Charles Bell
Posts: 519
Nickname: charles
Registered: Feb, 2002
|
|
Re: Password Encryption
|
Posted: Aug 25, 2002 7:28 AM
|
|
A very secure way of password encryption is to use a one way hash function provided by the java implementation of the Secure Hash Algorithm or SHA
You calculate the hash or digest of the user name and password to form a byte array that is stored in a file and then compare that byte array from one calculated from a user login name and password.
Combining the user name and password prevents a hacker from simply trying common passwords. The hash or digest is in bytes. Even if a hacker could read the byte array stored in a file, he could not even in whole lifetime guess or manually hack the user name and password combination that gives that byte array.
This way the actual valid user names and passwords are not in plain text anywhere, making hacking the sytem virtually impossible. If you log all login attempst, its easy to see from a review of the log whether someone is trying to brute force an entry.
The following method does the computation of the 20 byte array.
import java.io.*;
import java.security.*;
import java.util.*;
/** Uses the given digestalgorithm to compute a 20 byte array of the
* user name and password.
*/
private byte[] makeDigest(String user, String password){
byte[] digestbytes = new byte[20];
try{
MessageDigest messagedigest = MessageDigest.getInstance("SHA");
messagedigest.update(user.getBytes());
messagedigest.update(password.getBytes());
ByteArrayOutputStream baos = new ByteArrayOutputStream();
messagedigest.update(baos.toByteArray());
digestbytes = messagedigest.digest();
}catch(NoSuchAlgorithmException nsae){
System.err.println("NoSuchAlgorithmException: " + nsae.getMessage());
}
return digestbytes;
}
|
|
Previous Topic
