Module com.aoapps.security

Package com.aoapps.security

Class HashedPassword

java.lang.Object

com.aoapps.security.HashedPassword

All Implemented Interfaces:

Serializable

public final class HashedPassword
extends Object
implements Serializable

A salted, hashed and key stretched password. https://crackstation.net/hashing-security.htm

Author:

AO Industries, Inc.

See Also:

• Serialized Form

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static enum	HashedPassword.Algorithm

Field Summary

Fields

Modifier and Type	Field	Description
static final int	HASH_BYTES	Deprecated. This is the value matching the previous default algorithm, please use HashedPassword.Algorithm.getHashBytes() instead.
static final HashedPassword	NO_PASSWORD	A singleton that must be used in places where no password is set.
static final String	NO_PASSWORD_VALUE	Indicates that no password is set.
static final HashedPassword.Algorithm	RECOMMENDED_ALGORITHM	The algorithm recommended for use with new passwords.
static final int	RECOMMENDED_ITERATIONS	Deprecated. This is the value matching the previous default algorithm, please use HashedPassword.Algorithm.getRecommendedIterations() instead.
static final int	SALT_BYTES	Deprecated. This is the value matching the previous default algorithm, please use HashedPassword.Algorithm.getSaltBytes() instead.

Constructor Summary

Constructors

Constructor	Description
HashedPassword(byte[] salt, int iterations, byte[] hash)	Deprecated. This represents a hash using the previous default algorithm, please use HashedPassword(com.aoapps.security.Password), HashedPassword(com.aoapps.security.Password, com.aoapps.security.HashedPassword.Algorithm), or HashedPassword(com.aoapps.security.Password, com.aoapps.security.HashedPassword.Algorithm, int) instead.
HashedPassword(HashedPassword.Algorithm algorithm, byte[] salt, int iterations, byte[] hash)	Deprecated. Please use valueOf(com.aoapps.security.HashedPassword.Algorithm, byte[], int, byte[]), which is able to automatically return the NO_PASSWORD singleton.
HashedPassword(Password password)	Creates a new hashed password using the recommended algorithm, a random salt, and the recommended iterations using a default SecureRandom instance, which is not a strong instance to avoid blocking.
HashedPassword(Password password, HashedPassword.Algorithm algorithm)	Creates a new hashed password using the given algorithm, a random salt, and the recommended iterations using a default SecureRandom instance, which is not a strong instance to avoid blocking.
HashedPassword(Password password, HashedPassword.Algorithm algorithm, byte[] salt, int iterations)	Creates a new hashed password using the given algorithm, salt, and iterations.
HashedPassword(Password password, HashedPassword.Algorithm algorithm, int iterations)	Creates a new hashed password using the given algorithm, a random salt, and the given iterations using a default SecureRandom instance, which is not a strong instance to avoid blocking.
HashedPassword(Password password, HashedPassword.Algorithm algorithm, int iterations, SecureRandom secureRandom)	Creates a new hashed password using the given algorithm, a random salt, and the given iterations using the provided SecureRandom source.
HashedPassword(Password password, HashedPassword.Algorithm algorithm, int iterations, Random random)	Deprecated. Please use SecureRandom.
HashedPassword(Password password, HashedPassword.Algorithm algorithm, SecureRandom secureRandom)	Creates a new hashed password using the given algorithm, a random salt, and the recommended iterations using the provided SecureRandom source.
HashedPassword(Password password, HashedPassword.Algorithm algorithm, Random random)	Deprecated. Please use SecureRandom.
HashedPassword(Password password, SecureRandom secureRandom)	Creates a new hashed password using the recommended algorithm, a random salt, and the recommended iterations using the provided SecureRandom source.
HashedPassword(Password password, Random random)	Deprecated. Please use SecureRandom.
HashedPassword(String password)	Deprecated. Please use HashedPassword(com.aoapps.security.Password) so the password may be destroyed.
HashedPassword(String password, HashedPassword.Algorithm algorithm)	Deprecated. Please use HashedPassword(com.aoapps.security.Password, com.aoapps.security.HashedPassword.Algorithm) so the password may be destroyed.
HashedPassword(String password, HashedPassword.Algorithm algorithm, byte[] salt, int iterations)	Deprecated. Please use HashedPassword(com.aoapps.security.Password, com.aoapps.security.HashedPassword.Algorithm, byte[], int) so the password may be destroyed.
HashedPassword(String password, HashedPassword.Algorithm algorithm, int iterations)	Deprecated. Please use HashedPassword(com.aoapps.security.Password, com.aoapps.security.HashedPassword.Algorithm, int) so the password may be destroyed.
HashedPassword(String password, HashedPassword.Algorithm algorithm, int iterations, SecureRandom secureRandom)	Deprecated. Please use HashedPassword(com.aoapps.security.Password, com.aoapps.security.HashedPassword.Algorithm, int, java.security.SecureRandom) so the password may be destroyed.
HashedPassword(String password, HashedPassword.Algorithm algorithm, int iterations, Random random)	Deprecated. Please use HashedPassword(com.aoapps.security.Password, com.aoapps.security.HashedPassword.Algorithm, int, java.util.Random) so the password may be destroyed.
HashedPassword(String password, HashedPassword.Algorithm algorithm, SecureRandom secureRandom)	Deprecated. Please use HashedPassword(com.aoapps.security.Password, com.aoapps.security.HashedPassword.Algorithm, java.security.SecureRandom) so the password may be destroyed.
HashedPassword(String password, HashedPassword.Algorithm algorithm, Random random)	Deprecated. Please use HashedPassword(com.aoapps.security.Password, com.aoapps.security.HashedPassword.Algorithm, java.util.Random) so the password may be destroyed.
HashedPassword(String password, SecureRandom secureRandom)	Deprecated. Please use HashedPassword(com.aoapps.security.Password, java.security.SecureRandom) so the password may be destroyed.
HashedPassword(String password, Random random)	Deprecated. Please use HashedPassword(com.aoapps.security.Password, java.util.Random) so the password may be destroyed.
HashedPassword(PBEKey pbeKey)	Creates a new hashed password using the given algorithm, salt, and iterations.

Method Summary

Modifier and Type	Method	Description
boolean	equals(Object obj)	Checks if equal to another hashed password, always false when either is NO_PASSWORD.
static byte[]	generateSalt()	Deprecated. This generates a salt for the previous default algorithm, please use HashedPassword.Algorithm.generateSalt(), HashedPassword(com.aoapps.security.Password), HashedPassword(com.aoapps.security.Password, com.aoapps.security.HashedPassword.Algorithm), HashedPassword(com.aoapps.security.Password, com.aoapps.security.HashedPassword.Algorithm, int) instead.
HashedPassword.Algorithm	getAlgorithm()
byte[]	getHash()
int	getIterations()
byte[]	getSalt()
static byte[]	hash(String password, byte[] salt, int iterations)	Deprecated. This generates a hash for the previous default algorithm and does not allow the password to be destroyed, please use HashedPassword.Algorithm.hash(com.aoapps.security.Password, byte[], int), HashedPassword(com.aoapps.security.Password), HashedPassword(com.aoapps.security.Password, com.aoapps.security.HashedPassword.Algorithm), HashedPassword(com.aoapps.security.Password, com.aoapps.security.HashedPassword.Algorithm, int) instead.
int	hashCode()	The hash code is taken from the last 32 bits of the hash.
boolean	isRehashRecommended()	It is recommended to rehash the password during login when the recommended settings are stronger than the settings used in the previous hashing.
static void	main(String... args)
boolean	matches(Password password)	Checks if this matches the provided password, always false when is NO_PASSWORD.
boolean	matches(String password)	Deprecated. Please use matches(com.aoapps.security.Password) so the password may be destroyed.
String	toString()	Gets the string representation of the hashed password.
static HashedPassword	valueOf(HashedPassword.Algorithm algorithm, byte[] salt, int iterations, byte[] hash)	Restores a HashedPassword from its individual fields.
static HashedPassword	valueOf(String hashedPassword)	Parses the result of toString().

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, wait, wait, wait

Field Details

NO_PASSWORD_VALUE

public static final String NO_PASSWORD_VALUE

Indicates that no password is set.

This matches a value often used in /etc/shadow when the user has no password set (although ! is also commonly used for this purpose).

This is also used as the value used for filtered data in the AOServ Protocol.

See Also:

• Constant Field Values

RECOMMENDED_ALGORITHM

public static final HashedPassword.Algorithm RECOMMENDED_ALGORITHM

The algorithm recommended for use with new passwords. This may change at any time, but previous algorithms will remain supported.

It is recommended to re-hash a password during login when the recommended algorithm has changed.

SALT_BYTES

@Deprecated
public static final int SALT_BYTES

Deprecated.

This is the value matching the previous default algorithm, please use HashedPassword.Algorithm.getSaltBytes() instead.

The number of bytes in the random salt.

See Also:

• Constant Field Values

HASH_BYTES

@Deprecated
public static final int HASH_BYTES

Deprecated.

This is the value matching the previous default algorithm, please use HashedPassword.Algorithm.getHashBytes() instead.

The number of bytes in the hash.

See Also:

• Constant Field Values

RECOMMENDED_ITERATIONS

@Deprecated
public static final int RECOMMENDED_ITERATIONS

Deprecated.

This is the value matching the previous default algorithm, please use HashedPassword.Algorithm.getRecommendedIterations() instead.

NO_PASSWORD

public static final HashedPassword NO_PASSWORD

A singleton that must be used in places where no password is set.

Constructor Details

HashedPassword

@Deprecated
public HashedPassword(HashedPassword.Algorithm algorithm,
 byte[] salt,
 int iterations,
 byte[] hash)
               throws IllegalArgumentException

Deprecated.

Please use valueOf(com.aoapps.security.HashedPassword.Algorithm, byte[], int, byte[]), which is able to automatically return the NO_PASSWORD singleton.

Parameters:

algorithm - The algorithm previously used to hash the password

iterations - The number of has iterations

Throws:

IllegalArgumentException - when salt.length != algorithm.getSaltBytes() or hash.length != algorithm.getHashBytes() or iterations < algorithm.getMinimumIterations() or iterations > algorithm.getMaximumIterations()

HashedPassword

@Deprecated
public HashedPassword(byte[] salt,
 int iterations,
 byte[] hash)
               throws IllegalArgumentException

Deprecated.

This represents a hash using the previous default algorithm, please use HashedPassword(com.aoapps.security.Password), HashedPassword(com.aoapps.security.Password, com.aoapps.security.HashedPassword.Algorithm), or HashedPassword(com.aoapps.security.Password, com.aoapps.security.HashedPassword.Algorithm, int) instead.

Parameters:

iterations - The number of has iterations

Throws:

IllegalArgumentException - when salt.length != SALT_BYTES or hash.length != HASH_BYTES or iterations < algorithm.getMinimumIterations() or iterations > algorithm.getMaximumIterations()

HashedPassword

public HashedPassword(Password password,
 HashedPassword.Algorithm algorithm,
 byte[] salt,
 int iterations)
               throws IllegalArgumentException

Creates a new hashed password using the given algorithm, salt, and iterations.

Parameters:

password - Is destroyed before this method returns. If the original password is needed, pass a clone to this method.

algorithm - The algorithm previously used to hash the password

iterations - The number of has iterations

Throws:

IllegalArgumentException - when password == null || password.isDestroyed() on salt.length != algorithm.getSaltBytes() or iterations < algorithm.getMinimumIterations() or iterations > algorithm.getMaximumIterations()

HashedPassword

@Deprecated
public HashedPassword(String password,
 HashedPassword.Algorithm algorithm,
 byte[] salt,
 int iterations)
               throws IllegalArgumentException

Deprecated.

Please use HashedPassword(com.aoapps.security.Password, com.aoapps.security.HashedPassword.Algorithm, byte[], int) so the password may be destroyed.

Creates a new hashed password using the given algorithm, salt, and iterations.

Parameters:

algorithm - The algorithm previously used to hash the password

iterations - The number of has iterations

Throws:

IllegalArgumentException - when password == null || password.isEmpty() or password only contains (char)0 (conflicts with destroyed passwords) on salt.length != algorithm.getSaltBytes() or iterations < algorithm.getMinimumIterations() or iterations > algorithm.getMaximumIterations()

HashedPassword

public HashedPassword(PBEKey pbeKey)
               throws IllegalArgumentException

Creates a new hashed password using the given algorithm, salt, and iterations.

Parameters:

pbeKey - Is not destroyed, the caller should destroy the PBEKey if not longer required.

Throws:

IllegalArgumentException - when password == null || password.isDestroyed() on salt.length != algorithm.getSaltBytes() or iterations < algorithm.getMinimumIterations() or iterations > algorithm.getMaximumIterations()

HashedPassword

@Deprecated
public HashedPassword(Password password,
 HashedPassword.Algorithm algorithm,
 int iterations,
 Random random)
               throws IllegalArgumentException

Deprecated.

Please use SecureRandom. This method will stay, but will remain deprecated since it should only be used after careful consideration.

Creates a new hashed password using the given algorithm, a random salt, and the given iterations using the provided Random source.

Parameters:

password - Is destroyed before this method returns. If the original password is needed, pass a clone to this method.

algorithm - The algorithm previously used to hash the password

iterations - The number of has iterations

Throws:

IllegalArgumentException - when password == null || password.isDestroyed() or iterations < algorithm.getMinimumIterations() or iterations > algorithm.getMaximumIterations()

HashedPassword

public HashedPassword(Password password,
 HashedPassword.Algorithm algorithm,
 int iterations,
 SecureRandom secureRandom)
               throws IllegalArgumentException

Creates a new hashed password using the given algorithm, a random salt, and the given iterations using the provided SecureRandom source.

Parameters:

password - Is destroyed before this method returns. If the original password is needed, pass a clone to this method.

algorithm - The algorithm previously used to hash the password

iterations - The number of has iterations

Throws:

IllegalArgumentException - when password == null || password.isDestroyed() or iterations < algorithm.getMinimumIterations() or iterations > algorithm.getMaximumIterations()

HashedPassword

@Deprecated
public HashedPassword(String password,
 HashedPassword.Algorithm algorithm,
 int iterations,
 Random random)
               throws IllegalArgumentException

Deprecated.

Please use HashedPassword(com.aoapps.security.Password, com.aoapps.security.HashedPassword.Algorithm, int, java.util.Random) so the password may be destroyed.

Please use SecureRandom. This method should only be used after careful consideration.

Creates a new hashed password using the given algorithm, a random salt, and the given iterations using the provided Random source.

Parameters:

algorithm - The algorithm previously used to hash the password

iterations - The number of has iterations

Throws:

IllegalArgumentException - when password == null || password.isEmpty() or password only contains (char)0 (conflicts with destroyed passwords) or iterations < algorithm.getMinimumIterations() or iterations > algorithm.getMaximumIterations()

HashedPassword

@Deprecated
public HashedPassword(String password,
 HashedPassword.Algorithm algorithm,
 int iterations,
 SecureRandom secureRandom)
               throws IllegalArgumentException

Deprecated.

Please use HashedPassword(com.aoapps.security.Password, com.aoapps.security.HashedPassword.Algorithm, int, java.security.SecureRandom) so the password may be destroyed.

Creates a new hashed password using the given algorithm, a random salt, and the given iterations using the provided SecureRandom source.

Parameters:

algorithm - The algorithm previously used to hash the password

iterations - The number of has iterations

Throws:

IllegalArgumentException - when password == null || password.isEmpty() or password only contains (char)0 (conflicts with destroyed passwords) or iterations < algorithm.getMinimumIterations() or iterations > algorithm.getMaximumIterations()

HashedPassword

public HashedPassword(Password password,
 HashedPassword.Algorithm algorithm,
 int iterations)
               throws IllegalArgumentException

Creates a new hashed password using the given algorithm, a random salt, and the given iterations using a default SecureRandom instance, which is not a strong instance to avoid blocking.

Parameters:

password - Is destroyed before this method returns. If the original password is needed, pass a clone to this method.

algorithm - The algorithm previously used to hash the password

iterations - The number of has iterations

Throws:

IllegalArgumentException - when password == null || password.isDestroyed() or iterations < algorithm.getMinimumIterations() or iterations > algorithm.getMaximumIterations()

HashedPassword

@Deprecated
public HashedPassword(String password,
 HashedPassword.Algorithm algorithm,
 int iterations)
               throws IllegalArgumentException

Deprecated.

Please use HashedPassword(com.aoapps.security.Password, com.aoapps.security.HashedPassword.Algorithm, int) so the password may be destroyed.

Creates a new hashed password using the given algorithm, a random salt, and the given iterations using a default SecureRandom instance, which is not a strong instance to avoid blocking.

Parameters:

algorithm - The algorithm previously used to hash the password

iterations - The number of has iterations

Throws:

IllegalArgumentException - when password == null || password.isEmpty() or password only contains (char)0 (conflicts with destroyed passwords) or iterations < algorithm.getMinimumIterations() or iterations > algorithm.getMaximumIterations()

HashedPassword

@Deprecated
public HashedPassword(Password password,
 HashedPassword.Algorithm algorithm,
 Random random)
               throws IllegalArgumentException

Deprecated.

Please use SecureRandom. This method will stay, but will remain deprecated since it should only be used after careful consideration.

Creates a new hashed password using the given algorithm, a random salt, and the recommended iterations using the provided Random source.

Parameters:

password - Is destroyed before this method returns. If the original password is needed, pass a clone to this method.

Throws:

IllegalArgumentException - when password == null || password.isDestroyed()

HashedPassword

public HashedPassword(Password password,
 HashedPassword.Algorithm algorithm,
 SecureRandom secureRandom)
               throws IllegalArgumentException

Creates a new hashed password using the given algorithm, a random salt, and the recommended iterations using the provided SecureRandom source.

Parameters:

password - Is destroyed before this method returns. If the original password is needed, pass a clone to this method.

Throws:

IllegalArgumentException - when password == null || password.isDestroyed()

HashedPassword

@Deprecated
public HashedPassword(String password,
 HashedPassword.Algorithm algorithm,
 Random random)
               throws IllegalArgumentException

Deprecated.

Please use HashedPassword(com.aoapps.security.Password, com.aoapps.security.HashedPassword.Algorithm, java.util.Random) so the password may be destroyed.

Please use SecureRandom. This method should only be used after careful consideration.

Creates a new hashed password using the given algorithm, a random salt, and the recommended iterations using the provided Random source.

Throws:

IllegalArgumentException - when password == null || password.isEmpty() or password only contains (char)0 (conflicts with destroyed passwords)

HashedPassword

@Deprecated
public HashedPassword(String password,
 HashedPassword.Algorithm algorithm,
 SecureRandom secureRandom)
               throws IllegalArgumentException

Deprecated.

Please use HashedPassword(com.aoapps.security.Password, com.aoapps.security.HashedPassword.Algorithm, java.security.SecureRandom) so the password may be destroyed.

Creates a new hashed password using the given algorithm, a random salt, and the recommended iterations using the provided SecureRandom source.

Throws:

IllegalArgumentException - when password == null || password.isEmpty() or password only contains (char)0 (conflicts with destroyed passwords)

HashedPassword

public HashedPassword(Password password,
 HashedPassword.Algorithm algorithm)
               throws IllegalArgumentException

Creates a new hashed password using the given algorithm, a random salt, and the recommended iterations using a default SecureRandom instance, which is not a strong instance to avoid blocking.

Parameters:

password - Is destroyed before this method returns. If the original password is needed, pass a clone to this method.

Throws:

IllegalArgumentException - when password == null || password.isDestroyed()

HashedPassword

@Deprecated
public HashedPassword(String password,
 HashedPassword.Algorithm algorithm)
               throws IllegalArgumentException

Deprecated.

Please use HashedPassword(com.aoapps.security.Password, com.aoapps.security.HashedPassword.Algorithm) so the password may be destroyed.

Creates a new hashed password using the given algorithm, a random salt, and the recommended iterations using a default SecureRandom instance, which is not a strong instance to avoid blocking.

Throws:

IllegalArgumentException - when password == null || password.isEmpty() or password only contains (char)0 (conflicts with destroyed passwords)

HashedPassword

@Deprecated
public HashedPassword(Password password,
 Random random)
               throws IllegalArgumentException

Deprecated.

Please use SecureRandom. This method will stay, but will remain deprecated since it should only be used after careful consideration.

Creates a new hashed password using the recommended algorithm, a random salt, and the recommended iterations using the provided Random source.

Parameters:

password - Is destroyed before this method returns. If the original password is needed, pass a clone to this method.

Throws:

IllegalArgumentException - when password == null || password.isDestroyed()

HashedPassword

public HashedPassword(Password password,
 SecureRandom secureRandom)
               throws IllegalArgumentException

Creates a new hashed password using the recommended algorithm, a random salt, and the recommended iterations using the provided SecureRandom source.

Parameters:

password - Is destroyed before this method returns. If the original password is needed, pass a clone to this method.

Throws:

IllegalArgumentException - when password == null || password.isDestroyed()

HashedPassword

@Deprecated
public HashedPassword(String password,
 Random random)
               throws IllegalArgumentException

Deprecated.

Please use HashedPassword(com.aoapps.security.Password, java.util.Random) so the password may be destroyed.

Please use SecureRandom. This method should only be used after careful consideration.

Creates a new hashed password using the recommended algorithm, a random salt, and the recommended iterations using the provided Random source.

Throws:

IllegalArgumentException - when password == null || password.isEmpty() or password only contains (char)0 (conflicts with destroyed passwords)

HashedPassword

@Deprecated
public HashedPassword(String password,
 SecureRandom secureRandom)
               throws IllegalArgumentException

Deprecated.

Please use HashedPassword(com.aoapps.security.Password, java.security.SecureRandom) so the password may be destroyed.

Creates a new hashed password using the recommended algorithm, a random salt, and the recommended iterations using the provided SecureRandom source.

Throws:

IllegalArgumentException - when password == null || password.isEmpty() or password only contains (char)0 (conflicts with destroyed passwords)

HashedPassword

public HashedPassword(Password password)
               throws IllegalArgumentException

Creates a new hashed password using the recommended algorithm, a random salt, and the recommended iterations using a default SecureRandom instance, which is not a strong instance to avoid blocking.

Parameters:

password - Is destroyed before this method returns. If the original password is needed, pass a clone to this method.

Throws:

IllegalArgumentException - when password == null || password.isDestroyed()

HashedPassword

@Deprecated
public HashedPassword(String password)
               throws IllegalArgumentException

Deprecated.

Please use HashedPassword(com.aoapps.security.Password) so the password may be destroyed.

Creates a new hashed password using the recommended algorithm, a random salt, and the recommended iterations using a default SecureRandom instance, which is not a strong instance to avoid blocking.

Throws:

IllegalArgumentException - when password == null || password.isEmpty() or password only contains (char)0 (conflicts with destroyed passwords)

Method Details

generateSalt

@Deprecated
public static byte[] generateSalt()

Deprecated.

This generates a salt for the previous default algorithm, please use HashedPassword.Algorithm.generateSalt(), HashedPassword(com.aoapps.security.Password), HashedPassword(com.aoapps.security.Password, com.aoapps.security.HashedPassword.Algorithm), HashedPassword(com.aoapps.security.Password, com.aoapps.security.HashedPassword.Algorithm, int) instead.

Generates a random salt of SALT_BYTES bytes in length using a default SecureRandom instance, which is not a strong instance to avoid blocking.

See Also:

• hash(java.lang.String, byte[], int)

hash

@Deprecated
public static byte[] hash(String password,
 byte[] salt,
 int iterations)

Deprecated.

This generates a hash for the previous default algorithm and does not allow the password to be destroyed, please use HashedPassword.Algorithm.hash(com.aoapps.security.Password, byte[], int), HashedPassword(com.aoapps.security.Password), HashedPassword(com.aoapps.security.Password, com.aoapps.security.HashedPassword.Algorithm), HashedPassword(com.aoapps.security.Password, com.aoapps.security.HashedPassword.Algorithm, int) instead.

Hash the given password.

See Also:

• generateSalt()
• RECOMMENDED_ITERATIONS

valueOf

public static HashedPassword valueOf(String hashedPassword)
                              throws IllegalArgumentException

Parses the result of toString().

Parameters:

hashedPassword - when null, returns null

Throws:

IllegalArgumentException

valueOf

public static HashedPassword valueOf(HashedPassword.Algorithm algorithm,
 byte[] salt,
 int iterations,
 byte[] hash)
                              throws IllegalArgumentException

Restores a HashedPassword from its individual fields. This is useful for reading the object from a database, for example.

Parameters:

algorithm - The algorithm previously used to hash the password

iterations - The number of has iterations

Throws:

IllegalArgumentException - when salt.length != algorithm.getSaltBytes() or hash.length != algorithm.getHashBytes() or iterations < algorithm.getMinimumIterations() or iterations > algorithm.getMaximumIterations()

toString

public String toString()

Gets the string representation of the hashed password. The format is subject to change over time, but will maintain backward compatibility.

Please see valueOf(java.lang.String) for the inverse operation.

Overrides:

toString in class Object

equals

public boolean equals(Object obj)

Checks if equal to another hashed password, always false when either is NO_PASSWORD.

Performs comparisons in length-constant time. https://crackstation.net/hashing-security.htm

Overrides:

equals in class Object

hashCode

public int hashCode()

The hash code is taken from the last 32 bits of the hash. The last 32 bits are selected because the first bits might include zero padding when the hash length is not a multiple of Byte.SIZE.

Overrides:

hashCode in class Object

getAlgorithm

public HashedPassword.Algorithm getAlgorithm()

getSalt

public byte[] getSalt()

Returns:

Defensive copy

getIterations

public int getIterations()

getHash

public byte[] getHash()

Returns:

Defensive copy

matches

public boolean matches(Password password)

Checks if this matches the provided password, always false when is NO_PASSWORD.

When verifying a user's password, please check isRehashRecommended() then either set the same password again or, ideally, generate a new password or prompt the user to reset their password. This will allow the stored passwords to keep up with encryption improvements.

Performs comparisons in length-constant time. https://crackstation.net/hashing-security.htm

Parameters:

password - Is destroyed before this method returns. If the original password is needed, pass a clone to this method.

See Also:

• isRehashRecommended()

matches

@Deprecated
public boolean matches(String password)

Deprecated.

Please use matches(com.aoapps.security.Password) so the password may be destroyed.

Checks if this matches the provided password, always false when is NO_PASSWORD.

When verifying a user's password, please check isRehashRecommended() then either set the same password again or, ideally, generate a new password or prompt the user to reset their password. This will allow the stored passwords to keep up with encryption improvements.

Performs comparisons in length-constant time. https://crackstation.net/hashing-security.htm

See Also:

• isRehashRecommended()

isRehashRecommended

public boolean isRehashRecommended()

It is recommended to rehash the password during login when the recommended settings are stronger than the settings used in the previous hashing.

main

public static void main(String... args)