public class BCrypt extends Object
String pw_hash = BCrypt.hashpw(plain_password, BCrypt.gensalt());
To check whether a plaintext password matches one that has been
hashed previously, use the checkpw method:
if (BCrypt.checkpw(candidate_password, stored_hash))
System.out.println("It matches");
else
System.out.println("It does not match");
The gensalt() method takes an optional parameter (log_rounds)
that determines the computational complexity of the hashing:
String strong_salt = BCrypt.gensalt(10)
String stronger_salt = BCrypt.gensalt(12)
The amount of work increases exponentially (2**log_rounds), so
each increment is twice as much work. The default log_rounds is
10, and the valid range is 4 to 30.| Modifier and Type | Field and Description |
|---|---|
private static char[] |
base64_code |
private static int |
BCRYPT_SALT_LEN |
private static int[] |
bf_crypt_ciphertext |
private static int |
BLOWFISH_NUM_ROUNDS |
private static int |
GENSALT_DEFAULT_LOG2_ROUNDS |
private static byte[] |
index_64 |
private int[] |
P |
private static int[] |
P_orig |
private int[] |
S |
private static int[] |
S_orig |
| Constructor and Description |
|---|
BCrypt() |
| Modifier and Type | Method and Description |
|---|---|
private static byte |
char64(char x)
Look up the 3 bits base64-encoded by the specified character,
range-checking againt conversion table
|
static boolean |
checkpw(String plaintext,
String hashed)
Check that a plaintext password matches a previously hashed
one
|
byte[] |
crypt_raw(byte[] password,
byte[] salt,
int log_rounds,
int[] cdata)
Perform the central password hashing step in the
bcrypt scheme
|
private static byte[] |
decode_base64(String s,
int maxolen)
Decode a string encoded using bcrypt's base64 scheme to a
byte array.
|
private void |
ekskey(byte[] data,
byte[] key)
Perform the "enhanced key schedule" step described by
Provos and Mazieres in "A Future-Adaptable Password Scheme"
http://www.openbsd.org/papers/bcrypt-paper.ps
|
private void |
encipher(int[] lr,
int off)
Blowfish encipher a single 64-bit block encoded as
two 32-bit halves
|
private static String |
encode_base64(byte[] d,
int len)
Encode a byte array using bcrypt's slightly-modified base64
encoding scheme.
|
static String |
gensalt()
Generate a salt for use with the BCrypt.hashpw() method,
selecting a reasonable default for the number of hashing
rounds to apply
|
static String |
gensalt(int log_rounds)
Generate a salt for use with the BCrypt.hashpw() method
|
static String |
gensalt(int log_rounds,
SecureRandom random)
Generate a salt for use with the BCrypt.hashpw() method
|
static String |
hashpw(String password,
String salt)
Hash a password using the OpenBSD bcrypt scheme
|
private void |
init_key()
Initialise the Blowfish key schedule
|
private void |
key(byte[] key)
Key the Blowfish cipher
|
private static int |
streamtoword(byte[] data,
int[] offp)
Cycically extract a word of key material
|
private static final int GENSALT_DEFAULT_LOG2_ROUNDS
private static final int BCRYPT_SALT_LEN
private static final int BLOWFISH_NUM_ROUNDS
private static final int[] P_orig
private static final int[] S_orig
private static final int[] bf_crypt_ciphertext
private static final char[] base64_code
private static final byte[] index_64
private int[] P
private int[] S
private static String encode_base64(byte[] d, int len) throws IllegalArgumentException
d - the byte array to encodelen - the number of bytes to encodeIllegalArgumentException - if the length is invalidprivate static byte char64(char x)
x - the base64-encoded valueprivate static byte[] decode_base64(String s, int maxolen) throws IllegalArgumentException
s - the string to decodemaxolen - the maximum number of bytes to decodeIllegalArgumentException - if maxolen is invalidprivate final void encipher(int[] lr,
int off)
lr - an array containing the two 32-bit half blocksoff - the position in the array of the blocksprivate static int streamtoword(byte[] data,
int[] offp)
data - the string to extract the data fromoffp - a "pointer" (as a one-entry array) to the
current offset into dataprivate void init_key()
private void key(byte[] key)
key - an array containing the keyprivate void ekskey(byte[] data,
byte[] key)
data - salt informationkey - password informationpublic byte[] crypt_raw(byte[] password,
byte[] salt,
int log_rounds,
int[] cdata)
password - the password to hashsalt - the binary salt to hash with the passwordlog_rounds - the binary logarithm of the number
of rounds of hashing to applycdata - the plaintext to encryptpublic static String hashpw(String password, String salt)
password - the password to hashsalt - the salt to hash with (perhaps generated
using BCrypt.gensalt)public static String gensalt(int log_rounds, SecureRandom random)
log_rounds - the log2 of the number of rounds of
hashing to apply - the work factor therefore increases as
2**log_rounds.random - an instance of SecureRandom to usepublic static String gensalt(int log_rounds)
log_rounds - the log2 of the number of rounds of
hashing to apply - the work factor therefore increases as
2**log_rounds.public static String gensalt()
Copyright © 2018 Apache NiFi Project. All rights reserved.