Class Pbkdf2PasswordHasher

java.lang.Object
com.svenruppert.jsentinel.authentication.Pbkdf2PasswordHasher
All Implemented Interfaces:
PasswordHasher
public final class Pbkdf2PasswordHasher extends Object implements PasswordHasher
PBKDF2-HMAC-SHA256 hasher using only JDK APIs. Encoded format: pbkdf2$<iterations>$<base64-salt>$<base64-hash>.

  • Field Details

  • Constructor Details

    • Pbkdf2PasswordHasher

      public Pbkdf2PasswordHasher()

    • Pbkdf2PasswordHasher

      public Pbkdf2PasswordHasher(int iterations, SecureRandom random)

  • Method Details

    • hash

      public String hash(char[] rawPassword)
      Description copied from interface: PasswordHasher
      Hashes the password and returns the implementation's wire format.
      Specified by:
      hash in interface PasswordHasher

    • verify

      public boolean verify(char[] rawPassword, String storedHash)
      Description copied from interface: PasswordHasher
      Verifies a candidate password against a wire-format stored hash.
      Specified by:
      verify in interface PasswordHasher

    • parse

      public PasswordHash parse(String storedHash)
      Description copied from interface: PasswordHasher
      Parses a wire-format hash into a PasswordHash. Implementations that override the typed API must override this method too. Default throws — the default implementations of PasswordHasher.hashTo(char[]) and PasswordHasher.verify(char[], PasswordHash) call this, so a hasher that provides only the String pair must override either the default methods or this one to participate in the typed API.
      Specified by:
      parse in interface PasswordHasher
      Parameters:
      storedHash - wire-format hash
      Returns:
      parsed typed hash

    • serialize

      public String serialize(PasswordHash hash)
      Description copied from interface: PasswordHasher
      Inverse of PasswordHasher.parse(String). Default throws.
      Specified by:
      serialize in interface PasswordHasher
      Parameters:
      hash - typed hash
      Returns:
      wire-format string suitable for PasswordHasher.verify(char[], String)

    • needsRehash

      public boolean needsRehash(PasswordHash storedHash)
      Description copied from interface: PasswordHasher
      Reports whether storedHash was produced with parameters that differ from this hasher's current configuration. Callers that want to upgrade weak or outdated hashes should re-hash on the next successful login when this returns true.

      The default returns false (no drift detection). Concrete implementations like Pbkdf2PasswordHasher compare the hash's algorithm + iteration count against their own.

      Specified by:
      needsRehash in interface PasswordHasher
      Parameters:
      storedHash - previously stored hash; never null
      Returns:
      true when storedHash is a pbkdf2 hash whose iteration count differs from this hasher's current iterations, or when its algorithm is not pbkdf2 at all (in which case re-hashing migrates the user to the current scheme on the next successful login).