24 Commits

Author SHA1 Message Date
ljacqu
5be3f8facc #1095 Update SMF hash algorithm to generate salt as SMF does
- The salt isn't used for password hashing but SMF requires that there be one to generate the authentication cookie. This does not yet enable registration from Minecraft: SMF has other non-null columns that need to be tackled. This is a first step.
2017-10-08 22:42:37 +02:00
ljacqu
de5324bbc6 #685 Fix PBKDF2 implementation
- Fix our PBKDF2 hash implementation and its test class
- Use external dependency as PBKDF2 implementation
2016-11-25 15:51:15 +01:00
ljacqu
e224d62b7e Hashes: make tests faster when 'skip long tests' profile is enabled 2016-08-27 21:26:36 +02:00
ljacqu
3753a0ef96 #565 Allow to skip extended encryption methods
- Set system property via surefire plugin and create profile that modifies the property
- Check for the new property in AbstractEncryptionMethodTest and shorten/skip the tests when necessary
2016-06-05 00:29:31 +02:00
ljacqu
9b1ee86b2f Trivial code householding
- Replace `if (!x) ... else ...` with `if(x) ... else ...`
- Avoid throwing RuntimeException; use children
2016-05-30 12:18:55 +02:00
ljacqu
3b33dc774d #369 Fix WBB4 algorithm
- Update BCrypt implementation version
- Separate third-party BCrypt implementation from our BCRYPT EncryptionMethod extension
- Fix WBB4: ensure password is hashed with bcrypt twice and that we check accordingly
2016-01-18 13:31:54 +01:00
ljacqu
a0da423a7b Minor - Javadoc changes
- Add/replace/improve javadoc in the commands and encryption section
- Note: A simple <p> is the javadoc way to make a new paragraph
http://www.oracle.com/technetwork/java/javase/documentation/index-137868.html#format
- Note: Do not escape '<' and '>' inside of {@code }
- Note: '>' does not need to be escaped
2015-12-31 13:32:41 +01:00
ljacqu
eea3697fa4 #364 Add test for bogus hashes
- Verify that a "hash" in the wrong format doesn't throw exception (this is relevant when the supportOldPasswordHash setting is enabled)
2015-12-30 23:24:36 +01:00
ljacqu
c0a393b8b3 Minor - rename EncryptedPassword to HashedPassword
- We hash passwords; we don't encrypt them
2015-12-30 22:51:59 +01:00
ljacqu
e85dbe81e5 #358 Ensure lowercase player name, issue cleanup
- Ensure within PasswordSecurity that the player name is lowercase
- Remove check for MD5VB separate salt (we only generate hashes with the salt embedded, so either we need to change that or we don't need this check)
- Remove obsolete TODO
2015-12-30 22:45:18 +01:00
ljacqu
a3402d573f #358 Handle hash + salt as one "unit"
- Rename HashResult to EncryptedPassword to reflect its broader use
- Use EncryptedPassword in methods that require the hash and the salt, instead of passing them as strings separately
- Store EncryptedPassword as field in PlayerAuth; updatePassword() thus processes the entire data in the EncryptedPassword object
2015-12-30 17:56:22 +01:00
ljacqu
922082f312 #364 Add HashAlgorithm integration test, fix failing tests
- Create integration test for the HashAlgorithm enum
- Create AsciiRestricted annotation and make test aware of it
- Add option to skip "same hash for same salt" test (for wordpress)
- Change some EncryptionMethods to extend from a common superclass
2015-12-29 13:29:26 +01:00
ljacqu
47f4275225 #358 Update EncryptionMethod to new interface
- Add new methods to the EncryptionMethod interface
- Delete temporary interface (NewEncrMethod)
- Remove temporary checks and casts to NewEncrMethod
2015-12-28 22:00:43 +01:00
ljacqu
73bc6e286a #369 Fix bcrypt 2y implementation
- Change salt length to 22: it was once changed on accident during some other commit
2015-12-28 21:03:33 +01:00
ljacqu
48d0a65724 #358 Create encryption method supertypes, add new methods 2015-12-28 20:10:45 +01:00
ljacqu
31730699ac #358 Start refactoring PasswordSecurity
- Add new methods temporarily to NewEncrMethod interface
   - No data source access within EncryptionMethod implementations
   - Generate the salt within the EncryptionMethod implementation
- Deprecate static methods on PasswordSecurity
- Adjust AbstractEncryptionMethodTest to test the classes with the new interface
- Add getter for data source instead of accessing field directly
2015-12-28 16:23:08 +01:00
ljacqu
90a0325194 #358 Add future interface methods, remove exception throwing
- Create Utils class for a common implementation of md5/sha1
- Create "foolproof" way of getting the MessageDigest for md5 etc. (MessageDigestAlgorithm enum)
- Create description annotations to annotate algorithms with usage recommendation and salt type
2015-12-26 23:59:32 +01:00
ljacqu
71a9f4140b #375 Issue warning instead of failing test for non-ASCII password
- Add javadoc to fields
2015-12-26 12:52:05 +01:00
ljacqu
c50741e1ca #375 Remove Ignore annotation on password hash check test 2015-12-23 15:28:52 +01:00
ljacqu
f785d9d357 Revert 799ecf8 and apply Ignore annotation to test failing locally
- Revert commit (undo formatting changes, commented out code)
- Add ignore to not run the test due to local problems (probably because of some character encoding issue)
2015-12-23 09:19:59 +01:00
Xephi59
799ecf8f7e Comment these test for this moment 2015-12-23 00:46:08 +01:00
ljacqu
1f11537b85 #364 Add more tests for encryption algorithms
- Rename getHash() to computeHash(): get.. suggests it's just retrieving some field but it's really doing a computation, which is quite complex depending on the hash algorithm
2015-12-20 23:43:54 +01:00
ljacqu
51d1705b1f #364 Add tests for more encryption algorithms 2015-12-20 14:08:43 +01:00
ljacqu
bf7a0c5a49 #364 Create first EncryptionMethod tests 2015-12-20 00:51:15 +01:00