#1627 Replace BCryptService with Maven dependency (#1629)

* #1627 Replace BCryptService with Maven dependency
- Remove BCryptService in favor of a better BCrypt implementation (Maven dependency)
- Introduce BCryptHasher wrapping the dependency with more suitable methods
- Fix inaccurate details about salt length in docu annotation: for BCrypt it's always 22 chars
- Change phpBB hash to produce 2y hashes instead of 2a

* #1627 Use UTF-8 encoding when (dis)assembling Strings

* #1627 Small test additions
This commit is contained in:
ljacqu
2018-09-03 23:13:48 +02:00
committed by GitHub
parent d39562d624
commit b22f26822b
18 changed files with 342 additions and 928 deletions
@@ -1,45 +1,17 @@
package fr.xephi.authme.security.crypts;
import fr.xephi.authme.ConsoleLogger;
import fr.xephi.authme.security.HashUtils;
import fr.xephi.authme.util.ExceptionUtils;
import at.favre.lib.crypto.bcrypt.BCrypt;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
public class XfBCrypt implements EncryptionMethod {
public class XfBCrypt extends BCryptBasedHash {
public static final String SCHEME_CLASS = "XenForo_Authentication_Core12";
private static final Pattern HASH_PATTERN = Pattern.compile("\"hash\";s.*\"(.*)?\"");
@Override
public String generateSalt() {
return BCryptService.gensalt();
}
@Override
public String computeHash(String password, String salt, String name) {
return BCryptService.hashpw(password, salt);
}
@Override
public HashedPassword computeHash(String password, String name) {
String salt = generateSalt();
return new HashedPassword(BCryptService.hashpw(password, salt), null);
}
@Override
public boolean comparePassword(String password, HashedPassword hash, String salt) {
try {
return HashUtils.isValidBcryptHash(hash.getHash()) && BCryptService.checkpw(password, hash.getHash());
} catch (IllegalArgumentException e) {
ConsoleLogger.warning("XfBCrypt checkpw() returned " + ExceptionUtils.formatException(e));
}
return false;
}
@Override
public boolean hasSeparateSalt() {
return false;
XfBCrypt() {
super(new BCryptHasher(BCrypt.Version.VERSION_2A, 10));
}
/**