mysql数据库test密码_java – 从MySQL数据库验证哈希密码

我在

Eclipse中使用Java,并在创建新用户时在我的数据库中存储哈希密码.这是通过此代码完成的..

String hashed_password = Password.hashPassword(passwordField.toString());

String query = "insert into user (username, password, usertype, license_code) values (?, ?, ?, ?)";

PreparedStatement pst = connection.prepareStatement(query);

pst.setString(1, userNameTextField.getText());

pst.setString(2, hashed_password);

我遗漏了一些与密码无关的其他细节,但是,我的散列值是数据库中的存储.然后我登录,并执行以下代码…

String test_passwd = passwordField.getText();

String test_hash = "$2a$12$N773YstmtU/1zIUe9An.r.P9U5BQp4o6.Qjk.J.zhA6ZtFytYuOZC";

System.out.println("Testing BCrypt Password hashing and verification");

System.out.println("Test password: " + test_passwd);

System.out.println("Test stored hash: " + test_hash);

System.out.println("Hashing test password...");

System.out.println();

String computed_hash = Password.hashPassword(test_passwd);

System.out.println("Test computed hash: " + computed_hash);

System.out.println();

System.out.println("Verifying that hash and stored hash both match for the test password...");

System.out.println();

String compare_test = Password.checkPassword(test_passwd, test_hash)

? "Passwords Match" : "Passwords do not match";

String compare_computed = Password.checkPassword(test_passwd, computed_hash)

? "Passwords Match" : "Passwords do not match";

System.out.println("Verify against stored hash: " + compare_test);

System.out.println("Verify against computed hash: " + compare_computed);

test_hash变量是从新用户代码存储在数据库中的散列密码.当我登录时,我知道我使用的密码与我在新用户提示中使用的密码相同.

但是,这是我的结果：

Test stored hash: $2a$12$N773YstmtU/1zIUe9An.r.P9U5BQp4o6.Qjk.J.zhA6ZtFytYuOZC

Hashing test password...

Test computed hash: $2a$12$rbBleRV4gyLaY4.ZZ4fjiOrLW423TWYqKmv0ejws7mmFd2N3/eieK

Verifying that hash and stored hash both match for the test password...

Verify against stored hash: Passwords do not match

Verify against computed hash: Passwords Match

结果表明密码与当时和那里的哈希密码匹配,但是尽管是相同的初始密码,但是与数据库中的哈希密码不匹配.

这是我散列密码并验证它的代码…

public class Password {

// Define the BCrypt workload to use when generating password hashes. 10-31 is a valid value.

private static int workload = 12;

/**

* This method can be used to generate a string representing an account password

* suitable for storing in a database. It will be an OpenBSD-style crypt(3) formatted

* hash string of length=60

* The bcrypt workload is specified in the above static variable, a value from 10 to 31.

* A workload of 12 is a very reasonable safe default as of 2013.

* This automatically handles secure 128-bit salt generation and storage within the hash.

* @param password_plaintext The account's plaintext password as provided during account creation,

* or when changing an account's password.

* @return String - a string of length 60 that is the bcrypt hashed password in crypt(3) format.

*/

public static String hashPassword(String password_plaintext) {

String salt = BCrypt.gensalt(workload);

String hashed_password = BCrypt.hashpw(password_plaintext, salt);

return(hashed_password);

}

/**

* This method can be used to verify a computed hash from a plaintext (e.g. during a login

* request) with that of a stored hash from a database. The password hash from the database

* must be passed as the second variable.

* @param password_plaintext The account's plaintext password, as provided during a login request

* @param stored_hash The account's stored password hash, retrieved from the authorization database

* @return boolean - true if the password matches the password of the stored hash, false otherwise

*/

public static boolean checkPassword(String password_plaintext, String stored_hash) {

boolean password_verified = false;

if(null == stored_hash || !stored_hash.startsWith("$2a$"))

throw new java.lang.IllegalArgumentException("Invalid hash provided for comparison");

password_verified = BCrypt.checkpw(password_plaintext, stored_hash);

return(password_verified);

}

}