Buscar este blog

domingo, 25 de diciembre de 2016

Password hash 2016 - Argon2

Argon2 was the winner of Password Hashing Competition.

The project is written in C, but there is a java version that uses JNA (Java Native Access):  https://github.com/phxql/argon2-jvm

Maven configuration.
<dependency>
    <groupId>de.mkammerer</groupId>
    <artifactId>argon2-jvm</artifactId>
    <version>2.1</version>
</dependency>

Java example (most of the examples I saw are inaccurate due the fact that the password is actually wiped after the encryption);
import de.mkammerer.argon2.Argon2;
import de.mkammerer.argon2.Argon2Factory;

public class Main {

 public static void main(final String[] args) {
  final String hash = generateHash("secret".toCharArray());

  System.out.println(isValidPass("secret".toCharArray(), hash));
  System.out.println(isValidPass("otherPass".toCharArray(), hash));
 }

 private static String generateHash(final char[] pass) {
  final Argon2 argon2 = Argon2Factory.create(Argon2Factory.Argon2Types.ARGON2i, 64, 64);
     final char[] passwd = "secret".toCharArray();
  try {
   final int t = 2;
   final int m = 65536;
   final int p = 1;
      return argon2.hash(t, m, p, passwd);
  } finally {
      argon2.wipeArray(passwd);
  }
 }

 private static boolean isValidPass(final char[] passwd, final String hash) {
  final Argon2 argon2 = Argon2Factory.create(Argon2Factory.Argon2Types.ARGON2i, 64, 64);
  try {
   return argon2.verify(hash, passwd);
  } finally {
      argon2.wipeArray(passwd);
  }

 }
}

No hay comentarios:

Publicar un comentario