HashPassword.patch

Șerban Bursuc, 08/14/2026 08:29 AM

        /** Stores the temporary account details upon successful creation. */
        private TemporaryAccount account = null;
        /** Definition of the user to create, prepared by the posting thread. */
        private TempUserDef user = null;
        /** Clear text password of the user to create, prepared by the posting thread. */
        private String password = null;
        /** Static ID generator shared across all temporary accounts and groups. */
        private static TempIdManager idGenerator;
-...
+       }
        /**
         * Constructs a new task set to <b>creation mode</b>.
         * <p>
         * When executed, this task will generate and add a new temporary user.
         * </p>
         * Constructs a new task set to <b>creation mode</b>.  The credentials of the new user are
         * generated and hashed here, on the posting thread, so that the deliberately expensive
         * password hashing is not serialized on the single worker thread.
         */
        public CreateAccountTask()
+       {
           this.create  = true;
           this.account = null;
           // Generate random values for account
           String subject = RandomWordGenerator.create(GEN_LENGTH, GEN_DIGITS, 0);
           password = RandomWordGenerator.create(GEN_LENGTH, GEN_DIGITS, GEN_SYMBOLS);
           // Fill account structure
           user = new TempUserDef();
           user.enabled = true;
           user.protect = true;
           user.person = "chui";
           user.subjectId = subject;
           user.password = HashPassword.hashPassword(password, HashPassword.EPHEMERAL_ITERATIONS);
           user.mode = 1;
           user.groups = new String[] { TEMP_GROUP };
           user.orderId = idGenerator.getNextId();
+       }
        /**
-...
         * This method performs the following steps:
         * <ol>
         *   <li>Ensures the temporary group exists.</li>
         *   <li>Generates a random subject ID (username) and password.</li>
         *   <li>Creates a {@code UserDef} populated with these credentials and default settings.</li>
         *   <li>Persists the temporary user via the Admin Server.</li>
         *   <li>Persists the temporary user prepared by the constructor via the Admin Server.</li>
         *   <li>Caches the resulting credentials in the {@code account} field.</li>
         *   <li>Triggers a cache refresh in the {@code SecurityManager}.</li>
         * </ol>
-...
+       {
           createGroupIfNotExists();
           // Generate random values for account
           String subject = RandomWordGenerator.create(GEN_LENGTH, GEN_DIGITS, 0);
           String password = RandomWordGenerator.create(GEN_LENGTH, GEN_DIGITS, GEN_SYMBOLS);
           // Fill account structure
           TempUserDef user = new TempUserDef();
           user.enabled = true;
           user.protect = true;
           user.person = "chui";
           user.subjectId = subject;
           user.password = HashPassword.hashPassword(password);
           user.mode = 1;
           user.groups = new String[] { TEMP_GROUP };
           user.orderId = idGenerator.getNextId();
           synchronized (mutex)
+          {
              // Create temporary account
-...
                    return;
+                }
+             }
              else
+             {
                 // the ID was allocated by the constructor and is not in use, make it available again
                 idGenerator.recycleId(user.orderId);
+             }
+          }
+       }

        /** PBKDF2 iteration count. */
        private static final int PBKDF2_ITERATIONS = 210000;
        /**
         * PBKDF2 iteration count for ephemeral, high entropy secrets.
         * <p>
         * The full iteration count exists to make offline cracking of user chosen passwords expensive.
         * It buys nothing for a randomly generated, single use, in-memory credential, while costing
         * hundreds of milliseconds on both the creation and the authentication path.  Only use this
         * for secrets which come from {@link RandomWordGenerator} and never outlive a session.
         * </p>
         */
        public static final int EPHEMERAL_ITERATIONS = 1000;
        /** Salt length for new password hashes, in bytes. */
        private static final int SALT_LENGTH = 16;
-...
         */
        public static byte[] hashPassword(String plain)
+       {
           return hashPassword(plain, PBKDF2_ITERATIONS);
+       }
        /**
         * Hashes string into a digest used as an internal password represenation, using the given
         * iteration count.  The count is stored in the hash, so {@link #verifyPassword} needs no
         * knowledge of it.
+        *
         * @param     plain
         *            plain text password
         * @param     iterations
         *            PBKDF2 iteration count;  must be greater than 0.  Anything below
         *            {@link #PBKDF2_ITERATIONS} is only appropriate for a high entropy secret, see
         *            {@link #EPHEMERAL_ITERATIONS}.
+        *
         * @return    array of bytes representing the hashed string or
         *            <code>null</code>, if the PBKDF2 algorithm is unavailable.
         */
        public static byte[] hashPassword(String plain, int iterations)
+       {
           if (plain == null)
+          {
              return null;
-...
           byte[] salt = new byte[SALT_LENGTH];
           RANDOM.nextBytes(salt);
           byte[] hash = pbkdf2(plain, salt, PBKDF2_ITERATIONS, DERIVED_KEY_LENGTH);
           byte[] hash = pbkdf2(plain, salt, iterations, DERIVED_KEY_LENGTH);
           if (hash == null)
+          {
              return null;
-...
           ByteBuffer buffer = ByteBuffer.allocate(CURRENT_MAGIC.length + Integer.BYTES * 3 +
                                                   salt.length + hash.length);
           buffer.put(CURRENT_MAGIC);
           buffer.putInt(PBKDF2_ITERATIONS);
           buffer.putInt(iterations);
           buffer.putInt(salt.length);
           buffer.putInt(hash.length);
           buffer.put(salt);

Project

General

Profile

FWD » Core Development » Runtime Infrastructure

HashPassword.patch