Scribd
Upload
7 views2 pages

Java Secure Password Hashing Example

This program takes a password from the user as input, hashes it using MD5 along with a randomly generated salt, and prints the hashed password and salt to the console. It generates a salt using SecureRandom, combines the salt and password, hashes the result with MD5, and converts the hash and salt to uppercase hexadecimal strings. Any errors in hashing or reading input are caught and printed.

Uploaded by

Hugo
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
7 views2 pages

Java Secure Password Hashing Example

This program takes a password from the user as input, hashes it using MD5 along with a randomly generated salt, and prints the hashed password and salt to the console. It generates a salt using SecureRandom, combines the salt and password, hashes the result with MD5, and converts the hash and salt to uppercase hexadecimal strings. Any errors in hashing or reading input are caught and printed.

Uploaded by

Hugo
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

12/20/21, 2:20 PM exercise3.

java

1 import [Link];
2 import [Link];
3 import [Link];
4 import [Link];
5 import [Link];
6 import [Link];
7 import [Link];
8
9 public class exercise3 {
10    public static void main(String[] args) {
11        SecureRandom secureRandom = new SecureRandom();
12        byte[] byte_sal = new byte[16];
13        [Link](byte_sal);
14        String sal = [Link](byte_sal);
15        [Link]("Result: "+sal);
16
17        Console console = [Link]();
18        if (console == null) {
19            [Link]("Console unavailable");
20            return;
21       }
22
23        String password = [Link]("Enter password:");
24
25        try {
26            SecureRandom salt = new SecureRandom();
27            int salt_len = 16;
28            byte salt_bytes[] = new byte[salt_len];
29            [Link](salt_bytes);
30
31            ByteArrayOutputStream data_to_hash = new ByteArrayOutputStream();
32            data_to_hash.write(salt_bytes, 0, salt_len);
33            data_to_hash.write([Link]());
34
35            MessageDigest md = [Link]("MD5");
36
37
38            //#1#: Use md’s update() method. Use data_to_hash.toByteArray() as
input to md’s update() method
39
40            [Link](data_to_hash.toByteArray());
41
42            byte[] digest = [Link]();
43            String hash_pwd =
[Link](digest).toUpperCase();
44
45            String salt_str =
[Link](salt_bytes).toUpperCase();
46
47            [Link]("Storing into db hash:" + hash_pwd);
48            [Link]("\n");
49            [Link]("Storing into db salt:" + salt_str);
50            [Link]("\n");
51
52       } catch (NoSuchAlgorithmException e) {
53            [Link]("MD5 not supported for some reason");
54            return;
55       } catch (IOException e) {
56            [Link]("Could not prepare data for hashing");

localhost:4649/?mode=clike 1/2
12/20/21, 2:20 PM [Link]

57            return;
58       }
59   }
60
61 }
62

localhost:4649/?mode=clike 2/2

Common questions

Powered by AI

The method DatatypeConverter.printHexBinary is used in the 'exercise3' class to convert byte arrays into a string of uppercase hexadecimal characters. This conversion is crucial for presenting binary data in a readable and manageable format, which is especially important for storing and verifying data such as hashes and salts in databases .

In 'exercise3', console interactions are managed using the Console class to read password input from the user. If the console is unavailable (e.g., running in an environment where System.console() returns null), the program simply prints 'Console unavailable' and exits, indicating a limitation in obtaining user input for further processing .

The MessageDigest class in 'exercise3' is employed to create a cryptographic hash of the combined salt and password. It is implemented using the MD5 algorithm, where the update() method processes the bytes from a ByteArrayOutputStream containing the salt and password. Finally, the digest() method computes the hash, outputting it as a byte array .

Using MD5 for hashing in 'exercise3' poses security risks because MD5 is considered outdated and vulnerable to collision attacks. These vulnerabilities allow attackers to generate different data with the same hash, potentially leading to unauthorized access or validation bypass. More secure algorithms like SHA-256 are recommended for hashing sensitive data .

In the Java class 'exercise3', SecureRandom is utilized to generate salt for password hashing, enhancing security by ensuring that each password has a unique hash even if the same password is used multiple times. This randomness is crucial as it defends against rainbow table attacks that use precomputed hash lists .

The 'exercise3' Java class falls short of modern security practices by using MD5, which is vulnerable to collision attacks. Improvements include replacing it with SHA-256 or stronger algorithms for hashing, incorporating password-based key derivation functions like PBKDF2 to enhance resistance against brute force attacks, and ensuring input handling does not expose data even if the console is unavailable .

Converting the salt and hash to hexadecimal format in 'exercise3' is necessary for easy storage and readability. Hexadecimal serves as a compact and human-friendly representation of binary data, making it suitable for logging, displaying, or transmitting data in a consistent format, especially when storing into databases .

Storing both the hash and salt in a database is a security measure that ensures the integrity and confidentiality of passwords. The salt ensures that even identical passwords will have different hashes, preventing attackers from using precomputed hash tables effectively. This separation is critical in maintaining password security even if database contents are exposed .

The 'exercise3' Java class handles exceptions using try-catch blocks for NoSuchAlgorithmException and IOException. NoSuchAlgorithmException is significant as it handles cases where the desired cryptographic algorithm (MD5) isn't available in the environment, while IOException addresses failures in preparing data for hashing, such as stream writing problems .

ByteArrayOutputStream in 'exercise3' is used to collect the byte data of both the salt and password before hashing. It allows the program to write the salt bytes and password, then retrieve the combined data as a byte array needed for the MessageDigest update operation, ensuring all necessary components are included in the final hash calculation .

You might also like