||
* @see fr.xephi.authme.security.pbkdf2.PBKDF2#setParameters(PBKDF2Parameters)
|
||||
*/
|
||||
public void setParameters(PBKDF2Parameters parameters) {
|
||||
this.parameters = parameters;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -27,7 +27,7 @@ package fr.xephi.authme.security.pbkdf2;
|
||||
* href="http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html"
|
||||
* >http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html</a>.
|
||||
* </p>
|
||||
*
|
||||
*
|
||||
* @author Matthias Gärtner
|
||||
* @version 1.0
|
||||
*/
|
||||
@@ -35,22 +35,20 @@ public interface PBKDF2Formatter {
|
||||
|
||||
/**
|
||||
* Convert parameters to String.
|
||||
*
|
||||
* @param p
|
||||
* Parameters object to output.
|
||||
|
||||
* @return String representation */
|
||||
*
|
||||
* @param p Parameters object to output.
|
||||
* @return String representation
|
||||
*/
|
||||
public abstract String toString(PBKDF2Parameters p);
|
||||
|
||||
/**
|
||||
* Convert String to parameters. Depending on actual implementation, it may
|
||||
* be required to set further fields externally.
|
||||
*
|
||||
* @param s
|
||||
* String representation of parameters to decode.
|
||||
|
||||
*
|
||||
* @param s String representation of parameters to decode.
|
||||
* @param p PBKDF2Parameters
|
||||
* @return <code>false</code> syntax OK, <code>true</code> some syntax
|
||||
* issue. */
|
||||
* issue.
|
||||
*/
|
||||
public abstract boolean fromString(PBKDF2Parameters p, String s);
|
||||
}
|
||||
|
||||
@@ -27,7 +27,7 @@ package fr.xephi.authme.security.pbkdf2;
|
||||
* href="http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html"
|
||||
* >http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html</a>.
|
||||
* </p>
|
||||
*
|
||||
*
|
||||
* @author Matthias Gärtner
|
||||
* @version 1.0
|
||||
*/
|
||||
@@ -35,11 +35,11 @@ public class PBKDF2HexFormatter implements PBKDF2Formatter {
|
||||
|
||||
/**
|
||||
* Method fromString.
|
||||
*
|
||||
* @param p PBKDF2Parameters
|
||||
* @param s String
|
||||
|
||||
|
||||
* @return boolean * @see fr.xephi.authme.security.pbkdf2.PBKDF2Formatter#fromString(PBKDF2Parameters, String) */
|
||||
* @return boolean * @see fr.xephi.authme.security.pbkdf2.PBKDF2Formatter#fromString(PBKDF2Parameters, String)
|
||||
*/
|
||||
public boolean fromString(PBKDF2Parameters p, String s) {
|
||||
if (p == null || s == null) {
|
||||
return true;
|
||||
@@ -62,10 +62,10 @@ public class PBKDF2HexFormatter implements PBKDF2Formatter {
|
||||
|
||||
/**
|
||||
* Method toString.
|
||||
*
|
||||
* @param p PBKDF2Parameters
|
||||
|
||||
|
||||
* @return String * @see fr.xephi.authme.security.pbkdf2.PBKDF2Formatter#toString(PBKDF2Parameters) */
|
||||
* @return String * @see fr.xephi.authme.security.pbkdf2.PBKDF2Formatter#toString(PBKDF2Parameters)
|
||||
*/
|
||||
public String toString(PBKDF2Parameters p) {
|
||||
String s = BinTools.bin2hex(p.getSalt()) + ":" + String.valueOf(p.getIterationCount()) + ":" + BinTools.bin2hex(p.getDerivedKey());
|
||||
return s;
|
||||
|
||||
@@ -4,7 +4,7 @@ package fr.xephi.authme.security.pbkdf2;
|
||||
* <p>
|
||||
* Parameter data holder for PBKDF2 configuration.
|
||||
* </p>
|
||||
*
|
||||
* <p>
|
||||
* <hr />
|
||||
* <p>
|
||||
* A free Java implementation of Password Based Key Derivation Function 2 as
|
||||
@@ -32,7 +32,7 @@ package fr.xephi.authme.security.pbkdf2;
|
||||
* href="http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html"
|
||||
* >http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html</a>.
|
||||
* </p>
|
||||
*
|
||||
*
|
||||
* @author Matthias Gärtner
|
||||
* @version 1.0
|
||||
*/
|
||||
@@ -55,7 +55,6 @@ public class PBKDF2Parameters {
|
||||
/**
|
||||
* Constructor. Defaults to <code>null</code> for byte arrays, UTF-8 as
|
||||
* character set and 1000 for iteration count.
|
||||
*
|
||||
*/
|
||||
public PBKDF2Parameters() {
|
||||
this.hashAlgorithm = null;
|
||||
@@ -67,18 +66,14 @@ public class PBKDF2Parameters {
|
||||
|
||||
/**
|
||||
* Constructor.
|
||||
*
|
||||
* @param hashAlgorithm
|
||||
* for example HMacSHA1 or HMacMD5
|
||||
* @param hashCharset
|
||||
* for example UTF-8
|
||||
* @param salt
|
||||
* Salt as byte array, may be <code>null</code> (not recommended)
|
||||
* @param iterationCount
|
||||
* Number of iterations to execute. Recommended value 1000.
|
||||
*
|
||||
* @param hashAlgorithm for example HMacSHA1 or HMacMD5
|
||||
* @param hashCharset for example UTF-8
|
||||
* @param salt Salt as byte array, may be <code>null</code> (not recommended)
|
||||
* @param iterationCount Number of iterations to execute. Recommended value 1000.
|
||||
*/
|
||||
public PBKDF2Parameters(String hashAlgorithm, String hashCharset,
|
||||
byte[] salt, int iterationCount) {
|
||||
byte[] salt, int iterationCount) {
|
||||
this.hashAlgorithm = hashAlgorithm;
|
||||
this.hashCharset = hashCharset;
|
||||
this.salt = salt;
|
||||
@@ -88,20 +83,15 @@ public class PBKDF2Parameters {
|
||||
|
||||
/**
|
||||
* Constructor.
|
||||
*
|
||||
* @param hashAlgorithm
|
||||
* for example HMacSHA1 or HMacMD5
|
||||
* @param hashCharset
|
||||
* for example UTF-8
|
||||
* @param salt
|
||||
* Salt as byte array, may be <code>null</code> (not recommended)
|
||||
* @param iterationCount
|
||||
* Number of iterations to execute. Recommended value 1000.
|
||||
* @param derivedKey
|
||||
* Convenience data holder, not used during computation.
|
||||
*
|
||||
* @param hashAlgorithm for example HMacSHA1 or HMacMD5
|
||||
* @param hashCharset for example UTF-8
|
||||
* @param salt Salt as byte array, may be <code>null</code> (not recommended)
|
||||
* @param iterationCount Number of iterations to execute. Recommended value 1000.
|
||||
* @param derivedKey Convenience data holder, not used during computation.
|
||||
*/
|
||||
public PBKDF2Parameters(String hashAlgorithm, String hashCharset,
|
||||
byte[] salt, int iterationCount, byte[] derivedKey) {
|
||||
byte[] salt, int iterationCount, byte[] derivedKey) {
|
||||
this.hashAlgorithm = hashAlgorithm;
|
||||
this.hashCharset = hashCharset;
|
||||
this.salt = salt;
|
||||
@@ -111,14 +101,16 @@ public class PBKDF2Parameters {
|
||||
|
||||
/**
|
||||
* Method getIterationCount.
|
||||
|
||||
* @return int */
|
||||
*
|
||||
* @return int
|
||||
*/
|
||||
public int getIterationCount() {
|
||||
return iterationCount;
|
||||
}
|
||||
|
||||
/**
|
||||
* Method setIterationCount.
|
||||
*
|
||||
* @param iterationCount int
|
||||
*/
|
||||
public void setIterationCount(int iterationCount) {
|
||||
@@ -127,14 +119,16 @@ public class PBKDF2Parameters {
|
||||
|
||||
/**
|
||||
* Method getSalt.
|
||||
|
||||
* @return byte[] */
|
||||
*
|
||||
* @return byte[]
|
||||
*/
|
||||
public byte[] getSalt() {
|
||||
return salt;
|
||||
}
|
||||
|
||||
/**
|
||||
* Method setSalt.
|
||||
*
|
||||
* @param salt byte[]
|
||||
*/
|
||||
public void setSalt(byte[] salt) {
|
||||
@@ -143,14 +137,16 @@ public class PBKDF2Parameters {
|
||||
|
||||
/**
|
||||
* Method getDerivedKey.
|
||||
|
||||
* @return byte[] */
|
||||
*
|
||||
* @return byte[]
|
||||
*/
|
||||
public byte[] getDerivedKey() {
|
||||
return derivedKey;
|
||||
}
|
||||
|
||||
/**
|
||||
* Method setDerivedKey.
|
||||
*
|
||||
* @param derivedKey byte[]
|
||||
*/
|
||||
public void setDerivedKey(byte[] derivedKey) {
|
||||
@@ -159,14 +155,16 @@ public class PBKDF2Parameters {
|
||||
|
||||
/**
|
||||
* Method getHashAlgorithm.
|
||||
|
||||
* @return String */
|
||||
*
|
||||
* @return String
|
||||
*/
|
||||
public String getHashAlgorithm() {
|
||||
return hashAlgorithm;
|
||||
}
|
||||
|
||||
/**
|
||||
* Method setHashAlgorithm.
|
||||
*
|
||||
* @param hashAlgorithm String
|
||||
*/
|
||||
public void setHashAlgorithm(String hashAlgorithm) {
|
||||
@@ -175,14 +173,16 @@ public class PBKDF2Parameters {
|
||||
|
||||
/**
|
||||
* Method getHashCharset.
|
||||
|
||||
* @return String */
|
||||
*
|
||||
* @return String
|
||||
*/
|
||||
public String getHashCharset() {
|
||||
return hashCharset;
|
||||
}
|
||||
|
||||
/**
|
||||
* Method setHashCharset.
|
||||
*
|
||||
* @param hashCharset String
|
||||
*/
|
||||
public void setHashCharset(String hashCharset) {
|
||||
|
||||
@@ -27,7 +27,7 @@ package fr.xephi.authme.security.pbkdf2;
|
||||
* href="http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html"
|
||||
* >http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html</a>.
|
||||
* </p>
|
||||
*
|
||||
*
|
||||
* @author Matthias Gärtner
|
||||
* @version 1.0
|
||||
*/
|
||||
@@ -35,27 +35,25 @@ public interface PRF {
|
||||
|
||||
/**
|
||||
* Initialize this instance with the user-supplied password.
|
||||
*
|
||||
* @param P
|
||||
* The password supplied as array of bytes. It is the caller's
|
||||
* task to convert String passwords to bytes as appropriate.
|
||||
*
|
||||
* @param P The password supplied as array of bytes. It is the caller's
|
||||
* task to convert String passwords to bytes as appropriate.
|
||||
*/
|
||||
public void init(byte[] P);
|
||||
|
||||
/**
|
||||
* Pseudo Random Function
|
||||
*
|
||||
* @param M
|
||||
* Input data/message etc. Together with any data supplied during
|
||||
* initilization.
|
||||
|
||||
* @return Random bytes of hLen length. */
|
||||
*
|
||||
* @param M Input data/message etc. Together with any data supplied during
|
||||
* initilization.
|
||||
* @return Random bytes of hLen length.
|
||||
*/
|
||||
public byte[] doFinal(byte[] M);
|
||||
|
||||
/**
|
||||
* Query block size of underlying algorithm/mechanism.
|
||||
*
|
||||
|
||||
* @return block size */
|
||||
*
|
||||
* @return block size
|
||||
*/
|
||||
public int getHLen();
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user