@Test public void validatePasswordTest() { char[][] password = new char[10][]; for (int i = 0; i < password.length; i++) { password[i] = randomString(20).toCharArray(); byte[] salt = PasswordUtil.generateRandomSalt(); logger.debug("Validating password '{}' with salt '{}'.", String.valueOf(password[i]), EncryptionUtil.byteToHex(salt)); byte[] hash = PasswordUtil.generateHash(password[i], salt); boolean isValid = PasswordUtil.validatePassword(password[i], salt, hash); assertTrue(isValid); for (int j = 0; j < 3; j++) { char[] otherPW; do { otherPW = randomString(20).toCharArray(); } while (Arrays.equals(otherPW, password[i])); byte[] otherSalt; do { otherSalt = PasswordUtil.generateRandomSalt(); } while (Arrays.equals(otherSalt, salt)); byte[] otherHash = null; do { otherHash = PasswordUtil.generateHash(randomString(20).toCharArray(), PasswordUtil.generateRandomSalt()); } while (Arrays.equals(otherHash, hash)); assertFalse(PasswordUtil.validatePassword(otherPW, salt, hash)); assertFalse(PasswordUtil.validatePassword(password[i], otherSalt, hash)); assertFalse(PasswordUtil.validatePassword(password[i], salt, otherHash)); assertFalse(PasswordUtil.validatePassword(otherPW, otherSalt, hash)); assertFalse(PasswordUtil.validatePassword(password[i], otherSalt, otherHash)); assertFalse(PasswordUtil.validatePassword(otherPW, salt, otherHash)); assertFalse(PasswordUtil.validatePassword(otherPW, otherSalt, otherHash)); } } }
public static boolean validatePassword(char[] password, byte[] salt, byte[] correctHash) { byte[] testHash = getPBKDF2Hash(password, salt, HASH_BIT_SIZE); return slowCompare(correctHash, testHash); }
PasswordUtil { public static boolean validatePassword(char[] password, byte[] salt, byte[] correctHash) { byte[] testHash = getPBKDF2Hash(password, salt, HASH_BIT_SIZE); return slowCompare(correctHash, testHash); } }
PasswordUtil { public static boolean validatePassword(char[] password, byte[] salt, byte[] correctHash) { byte[] testHash = getPBKDF2Hash(password, salt, HASH_BIT_SIZE); return slowCompare(correctHash, testHash); } private  PasswordUtil(); }
PasswordUtil { public static boolean validatePassword(char[] password, byte[] salt, byte[] correctHash) { byte[] testHash = getPBKDF2Hash(password, salt, HASH_BIT_SIZE); return slowCompare(correctHash, testHash); } private  PasswordUtil(); static byte[] generateRandomSalt(); static byte[] generateFixedSalt(byte[] input); static byte[] generateHash(char[] password, byte[] salt); static SecretKey generateAESKeyFromPassword(String password, String pin, AES_KEYLENGTH keyLength); static boolean validatePassword(char[] password, byte[] salt, byte[] correctHash); }
PasswordUtil { public static boolean validatePassword(char[] password, byte[] salt, byte[] correctHash) { byte[] testHash = getPBKDF2Hash(password, salt, HASH_BIT_SIZE); return slowCompare(correctHash, testHash); } private  PasswordUtil(); static byte[] generateRandomSalt(); static byte[] generateFixedSalt(byte[] input); static byte[] generateHash(char[] password, byte[] salt); static SecretKey generateAESKeyFromPassword(String password, String pin, AES_KEYLENGTH keyLength); static boolean validatePassword(char[] password, byte[] salt, byte[] correctHash); static final int HASH_BIT_SIZE; static final int SALT_BIT_SIZE; }