java - 如何使用 MD5 转换密码并根据有效凭据检查用户的凭据？

Question

我对 Java 很陌生。我必须编写一个程序，从用户那里获取用户名和密码，使用 MD5 转换密码，然后验证用户名和密码。用户有 3 次机会输入正确信息。一旦正确，我需要显示一条欢迎消息。如果输入错误信息3次，程序需要退出。我什至不知道从哪里开始。

我获得了一个包含 MD5 信息的文件。我还获得了一个文件，其中包含所有用户信息以及哈希密码。

这些是用户凭据:

griffin.keyes   108de81c31bf9c622f76876b74e9285f    "alphabet soup" 

rosario.dawson  3e34baa4ee2ff767af8c120a496742b5    "animal doctor"

bernie.gorilla  a584efafa8f9ea7fe5cf18442f32b07b    "secret password"

我获得的 MD5 是:

import java.security.MessageDigest;

public class MD5Digest {

    public static void main(String[] args) throws Exception {

        //Copy and paste this section of code
        String original = "letmein";  //Replace "password" with the actual password inputted by the user
        MessageDigest md = MessageDigest.getInstance("MD5");
        md.update(original.getBytes());
        byte[] digest = md.digest();
        StringBuffer sb = new StringBuffer();
        for (byte b : digest) {
            sb.append(String.format("%02x", b & 0xff));
        }
        //End copy/paste

        System.out.println("original:" + original);
        System.out.println("digested:" + sb.toString()); //sb.toString() is what you'll need to compare password strings
    }

}

我还应该将我的程序分为两个单独的方法，但这是我现在最不担心的。我已经为此工作了一个星期了，但还没有取得多大进展。任何帮助将不胜感激。这是我所拥有的

import java.security.MessageDigest;
import java.util.Scanner;

class CredAndPass {
    public static void CredAndPass() throws Exception {
        String original = "letmein";  //Replace "password" with the actual password inputted by the user
        MessageDigest md = MessageDigest.getInstance("MD5");
        md.update(original.getBytes());
        byte[] digest = md.digest();
        StringBuffer sb = new StringBuffer();
        for (byte b : digest) {
            sb.append(String.format("%02x", b & 0xff));
        }
    }
}
public class AuthSystem {

    public static void main(String[] args) throws Exception {
        int i;
        String username = "";
        String password = "";
        for (i = 0; i <= 2; ++i){
            Scanner scnr = new Scanner(System.in);
            System.out.println("Enter username:");
            username = scnr.next();
            System.out.println("Enter password:");
            String password1 = scnr.next();
        }
    }
}

Answer 1

首先，我们改进 CredAndPass.CredAndPass 以从给定的 String 获取 MD5 哈希值

class CredAndPass {
    public static String CredAndPass(String original) throws Exception {
        MessageDigest md = MessageDigest.getInstance("MD5");
        md.update(original.getBytes());
        byte[] digest = md.digest();
        // Note here that I use a StringBuilder instead of a StringBuffer
        // as it is not meant to be shared so no need to use a thread safe
        // builder of String
        StringBuilder sb = new StringBuilder(32);
        for (byte b : digest) {
            sb.append(String.format("%02x", b & 0xff));
        }
        // Returns the result
        return sb.toString();
    }
}

然后我们稍微修改一下main方法的逻辑，检查3次如果不成功就离开

public static void main(String[] args) throws Exception {
    // A Map for testing purpose representing the login and hash of your existing users
    Map<String, String> credentials = new HashMap<>();
    credentials.put("griffin.keyes", "108de81c31bf9c622f76876b74e9285f");
    credentials.put("rosario.dawson", "3e34baa4ee2ff767af8c120a496742b5");
    credentials.put("bernie.gorilla", "a584efafa8f9ea7fe5cf18442f32b07b");
    // Variable used to know if it was successful or not
    boolean success = false;
    BufferedReader scnr = new BufferedReader(new InputStreamReader(System.in));
    String username = null;
    // Iterate up to 3 times
    for (int i = 0; i < 3; ++i){
        System.out.println("Enter username:");
        username = scnr.readLine();
        System.out.println("Enter password:");
        String password1 = scnr.readLine();

        // Get the hash for the given username
        String hash = credentials.get(username);
        // Check if the username exists and if so check if the hash of his 
        // password matches with the hash of the provided password
        if (hash == null || !hash.equals(CredAndPass.CredAndPass(password1))) {
            // We don't have a match so we keep going
            System.err.println("User or password invalid");
            continue;
        }
        success = true;
        // Exit from the loop as we have a success
        break;
    }
    if (success) {
        System.out.printf("Welcome %s!%n", username);
    } else {
        System.out.println("Could not connect");
    }
}