Meishin/LoginSystem
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

#685 Fix PBKDF2 implementation

Browse Source 
- Fix our PBKDF2 hash implementation and its test class
- Use external dependency as PBKDF2 implementation
This commit is contained in:
ljacqu
2016-11-25 15:51:15 +01:00
parent 57e7c71d72
commit de5324bbc6
19 changed files with 46 additions and 1028 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/fr/xephi/authme/security/crypts/CryptPBKDF2.java
+12 -11
View File
@@ -1,22 +1,23 @@
package fr.xephi.authme.security.crypts;
import de.rtner.misc.BinTools;
import de.rtner.security.auth.spi.PBKDF2Engine;
import de.rtner.security.auth.spi.PBKDF2Parameters;
import fr.xephi.authme.security.crypts.description.Recommendation;
import fr.xephi.authme.security.crypts.description.Usage;
import fr.xephi.authme.security.pbkdf2.PBKDF2Engine;
import fr.xephi.authme.security.pbkdf2.PBKDF2Parameters;
import java.util.Arrays;
@Recommendation(Usage.DOES_NOT_WORK)
@Recommendation(Usage.RECOMMENDED)
public class CryptPBKDF2 extends HexSaltedMethod {
private static final int NUMBER_OF_ITERATIONS = 10_000;
@Override
public String computeHash(String password, String salt, String name) {
String result = "pbkdf2_sha256$10000$" + salt + "$";
PBKDF2Parameters params = new PBKDF2Parameters("HmacSHA256", "ASCII", salt.getBytes(), 10000);
String result = "pbkdf2_sha256$" + NUMBER_OF_ITERATIONS + "$" + salt + "$";
PBKDF2Parameters params = new PBKDF2Parameters("HmacSHA256", "UTF-8", salt.getBytes(), NUMBER_OF_ITERATIONS);
PBKDF2Engine engine = new PBKDF2Engine(params);
return result + Arrays.toString(engine.deriveKey(password, 64));
return result + BinTools.bin2hex(engine.deriveKey(password, 64));
}
@Override
@@ -26,15 +27,15 @@ public class CryptPBKDF2 extends HexSaltedMethod {
return false;
}
String salt = line[2];
String derivedKey = line[3];
PBKDF2Parameters params = new PBKDF2Parameters("HmacSHA256", "ASCII", salt.getBytes(), 10000, derivedKey.getBytes());
byte[] derivedKey = BinTools.hex2bin(line[3]);
PBKDF2Parameters params = new PBKDF2Parameters("HmacSHA256", "UTF-8", salt.getBytes(), 10000, derivedKey);
PBKDF2Engine engine = new PBKDF2Engine(params);
return engine.verifyKey(password);
}
@Override
public int getSaltLength() {
return 12;
return 16;
}
}
src/main/java/fr/xephi/authme/security/crypts/CryptPBKDF2Django.java
+3 -3
View File
@@ -1,9 +1,9 @@
package fr.xephi.authme.security.crypts;
import de.rtner.security.auth.spi.PBKDF2Engine;
import de.rtner.security.auth.spi.PBKDF2Parameters;
import fr.xephi.authme.ConsoleLogger;
import fr.xephi.authme.security.crypts.description.AsciiRestricted;
import fr.xephi.authme.security.pbkdf2.PBKDF2Engine;
import fr.xephi.authme.security.pbkdf2.PBKDF2Parameters;
import fr.xephi.authme.util.StringUtils;
import javax.xml.bind.DatatypeConverter;
@@ -19,7 +19,7 @@ public class CryptPBKDF2Django extends HexSaltedMethod {
PBKDF2Parameters params = new PBKDF2Parameters("HmacSHA256", "ASCII", salt.getBytes(), DEFAULT_ITERATIONS);
PBKDF2Engine engine = new PBKDF2Engine(params);
return result + String.valueOf(DatatypeConverter.printBase64Binary(engine.deriveKey(password, 32)));
return result + DatatypeConverter.printBase64Binary(engine.deriveKey(password, 32));
}
@Override
src/main/java/fr/xephi/authme/security/crypts/JOOMLA.java
+1 -1
View File
@@ -4,7 +4,7 @@ import fr.xephi.authme.security.HashUtils;
import fr.xephi.authme.security.crypts.description.Recommendation;
import fr.xephi.authme.security.crypts.description.Usage;
@Recommendation(Usage.RECOMMENDED)
@Recommendation(Usage.ACCEPTABLE)
public class JOOMLA extends HexSaltedMethod {
@Override