Page History

public final class Password {
  private void setPassword(byte[] pass) throws Exception {
    // Arbitrary encryption scheme
    bytesbyte[] encrypted = encrypt(pass);
    clearArray(pass);    
    // Encrypted password to password.bin
    saveBytes(encrypted,"password.bin");
    clearArray(encrypted); 
  }

  boolean checkPassword(byte[] pass) throws Exception {
    // Load the encrypted password
    byte[] encrypted = loadBytes("password.bin"); 
    byte[] decrypted = decrypt(encrypted);
    clearArray(encrypted);
    boolean arraysEqual = Arrays.equal(decrypted, pass);
    clearArray(decrypted);
    clearArray(pass);
    return arraysEqual;
  }

  private void clearArray(byte[] a) {
    for (int i = 0; i < a.length; i++) {
      a[i] = 0;
    }
  }

  private byte[] encrypt(byte[] clearValue) {
    // ... symmetric encryption of clearValue bytes, returning the encrypted value
  }

  private byte[] decrypt(byte[] encryptedValue) {
    // ... symmetric decryption of  encryptedValue bytes, returning clear value
  }

  private void saveBytes(byte[] bytes, String filename) throws IOException {
    // ... write bytes to the file
  }
  
  private byte[] loadBytes(String filename) throws IOException { 
    // ... read bytes to the file 
  }
}

import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;

public final class Password {
  private SecureRandom random = new SecureRandom();

  private void setPassword(String pass) throws Exception {
    byte[] salt = generateSalt(12 new byte[12];
    random.nextBytes(salt);
    MessageDigest msgDigest = MessageDigest.getInstance("SHA-256");
    // Encode the string and salt
    byte[] hashVal = msgDigest.digest((pass+salt).getBytes());
    saveBytes(salt, "salt.bin");
    // Save the hash value to password.bin
    saveBytes(hashVal,"password.bin");
  }

   boolean checkPassword(String pass) throws Exception {
    byte[] salt = loadBytes("salt.bin");
    MessageDigest msgDigest = MessageDigest.getInstance("SHA-256");
    // Encode the string and salt
    byte[] hashVal1 = msgDigest.digest((pass+salt).getBytes());
    // Load the hash value stored in password.bin
    byte[] hashVal2 = loadBytes("password.bin");
    return Arrays.equals(hashVal1, hashVal2);
  }

  private void saveBytes(byte[] generateSalt(int n)bytes, String filename) throws IOException {
    // Generate a random byte array of length n... write bytes to the file
  }   

  private byte[] loadBytes(String filename) throws IOException { 
    // ... read bytes to the file 
  }
}

import java.security.MessageDigestGeneralSecurityException;
import java.security.SecureRandom;
import java.security.NoSuchAlgorithmExceptionspec.KeySpec;

public import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.PBEKeySpec;
  
final class Password {

  private void setPassword(byte[] pass) throws Exception {SecureRandom random = new SecureRandom();
  private final byte[] saltint SALT_BYTE_LENGTH = generateSalt(12);
  private final byte[]int inputITERATIONS = appendArrays(pass, salt)100000;
  private final MessageDigestString msgDigestALGORITHM = MessageDigest.getInstance("SHA-256")"PBKDF2WithHmacSHA256";
    
  // Encode the string and salt* Set password to new value, zeroing out password */
  void  bytesetPassword(char[] hashVal = msgDigest.digest(input);    pass)
      throws IOException, GeneralSecurityException  {
    clearArray(pass);   byte[] salt = new byte[SALT_BYTE_LENGTH];
    clearArrayrandom.nextBytes(inputsalt);
    saveBytes(salt, "salt.bin");    
    // Save the hash value to password.binbyte[] hashVal = hashPassword(pass, salt); 
    saveBytes(hashVal,"password.bin"); 
    clearArray(salt);
    clearArray(hashVal);
  }
Arrays.fill(hashVal, (byte) 0);
  }

  /* Indicates if given password is correct */
  boolean checkPassword(bytechar[] pass)
      throws ExceptionIOException, GeneralSecurityException  {
    byte[] salt = loadBytes("salt.bin");
    byte[] inputhashVal1 = appendArrayshashPassword(pass, salt);
    //  MessageDigest msgDigestLoad the hash value stored in password.bin
    byte[] hashVal2 = MessageDigest.getInstanceloadBytes("SHA-256password.bin");
    //boolean EncodearraysEqual the string and salt= timingEquals(hashVal1, hashVal2);
    byte[] hashVal1 = msgDigest.digest(input); 
    clearArray(pass);
    clearArray(input);
    // Load the hash value stored in password.bin
    byte[] hashVal2 = loadBytes("password.bin"); 
    boolean arraysEqual = Arrays.equals(hashVal1, hashVal2);
    clearArray(hashVal1);
    clearArray(hashVal2Arrays.fill(hashVal1, (byte) 0);
    Arrays.fill(hashVal2, (byte) 0);
    return arraysEqual;
  }
  
  /* Encrypts password & salt and zeroes both */
  private byte[] hashPassword(char[] pass, byte[] salt)
      throws GeneralSecurityException {
    KeySpec spec = new PBEKeySpec(pass, salt, ITERATIONS);
    Arrays.fill(pass, (char) 0);
    Arrays.fill(salt, (byte) 0);
    SecretKeyFactory f = SecretKeyFactory.getInstance(ALGORITHM);
    return arraysEqualf.generateSecret(spec).getEncoded();
  }

   private/**
   * Indicates if both byte[] generateSalt(int n) {
    // Generate a random byte array of length n
  }

  private byte[] appendArrays(byte[] a, byte[] barrays are equal
   * but uses same amount of time if they are the same or different
   * to prevent timing attacks
   */
  public static boolean timingEquals(byte b1[], byte b2[]) {
    // Return a new array of a[] appended to b[]
  }

  private void clearArray(byte[] a) {
    boolean result = true;
    int len = b1.length;
    if (len != b2.length) {
      result = false;
    }
    if (len > b2.length) {
      len = b2.length;
    }
    for (int i = 0; i < a.lengthlen; i++) {
      aresult &= (b1[i] == 0;
    } b2[i]);
    }
    return result;
  }

  private void saveBytes(byte[] bytes, String filename) throws IOException {
    // ... write bytes to the file
  }

  private byte[] loadBytes(String filename) throws IOException {
    // ... read bytes to the file
  }
}