我有一个使用 JDBC Jquery 和 MYSQL 的应用程序,它列出了一个带引号的表,并且用户可以添加引号。
我有一个登录页面,我在其中检查用户名的输入并将其与数据库中存在的内容进行比较。像这样,效果很好
public Boolean findByUsername(String username) throws SQLException {
ResultSet rs = null;
Connection conn = null;
PreparedStatement pstmt = null;
try {
conn = Database.getConnection();
conn.setAutoCommit(false);
String query = "SELECT * FROM user WHERE username = ?";
pstmt = conn.prepareStatement(query);
pstmt.setString(1, username);
rs = pstmt.executeQuery();
if (rs.next()) {
return true;
}
} catch (Exception e) {
e.printStackTrace();
throw new RuntimeException(e);
} finally {
conn.close();
}
return false;
}
但是当我想比较密码时,我遇到了问题,我用 PBKDF2 对密码加盐,它会生成一些像这样的随机字符 1000:485b5808b4786d6aa6e5360ad157945ee927d85e49e96312:60d76b0ef1b742cfa462d84eb7fd7c37eb361717179c0a45。当我想将密码输入与数据库中的内容进行比较时,我使用此方法。
public Boolean findByPassword(String password) throws SQLException,
NoSuchAlgorithmException, InvalidKeySpecException {
ResultSet rs = null;
Connection conn = null;
PreparedStatement pstmt = null;
PasswordHash p = new PasswordHash();
String hash = p.createHash(password);
try {
conn = Database.getConnection();
conn.setAutoCommit(false);
String query = "SELECT * FROM user WHERE passwd = ?";
System.out.println("password: " +password);
System.out.println("hashpassword " +hash);
pstmt = conn.prepareStatement(query);
pstmt.setString(1, hash);
rs = pstmt.executeQuery();
if (rs.next()) {
if(p.validatePassword(password, hash)){
return true;
}
}
} catch (Exception e) {
e.printStackTrace();
throw new RuntimeException(e);
} finally {
conn.close();
}
return false;
}
我使用此类来哈希密码
public class PasswordHash {
public final String PBKDF2_ALGORITHM = "PBKDF2WithHmacSHA1";
// The following constants may be changed without breaking existing hashes.
public final int SALT_BYTE_SIZE = 24;
public final int HASH_BYTE_SIZE = 24;
public final int PBKDF2_ITERATIONS = 1000;
public final int ITERATION_INDEX = 0;
public final int SALT_INDEX = 1;
public final int PBKDF2_INDEX = 2;
/**
* Returns a salted PBKDF2 hash of the password.
*
* @param password
* the password to hash
* @return a salted PBKDF2 hash of the password
*/
public String createHash(String password) throws NoSuchAlgorithmException,
InvalidKeySpecException {
return createHash(password.toCharArray());
}
/**
* Returns a salted PBKDF2 hash of the password.
*
* @param password
* the password to hash
* @return a salted PBKDF2 hash of the password
*/
public String createHash(char[] password) throws NoSuchAlgorithmException,
InvalidKeySpecException {
// Generate a random salt
SecureRandom random = new SecureRandom();
byte[] salt = new byte[SALT_BYTE_SIZE];
random.nextBytes(salt);
// Hash the password
byte[] hash = pbkdf2(password, salt, PBKDF2_ITERATIONS, HASH_BYTE_SIZE);
// format iterations:salt:hash
return PBKDF2_ITERATIONS + ":" + toHex(salt) + ":" + toHex(hash);
}
/**
* Validates a password using a hash.
*
* @param password
* the password to check
* @param correctHash
* the hash of the valid password
* @return true if the password is correct, false if not
*/
public boolean validatePassword(String password, String correctHash)
throws NoSuchAlgorithmException, InvalidKeySpecException {
return validatePassword(password.toCharArray(), correctHash);
}
/**
* Validates a password using a hash.
*
* @param password
* the password to check
* @param correctHash
* the hash of the valid password
* @return true if the password is correct, false if not
*/
public boolean validatePassword(char[] password, String correctHash)
throws NoSuchAlgorithmException, InvalidKeySpecException {
// Decode the hash into its parameters
String[] params = correctHash.split(":");
int iterations = Integer.parseInt(params[ITERATION_INDEX]);
byte[] salt = fromHex(params[SALT_INDEX]);
byte[] hash = fromHex(params[PBKDF2_INDEX]);
// Compute the hash of the provided password, using the same salt,
// iteration count, and hash length
byte[] testHash = pbkdf2(password, salt, iterations, hash.length);
// Compare the hashes in constant time. The password is correct if
// both hashes match.
return slowEquals(hash, testHash);
}
/**
* Compares two byte arrays in length-constant time. This comparison method
* is used so that password hashes cannot be extracted from an on-line
* system using a timing attack and then attacked off-line.
*
* @param a
* the first byte array
* @param b
* the second byte array
* @return true if both byte arrays are the same, false if not
*/
private boolean slowEquals(byte[] a, byte[] b) {
int diff = a.length ^ b.length;
for (int i = 0; i < a.length && i < b.length; i++)
diff |= a[i] ^ b[i];
return diff == 0;
}
/**
* Computes the PBKDF2 hash of a password.
*
* @param password
* the password to hash.
* @param salt
* the salt
* @param iterations
* the iteration count (slowness factor)
* @param bytes
* the length of the hash to compute in bytes
* @return the PBDKF2 hash of the password
*/
private byte[] pbkdf2(char[] password, byte[] salt, int iterations,
int bytes) throws NoSuchAlgorithmException, InvalidKeySpecException {
PBEKeySpec spec = new PBEKeySpec(password, salt, iterations, bytes * 8);
SecretKeyFactory skf = SecretKeyFactory.getInstance(PBKDF2_ALGORITHM);
return skf.generateSecret(spec).getEncoded();
}
/**
* Converts a string of hexadecimal characters into a byte array.
*
* @param hex
* the hex string
* @return the hex string decoded into a byte array
*/
private byte[] fromHex(String hex) {
byte[] binary = new byte[hex.length() / 2];
for (int i = 0; i < binary.length; i++) {
binary[i] = (byte) Integer.parseInt(
hex.substring(2 * i, 2 * i + 2), 16);
}
return binary;
}
/**
* Converts a byte array into a hexadecimal string.
*
* @param array
* the byte array to convert
* @return a length*2 character string encoding the byte array
*/
private String toHex(byte[] array) {
BigInteger bi = new BigInteger(1, array);
String hex = bi.toString(16);
int paddingLength = (array.length * 2) - hex.length();
if (paddingLength > 0)
return String.format("%0" + paddingLength + "d", 0) + hex;
else
return hex;
}
/**
* Tests the basic functionality of the PasswordHash class
*
* @param args
* ignored
*/
}
我在这里调用该方法
@POST
@Path("/login")
@Produces(MediaType.TEXT_PLAIN)
public String LogInUser(String username, String password)
throws NoSuchAlgorithmException, InvalidKeySpecException,
SQLException {
Gson gson = new Gson();
User theuser = gson.fromJson(username, User.class);
if (!u.findByUsername(theuser.getUsername())
&& u.findByPassword(theuser.getPasswd())) {
return theuser.getUsername();
}
return null;
}
如何将密码输入与数据库中存在的内容进行比较?
最佳答案
您查询 findByUsername
中的数据库方法使用 SELECT * FROM user WHERE username = ?
。该查询的结果也应该返回密码哈希值。因此,只需从此查询中获取密码哈希值,然后调用 validatePassword
.
忘记你的findByPassword
方法。这是行不通的。除此之外,它是完全错误的。 (如果数据库中存储的任何用户提供了密码,它将返回 true)
关于在 SQL(或者实际上任何数据库,或者更确切地说任何存储)中存储密码的一些提示:
- 始终存储通过强哈希哈希处理的密码。 (您可以这样做,但只要有人谈论存储密码,就应该重复此操作)
- 始终对哈希值加盐。 (你也这样做,但与上面相同)
- 并且请确保您的盐是随机的。
- 始终通过用户名或您的唯一标识符进行查询。
- 此标识符有唯一的键。
- 切勿使用任何可能包含重复项的列来查找用户记录。
- 这意味着永远不要通过密码查询(或哈希)。
- 切勿在查询中使用密码。切勿以明文形式使用。
- 更好的是,尝试避免在 SELECT 中使用哈希。
- 使用多轮算法。但要小心。
- 不要自己实现该算法,除非您知道自己在做什么。
- 保持合理的轮数。对密码进行 100 毫秒的哈希处理可能会让您轻松 DoSed。
- 不要做类似
for(int i=0;i<rounds;i++) md5(previous_hash)
的事情。它可能并且将会损害哈希值。
- 永远不要自己实现哈希。(当然,除非您非常清楚自己在做什么)
- 不要组合哈希值。
-
md5(sha256(sha512(password)))
乍一看似乎是个好主意,但相信我,事实并非如此。
-
- 始终存储经过哈希处理的密码。始终使用强哈希。始终使用随机盐对哈希加盐。
(如果有人有关于缺少提示的提示,我很乐意添加......)
关于java - 验证用户名和加盐密码,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/29855466/