Hashing Java - Revision history

Imifos: page category

2016-02-02T14:31:42Z

page category

Markgordon: Fixed spelling error.

2016-01-17T04:57:30Z

Fixed spelling error.

Markgordon: Missing closing brace

2016-01-17T04:48:58Z

Missing closing brace

Markgordon: Reworked code to avoid possible copyright issue. Switched PBKDF2WithHmacSHA1 to PBKDF2WithHmacSHA512 in case some code reviewer has read about SHA1 issues(!).

2016-01-16T21:17:18Z

Reworked code to avoid possible copyright issue. Switched PBKDF2WithHmacSHA1 to PBKDF2WithHmacSHA512 in case some code reviewer has read about SHA1 issues(!).

Markgordon: Remove theory & motivation of hashing. Instead, direct the reader to OWASP Password Storage Cheat Sheet. Replace example guidance based on Manico & Detlefsen's Iron-Clad Java: Building Secure Web Applications

2016-01-16T00:39:18Z

Remove theory & motivation of hashing. Instead, direct the reader to OWASP Password Storage Cheat Sheet. Replace example guidance based on Manico & Detlefsen's Iron-Clad Java: Building Secure Web Applications

Show changes

Markgordon: Grammatical correction to test my ability to edit this page

2015-12-16T19:04:53Z

Grammatical correction to test my ability to edit this page

Jmanico at 22:04, 1 February 2015

2015-02-01T22:04:25Z

Jmanico: deprecating this bad page

2015-02-01T22:01:57Z

deprecating this bad page

Jmanico: deprecating this bad page

2015-02-01T22:01:19Z

deprecating this bad page

Daniel Serodio: "createTable", not "creerTable"

2012-08-09T18:46:44Z

"createTable", not "creerTable"

@@ Line 8: / Line 8: @@
 |}
-Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
 <br/>
@@ Line 52: / Line 52: @@
 See ''Iron-Clad Java: Building Secure Web Applications'' by Manico and Detlefsen, 2015, Oracle Press.
-[[Category:OWASP Java Project]]
+[[Category:Java]]

@@ Line 40: / Line 40: @@
 The ''salt'' argument should be random data and vary for each user. It should be at least 32 bytes long. Remember to save the salt with the hashed password!
-The ''interations'' argument specifies how many times the PBKDF2 executes its underlying algorithm. A higher value is safer. You need to experiment on hardware equivalent to your production systems. As a starting point, find a value that requires one half second to execute. Scaling to huge number of users is beyond the scope of this document. Remember to save the value of iterations with the hashed password!
+The ''iterations'' argument specifies how many times the PBKDF2 executes its underlying algorithm. A higher value is safer. You need to experiment on hardware equivalent to your production systems. As a starting point, find a value that requires one half second to execute. Scaling to huge number of users is beyond the scope of this document. Remember to save the value of iterations with the hashed password!
 A keyLength of 256 is safe.

@@ Line 19: / Line 19: @@
      public static byte[] hashPassword( final char[] password, final byte[] salt, final int iterations, final int keyLength ) {
-    try {
+        try {
-        SecretKeyFactory skf = SecretKeyFactory.getInstance( "PBKDF2WithHmacSHA512" );
+            SecretKeyFactory skf = SecretKeyFactory.getInstance( "PBKDF2WithHmacSHA512" );
-        PBEKeySpec spec = new PBEKeySpec( password, salt, iterations, keyLength );
+            PBEKeySpec spec = new PBEKeySpec( password, salt, iterations, keyLength );
-        SecretKey key = skf.generateSecret( spec );
+            SecretKey key = skf.generateSecret( spec );
-        byte[] res = key.getEncoded( );
+            byte[] res = key.getEncoded( );
-        return res;
+            return res;
-    } catch( NoSuchAlgorithmException | InvalidKeySpecException e ) {
+        } catch( NoSuchAlgorithmException | InvalidKeySpecException e ) {
-        throw new RuntimeException( e );
+            throw new RuntimeException( e );
+     }

@@ Line 13: / Line 13: @@
 ==Introduction==
-This page helps Java developers hash passwords safely. We rely on OWASP's [[Password Storage Cheat Sheet]] to explain the theory of hashing. Here we discuss only how Java developers can safely implement the advice in that cheat sheet.
+This page helps Java developers hash passwords safely. We rely on OWASP's [[Password Storage Cheat Sheet]] to explain hashing best practice and theory.
 ==Java Example==
@@ Line 20: / Line 20: @@
      try {
-         return SecretKeyFactory.getInstance( "PBKDF2WithHmacSHA1" ).generateSecret(
+         SecretKeyFactory skf = SecretKeyFactory.getInstance( "PBKDF2WithHmacSHA512" );
-            new PBEKeySpec( password, salt, iterations, keyLength )).getEncoded( );
+        PBEKeySpec spec = new PBEKeySpec( password, salt, iterations, keyLength );
      } catch( NoSuchAlgorithmException | InvalidKeySpecException e ) {
@@ Line 30: / Line 33: @@
 The password and salt arguments are arrays, as is the result of the hashPassword function.
-Sensitive data should be ''cleared'' after you have used it (generally, this means set the data to nulls).
+Sensitive data should be ''cleared'' after you have used it (set the array elements to zero).
-The example uses a Password Based Key Derivation Function 2 (PBKDF2), as discussed in [[Password Storage Cheat Sheet]].
+The example uses a Password Based Key Derivation Function 2 (PBKDF2), as discussed in the [[Password Storage Cheat Sheet]].
 The ''salt'' argument should be random data and vary for each user. It should be at least 32 bytes long. Remember to save the salt with the hashed password!
@@ Line 39: / Line 42: @@
 A keyLength of 256 is safe.
 The SecretKeyFactory and PBEKeySpec classes have been part of Java SE since version 1.4.

@@ Line 64: / Line 64: @@
 In this configuration, an attacker must handle a brute force attack on each individual password. The database is now birthday attack/rainbow crack resistant.
-A 64 bits salt is recommended in RSA PKCS5 standard.
+A 64-bit salt is recommended in RSA PKCS5 standard.
 '''Sample java code :'''

@@ Line 14: / Line 14: @@
 |}
+<br/>
 == Status ==
-Released 14/1/2008
+For more information on password storage for authentication, please visit the password storage cheatsheet here: https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet .
 ==Introduction==

@@ Line 2: / Line 2: @@
 | type=old
 | lastRevision=2010-08-30
-| comment=The page should be updated.
+| comment=The page should be updated or removed.
 }}

← Older revision		Revision as of 22:01, 1 February 2015
Line 1:		Line 1:
		+	{{taggedDocument
		+	\| type=old
		+	\| lastRevision=2010-08-30
		+	\| comment=The page should be updated.
		+	\| link=https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet
		+	}}
		+
		+	{\|
		+	\|-
		+	! width="700" align="center" \| <br>
		+	! width="500" align="center" \| <br>
		+	\|-
		+	\| align="right" \| [[Image:OWASP Inactive Banner.jpg\|800px\| link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Inactive_Projects]]
		+	\| align="right" \|
		+
		+	\|}
		+
	== Status ==		== Status ==
	Released 14/1/2008		Released 14/1/2008

@@ Line 90: / Line 90: @@
 ==Complete Java Sample==
-In order to create the table needed by this application, call the method creerTable().
+In order to create the table needed by this application, call the method createTable().
 It creates a TABLE called CREDENTIAL, with these fields :
 * LOGIN VARCHAR (100)  PRIMARY KEY
@@ Line 249: / Line 249: @@
-     public void creerTable(Connection con) throws SQLException{
+     public void createTable(Connection con) throws SQLException{
          Statement st = null;
          try {