Question

我有一个使用JDBC Jquery和MYSQL的应用程序，它列出了带引号的表，用户可以添加引号。

我有一个登录页面，我检查用户名的输入，并将其与数据库中退出的内容进行比较。像这样，它工作正常

public Boolean findByUsername(String username) throws SQLException {

        ResultSet rs = null;
        Connection conn = null;
        PreparedStatement pstmt = null;

        try {

            conn = Database.getConnection();
            conn.setAutoCommit(false);
            String query = "SELECT * FROM user WHERE username = ?";
            pstmt = conn.prepareStatement(query);
            pstmt.setString(1, username);
            rs = pstmt.executeQuery();
            if (rs.next()) {
                return true;

            }
        } catch (Exception e) {
            e.printStackTrace();
            throw new RuntimeException(e);
        } finally {
            conn.close();
        }
        return false;
    }

但是当我想比较密码时，我遇到的问题是我用PBKDF2加密密码，它会生成一些像这样的随机字符 1000：485b5808b4786d6aa6e5360ad157945ee927d85e49e96312：60d76b0ef1b742cfa462d84eb7fd7c37eb361717179c0a45。当我想将密码输入与数据库中的某些东西进行比较时，我使用这种方法。

public Boolean findByPassword(String password) throws SQLException,
            NoSuchAlgorithmException, InvalidKeySpecException {

        ResultSet rs = null;
        Connection conn = null;
        PreparedStatement pstmt = null;
        PasswordHash p = new PasswordHash();
        String hash = p.createHash(password);
        try {

            conn = Database.getConnection();
            conn.setAutoCommit(false);
            String query = "SELECT * FROM user WHERE passwd = ?";
System.out.println("password: " +password);
System.out.println("hashpassword " +hash);
            pstmt = conn.prepareStatement(query);
            pstmt.setString(1, hash);
            rs = pstmt.executeQuery();
            if (rs.next()) {
                if(p.validatePassword(password, hash)){ 
                    return true;

                }


            }
        } catch (Exception e) {
            e.printStackTrace();
            throw new RuntimeException(e);
        } finally {
            conn.close();
        }
        return false;
    }

我使用此类来散列密码

public class PasswordHash {
    public final String PBKDF2_ALGORITHM = "PBKDF2WithHmacSHA1";

    // The following constants may be changed without breaking existing hashes.
    public final int SALT_BYTE_SIZE = 24;
    public final int HASH_BYTE_SIZE = 24;
    public final int PBKDF2_ITERATIONS = 1000;

    public final int ITERATION_INDEX = 0;
    public final int SALT_INDEX = 1;
    public final int PBKDF2_INDEX = 2;

    /**
     * Returns a salted PBKDF2 hash of the password.
     *
     * @param password
     *            the password to hash
     * @return a salted PBKDF2 hash of the password
     */
    public String createHash(String password) throws NoSuchAlgorithmException,
            InvalidKeySpecException {
        return createHash(password.toCharArray());
    }

    /**
     * Returns a salted PBKDF2 hash of the password.
     *
     * @param password
     *            the password to hash
     * @return a salted PBKDF2 hash of the password
     */
    public String createHash(char[] password) throws NoSuchAlgorithmException,
            InvalidKeySpecException {
        // Generate a random salt
        SecureRandom random = new SecureRandom();
        byte[] salt = new byte[SALT_BYTE_SIZE];
        random.nextBytes(salt);

        // Hash the password
        byte[] hash = pbkdf2(password, salt, PBKDF2_ITERATIONS, HASH_BYTE_SIZE);
        // format iterations:salt:hash
        return PBKDF2_ITERATIONS + ":" + toHex(salt) + ":" + toHex(hash);
    }

    /**
     * Validates a password using a hash.
     *
     * @param password
     *            the password to check
     * @param correctHash
     *            the hash of the valid password
     * @return true if the password is correct, false if not
     */
    public boolean validatePassword(String password, String correctHash)
            throws NoSuchAlgorithmException, InvalidKeySpecException {
        return validatePassword(password.toCharArray(), correctHash);
    }

    /**
     * Validates a password using a hash.
     *
     * @param password
     *            the password to check
     * @param correctHash
     *            the hash of the valid password
     * @return true if the password is correct, false if not
     */
    public boolean validatePassword(char[] password, String correctHash)
            throws NoSuchAlgorithmException, InvalidKeySpecException {
        // Decode the hash into its parameters
        String[] params = correctHash.split(":");
        int iterations = Integer.parseInt(params[ITERATION_INDEX]);
        byte[] salt = fromHex(params[SALT_INDEX]);
        byte[] hash = fromHex(params[PBKDF2_INDEX]);
        // Compute the hash of the provided password, using the same salt,
        // iteration count, and hash length
        byte[] testHash = pbkdf2(password, salt, iterations, hash.length);
        // Compare the hashes in constant time. The password is correct if
        // both hashes match.
        return slowEquals(hash, testHash);
    }

    /**
     * Compares two byte arrays in length-constant time. This comparison method
     * is used so that password hashes cannot be extracted from an on-line
     * system using a timing attack and then attacked off-line.
     * 
     * @param a
     *            the first byte array
     * @param b
     *            the second byte array
     * @return true if both byte arrays are the same, false if not
     */
    private boolean slowEquals(byte[] a, byte[] b) {
        int diff = a.length ^ b.length;
        for (int i = 0; i < a.length && i < b.length; i++)
            diff |= a[i] ^ b[i];
        return diff == 0;
    }

    /**
     * Computes the PBKDF2 hash of a password.
     *
     * @param password
     *            the password to hash.
     * @param salt
     *            the salt
     * @param iterations
     *            the iteration count (slowness factor)
     * @param bytes
     *            the length of the hash to compute in bytes
     * @return the PBDKF2 hash of the password
     */
    private byte[] pbkdf2(char[] password, byte[] salt, int iterations,
            int bytes) throws NoSuchAlgorithmException, InvalidKeySpecException {
        PBEKeySpec spec = new PBEKeySpec(password, salt, iterations, bytes * 8);
        SecretKeyFactory skf = SecretKeyFactory.getInstance(PBKDF2_ALGORITHM);
        return skf.generateSecret(spec).getEncoded();
    }

    /**
     * Converts a string of hexadecimal characters into a byte array.
     *
     * @param hex
     *            the hex string
     * @return the hex string decoded into a byte array
     */
    private byte[] fromHex(String hex) {
        byte[] binary = new byte[hex.length() / 2];
        for (int i = 0; i < binary.length; i++) {
            binary[i] = (byte) Integer.parseInt(
                    hex.substring(2 * i, 2 * i + 2), 16);
        }
        return binary;
    }

    /**
     * Converts a byte array into a hexadecimal string.
     *
     * @param array
     *            the byte array to convert
     * @return a length*2 character string encoding the byte array
     */
    private String toHex(byte[] array) {
        BigInteger bi = new BigInteger(1, array);
        String hex = bi.toString(16);
        int paddingLength = (array.length * 2) - hex.length();
        if (paddingLength > 0)
            return String.format("%0" + paddingLength + "d", 0) + hex;
        else
            return hex;
    }

    /**
     * Tests the basic functionality of the PasswordHash class
     *
     * @param args
     *            ignored
     */

}

我在这里打电话给

@POST
    @Path("/login")
    @Produces(MediaType.TEXT_PLAIN)
    public String LogInUser(String username, String password)
            throws NoSuchAlgorithmException, InvalidKeySpecException,
            SQLException {
        Gson gson = new Gson();
        User theuser = gson.fromJson(username, User.class);
        if (!u.findByUsername(theuser.getUsername())
                && u.findByPassword(theuser.getPasswd())) {
            return theuser.getUsername();
        }
        return null;

    }

如何将passwordinput与数据库中存在的内容进行比较？

Answer 1

您使用findByUsername在SELECT * FROM user WHERE username = ?方法中查询数据库。该查询的结果也应该返回密码哈希。因此，只需从此查询中获取密码哈希，然后调用validatePassword。

忘记了findByPassword方法。它不会起作用。除了它是完全错误的。（如果存储在数据库中的任何用户都提供了密码，它将返回true）

在SQL（或实际上是任何数据库，或者更确切地说是任何存储）中存储密码的一些提示：

始终存储经过强哈希哈希的密码。（你这样做，但任何人在谈论存储密码时都应该重复这一点）
始终为哈希加盐。（你这样做，但与上面相同）
- 请确保您的盐是随机的。
始终通过用户名查询或唯一标识符。
在此识别器上有一个唯一的密钥。
永远不要使用任何可能包含重复项的列来查找用户记录。
- 这意味着永远不会通过密码查询（或哈希）。
切勿在查询中使用密码。绝不使用明文。
- 更好，请尝试在SELECT中避免哈希。
使用多重算法。但要小心。
- 除非您知道自己在做什么，否则不要自己实施算法。
- 保持合理数量。将密码散列100ms可以轻松获得DoSed。
- 不要做for(int i=0;i<rounds;i++) md5(previous_hash)之类的事情。它可能并且将会破坏哈希。
永远不要自己实施哈希。（除非您当然知道自己在做什么）
请勿合并哈希值。
- md5(sha256(sha512(password)))一开始可能看起来不错，但相信我，不是。
始终存储密码哈希值。始终使用强哈希。始终用随机盐加盐哈希。

（如果有人提示缺少提示，我很乐意添加...）

验证用户名和加密密码

1 个答案: