Question of the Week presents answers to key questions posed by the developer community. The intent is to pass this important, but not always easy-to-find information on to JDC members. The questions are selected from the JDC newsgroups generally because: they are frequently asked, they are significant or timely, or their answers are not easily accessible.

Note: If you have a question to which you need an answer, try the JDC newsgroups. You can read through the existing newsgroups, or with your free JDC membership, you can post new messages or threads.

Question of the Week Archive

Topic: Encrypted Passwords

Question: How can I store an encrypted password?

I am looking for a way to encrypt passwords so that I can store them in a database, something like the UNIX password encryption scheme. I understand that there are one-way hash algorithms to encrypt passwords, but I don't have the foggiest idea of where to look for more information, or how to even start!

Answer:

The JDK^TM 1.1 and later releases include a secure hash method based on the National Institute of Standards and Technology's (NIST) Secure Hash Standard. A secure hash is a function that works in only one direction. It is like a trap door--you can easily fall in, but you can't climb back out.

The documentation for SHA is available in the java.security.MessageDigest class.

Here is an example that compares two strings that are supplied on the command line:

import java.io.*;
import java.security.*;
        
public class PasswordTest {

   public static void main(String args[]) {
        
    if (args.length != 2) {
        System.err.println("usage: 
             PasswordTest password testvalue");
        System.exit(1);
    }

    byte[] buf= new byte[args[0].length()];
    args[0].getBytes(0, args[0].length(), buf, 0);

    MessageDigest algorithm=null;
    try {
        algorithm = MessageDigest.getInstance("SHA-1");
    }catch (NoSuchAlgorithmException e) {
        System.out.println(e);
    }
    algorithm.reset();
    algorithm.update(buf);
    byte[] digest1 = algorithm.digest();

    algorithm.reset();
    buf= new byte[args[1].length()];
    args[1].getBytes(0, args[1].length(), buf, 0);
    algorithm.update(buf);
    byte[] digest2 = algorithm.digest();

    if(digest1.length != digest2.length) {
	System.out.println("They do not match!");
	System.exit(0);
    }

    for(int i=0; i<digest1.length ;i++) {
	if(digest1[i] != digest2[i]) {
	    System.out.println("They do not match!");
	    System.exit(0);
	}	
    }
    System.out.println("They match!");
    }
}

Many thanks to JDC member grkuntzmd for contributing to this answer.

THE INFORMATION PROVIDED IN THE JAVA DEVELOPER'S CONNECTION IS PROVIDED 'AS IS' WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR, AND NON-INFRINGEMENT.

THIS INFORMATION IS PROVIDED AT NO CHARGE. BY USE OF THE INFORMATION YOU AGREE THAT NEITHER SUN MICROSYSTEMS, INC. NOR ITS LICENSORS WILL BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SUN OR ITS LICENSORS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.

THIS INFORMATION COULD INCLUDE TECHNICAL INACCURACIES OR TYPOGRAPHICAL ERRORS. CHANGES ARE PERIODICALLY ADDED TO THE INFORMATION HEREIN. SUN MICROSYSTEMS, INC. MAY MAKE IMPROVEMENTS AND OTHER CHANGES IN THE PRODUCTS AND THE PROGRAMS DESCRIBED HEREIN AT ANY TIME WITHOUT NOTICE.