...
Noncompliant Code Example
Code Block | ||
---|---|---|
| ||
import java.security.MessageDigest; import java.security.NoSuchAlgorithmException; public final class HashExamples { private String salt = "ia0942980234241sadfaewvo32"; //Randomly generated private void setPassword(String pass) throws Exception { MessageDigest sha_1 = MessageDigest.getInstance("SHA-1"); byte[] hashVal = sha_1.digest((pass+salt).getBytes()); //encode the string and salt saveBytes(hashVal,"credentials.pw"); //save the hash value to credentials.pw } private boolean checkPassword(String pass) throws Exception { MessageDigest sha_1 = MessageDigest.getInstance("SHA-1"); byte[] hashVal1 = sha_1.digest((pass+salt).getBytes()); //encode the string and salt byte[] hashVal2 = loadBytes("credentials.pw"); //load the hash value stored in credentials.pw return Arrays.equals(hashVal1, hashVal2); } } |
...