Class DefaultPasswordHashingService

java.lang.Object

com.svenruppert.jsentinel.credential.password.DefaultPasswordHashingService

All Implemented Interfaces:

PasswordHashingService

public final class DefaultPasswordHashingService
extends Object
implements PasswordHashingService

Reference PasswordHashingService.

Each verify(...) call walks the pipeline in this strict order:

1. acquire limiter permit — one KdfExecutionLimiter permit covers the whole call, including any dummy KDF taken on failure;
2. parse — decode the envelope through PasswordHashCodec;
3. validate — gate the envelope through PasswordHashValidator (rejects out-of-bound parameters cheaply, CWE-400);
4. resolveProvider — look up the provider that produced the envelope (CWE-693);
5. resolvePepper — ask the PepperService for the stored pepper key; Phase 1a's NoOpPepperService never resolves a key, so any peppered envelope correctly fails verification rather than getting silently downgraded;
6. verify — delegate the constant-time comparison to the provider;
7. rehashDecision — on success, compute whether the envelope should be transparently upgraded.

Every failure path executes a comparable DummyVerificationService call before returning so that "user does not exist", "envelope is malformed" and "provider is missing" collapse onto the same observable timing profile (CWE-203, CWE-208). Every public failure collapses onto PublicFailureType.INVALID_CREDENTIALS; the differentiated InternalAuditEventType is preserved for audit sinks.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final class	DefaultPasswordHashingService.KdfLimitExceededException	Thrown by hash(char[]) when the limiter is saturated.

Constructor Summary

Constructors

Constructor	Description
DefaultPasswordHashingService(PasswordHashCodec codec, PasswordHashValidator validator, PasswordHashProviderRegistry providerRegistry, PepperService pepperService, PasswordHashPolicy policy, RehashDecisionEngine rehashEngine, KdfExecutionLimiter limiter, DummyVerificationService dummyService)

Method Summary

Modifier and Type	Method	Description
PasswordHashResult	hash(char[] password)	Produces a fresh hash for the given password under the active policy.
RehashDecision	needsRehash(String encodedHash)	Reports whether the supplied envelope should be rehashed under the active policy.
CredentialVerificationResult	verify(char[] password, String encodedHash)	Runs the verification pipeline on the supplied envelope.
CredentialVerificationResult	verifyAgainstNothing(char[] password)	Convenience entry point for callers that already know there is no stored envelope to verify against (typically "unknown user" paths).

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface PasswordHashingService

hash, verify, verifyAgainstNothing

Modifier and Type	Method	Description
default PasswordHashResult	hash(SecretValue password)	SecretValue overload for PasswordHashingService.hash(char[]).
default CredentialVerificationResult	verify(SecretValue password, String encodedHash)	SecretValue overload for PasswordHashingService.verify(char[], String).
default CredentialVerificationResult	verifyAgainstNothing(SecretValue password)	SecretValue overload for PasswordHashingService.verifyAgainstNothing(char[]).

Constructor Details

DefaultPasswordHashingService

public DefaultPasswordHashingService(PasswordHashCodec codec,
 PasswordHashValidator validator,
 PasswordHashProviderRegistry providerRegistry,
 PepperService pepperService,
 PasswordHashPolicy policy,
 RehashDecisionEngine rehashEngine,
 KdfExecutionLimiter limiter,
 DummyVerificationService dummyService)

Method Details

hash

public PasswordHashResult hash(char[] password)

Description copied from interface: PasswordHashingService

Produces a fresh hash for the given password under the active policy.

Specified by:

hash in interface PasswordHashingService

Parameters:

password - caller-owned character buffer; the implementation must not modify or zero it

verify

public CredentialVerificationResult verify(char[] password,
 String encodedHash)

Description copied from interface: PasswordHashingService

Runs the verification pipeline on the supplied envelope.

Specified by:

verify in interface PasswordHashingService

verifyAgainstNothing

public CredentialVerificationResult verifyAgainstNothing(char[] password)

Description copied from interface: PasswordHashingService

Convenience entry point for callers that already know there is no stored envelope to verify against (typically "unknown user" paths). The implementation still performs a comparable KDF call so the response is not distinguishable from a real verification (CWE-203, CWE-208).

Specified by:

verifyAgainstNothing in interface PasswordHashingService

needsRehash

public RehashDecision needsRehash(String encodedHash)

Description copied from interface: PasswordHashingService

Reports whether the supplied envelope should be rehashed under the active policy.

Specified by:

needsRehash in interface PasswordHashingService