upd: use scrypt for new passwords.

[gigi.git] / src / org / cacert / gigi / util / PasswordHash.java

diff --git a/src/org/cacert/gigi/util/PasswordHash.java b/src/org/cacert/gigi/util/PasswordHash.java
index 1baf13700729b2fb9330dcced7f2dbf32db4e31d..d6b0b9066b7ab11ec72177e883f1156227fc3ce7 100644 (file)
--- a/src/org/cacert/gigi/util/PasswordHash.java
+++ b/src/org/cacert/gigi/util/PasswordHash.java
@@ -3,24 +3,41 @@ package org.cacert.gigi.util;
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
 
+import com.lambdaworks.crypto.SCryptUtil;
+
 public class PasswordHash {
-       public static boolean verifyHash(String password, String hash) {
-               String newhash = sha1(password);
-               return newhash.equals(hash);
-       }
 
-       private static String sha1(String password) {
-               try {
-                       MessageDigest md = MessageDigest.getInstance("SHA1");
-                       byte[] digest = md.digest(password.getBytes());
-                       StringBuffer res = new StringBuffer(digest.length * 2);
-                       for (int i = 0; i < digest.length; i++) {
-                               res.append(Integer.toHexString((digest[i] & 0xF0) >> 4));
-                               res.append(Integer.toHexString(digest[i] & 0xF));
-                       }
-                       return res.toString();
-               } catch (NoSuchAlgorithmException e) {
-                       throw new Error(e);
-               }
-       }
+    public static boolean verifyHash(String password, String hash) {
+        if (hash.contains("$")) {
+            return SCryptUtil.check(password, hash);
+        }
+        String newhash = sha1(password);
+        boolean match = true;
+        if (newhash.length() != hash.length()) {
+            match = false;
+        }
+        for (int i = 0; i < newhash.length(); i++) {
+            match &= newhash.charAt(i) == hash.charAt(i);
+        }
+        return match;
+    }
+
+    private static String sha1(String password) {
+        try {
+            MessageDigest md = MessageDigest.getInstance("SHA1");
+            byte[] digest = md.digest(password.getBytes());
+            StringBuffer res = new StringBuffer(digest.length * 2);
+            for (int i = 0; i < digest.length; i++) {
+                res.append(Integer.toHexString((digest[i] & 0xF0) >> 4));
+                res.append(Integer.toHexString(digest[i] & 0xF));
+            }
+            return res.toString();
+        } catch (NoSuchAlgorithmException e) {
+            throw new Error(e);
+        }
+    }
+
+    public static String hash(String password) {
+        return SCryptUtil.scrypt(password, 1 << 14, 8, 1);
+    }
 }