Class Sha2Crypt

java.lang.Object

org.apache.commons.codec.digest.Sha2Crypt

public class Sha2Crypt
extends Object

SHA2-based Unix crypt implementation.

Based on the C implementation released into the Public Domain by Ulrich Drepper <drepper@redhat.com> http://www.akkadia.org/drepper/SHA-crypt.txt

Conversion to Kotlin and from there to Java in 2012 by Christian Hammers <ch@lathspell.de> and likewise put into the Public Domain.

This class is immutable and thread-safe.

SHA-crypt hashing has a quadratic input-length step. To bound CPU and memory consumption when plaintext is supplied by an untrusted caller, plaintext is limited to 4096 bytes by default. The limit can be changed with the org.apache.commons.codec.digest.Sha2Crypt.keyMax system property; this property is intended for trusted JVM configuration only.

Since:

1.7

Constructor Summary

Constructors

Constructor	Description
Sha2Crypt()	Deprecated. Will be private in the next major version.

Method Summary

Modifier and Type	Method	Description
static String	sha256Crypt(byte[] keyBytes)	Generates a libc crypt() compatible "$5$" hash value with random salt.
static String	sha256Crypt(byte[] keyBytes, String salt)	Generates a libc6 crypt() compatible "$5$" hash value.
static String	sha256Crypt(byte[] keyBytes, String salt, Random random)	Generates a libc6 crypt() compatible "$5$" hash value.
static String	sha512Crypt(byte[] keyBytes)	Generates a libc crypt() compatible "$6$" hash value with random salt.
static String	sha512Crypt(byte[] keyBytes, String salt)	Generates a libc6 crypt() compatible "$6$" hash value.
static String	sha512Crypt(byte[] keyBytes, String salt, Random random)	Generates a libc6 crypt() compatible "$6$" hash value.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

Sha2Crypt

@Deprecated
public Sha2Crypt()

Deprecated.

Will be private in the next major version.

Consider private.

Method Details

sha256Crypt

public static String sha256Crypt(byte[] keyBytes)

Generates a libc crypt() compatible "$5$" hash value with random salt.

See Crypt.crypt(String, String) for details.

A salt is generated for you using SecureRandom.

Parameters:

keyBytes - Plaintext to hash. Each array element is set to 0 before returning.

Returns:

The Complete hash value.

Throws:

IllegalArgumentException - Thrown if keyBytes exceeds the configured maximum length

IllegalArgumentException - Thrown if a NoSuchAlgorithmException is caught.

sha256Crypt

public static String sha256Crypt(byte[] keyBytes,
 String salt)

Generates a libc6 crypt() compatible "$5$" hash value.

See Crypt.crypt(String, String) for details.

Parameters:

keyBytes - Plaintext to hash. Each array element is set to 0 before returning.

salt - real salt value without prefix or "rounds=". The salt may be null, in which case a salt is generated for you using SecureRandom. If one does not want to use SecureRandom, you can pass your own Random in sha256Crypt(byte[], String, Random).

Returns:

The Complete hash value including salt.

Throws:

IllegalArgumentException - Thrown if keyBytes exceeds the configured maximum length

IllegalArgumentException - Thrown if the salt does not match the allowed pattern.

IllegalArgumentException - Thrown if a NoSuchAlgorithmException is caught.

sha256Crypt

public static String sha256Crypt(byte[] keyBytes,
 String salt,
 Random random)

Generates a libc6 crypt() compatible "$5$" hash value.

See Crypt.crypt(String, String) for details.

Parameters:

keyBytes - plaintext to hash. Each array element is set to 0 before returning.

salt - real salt value without prefix or "rounds=".

random - The instance of Random to use for generating the salt. Consider using SecureRandom for more secure salts.

Returns:

The Complete hash value including salt.

Throws:

IllegalArgumentException - Thrown if keyBytes exceeds the configured maximum length

IllegalArgumentException - Thrown if the salt does not match the allowed pattern.

IllegalArgumentException - Thrown if a NoSuchAlgorithmException is caught.

Since:

1.12

sha512Crypt

public static String sha512Crypt(byte[] keyBytes)

Generates a libc crypt() compatible "$6$" hash value with random salt.

See Crypt.crypt(String, String) for details.

A salt is generated for you using SecureRandom.

Parameters:

keyBytes - Plaintext to hash. Each array element is set to 0 before returning.

Returns:

Complete hash value.

Throws:

IllegalArgumentException - Thrown if keyBytes exceeds the configured maximum length

IllegalArgumentException - Thrown if a NoSuchAlgorithmException is caught.

sha512Crypt

public static String sha512Crypt(byte[] keyBytes,
 String salt)

Generates a libc6 crypt() compatible "$6$" hash value.

See Crypt.crypt(String, String) for details.

Parameters:

keyBytes - Plaintext to hash. Each array element is set to 0 before returning.

salt - Real salt value without prefix or "rounds=". The salt may be null, in which case a salt is generated for you using SecureRandom; if you want to use a Random object other than SecureRandom then we suggest you provide it using sha512Crypt(byte[], String, Random).

Returns:

Complete hash value including salt.

Throws:

IllegalArgumentException - Thrown if keyBytes exceeds the configured maximum length

IllegalArgumentException - Thrown if the salt does not match the allowed pattern.

IllegalArgumentException - Thrown if a NoSuchAlgorithmException is caught.

sha512Crypt

public static String sha512Crypt(byte[] keyBytes,
 String salt,
 Random random)

Generates a libc6 crypt() compatible "$6$" hash value.

See Crypt.crypt(String, String) for details.

Parameters:

keyBytes - Plaintext to hash. Each array element is set to 0 before returning.

salt - Real salt value without prefix or "rounds=". The salt may be null, in which case a salt is generated for you using SecureRandom.

random - The instance of Random to use for generating the salt. Consider using SecureRandom for more secure salts.

Returns:

Complete hash value including salt.

Throws:

IllegalArgumentException - Thrown if the salt does not match the allowed pattern.

IllegalArgumentException - Thrown if a NoSuchAlgorithmException is caught.

Since:

1.12