Package org.apache.commons.codec.digest

Class Sha2Crypt

  • public class Sha2Crypt
extends java.lang.Object
    SHA2-based Unix crypt implementation.

    Based on the C implementation released into the Public Domain by Ulrich Drepper <drepper@redhat.com> http://www.akkadia.org/drepper/SHA-crypt.txt

    Conversion to Kotlin and from there to Java in 2012 by Christian Hammers <ch@lathspell.de> and likewise put into the Public Domain.

    This class is immutable and thread-safe.

    SHA-crypt hashing has a quadratic input-length step. To bound CPU and memory consumption when plaintext is supplied by an untrusted caller, plaintext is limited to 4096 bytes by default. The limit can be changed with the org.apache.commons.codec.digest.Sha2Crypt.keyMax system property; this property is intended for trusted JVM configuration only.

    Since:
    1.7

    • Constructor Summary

      Constructors 
      Constructor Description
      Sha2Crypt()
      Deprecated.
      Will be private in the next major version.

    • Method Summary

      All Methods Static Methods Concrete Methods 
      Modifier and Type Method Description
      static java.lang.String sha256Crypt​(byte[] keyBytes)
      Generates a libc crypt() compatible "$5$" hash value with random salt.
      static java.lang.String sha256Crypt​(byte[] keyBytes, java.lang.String salt)
      Generates a libc6 crypt() compatible "$5$" hash value.
      static java.lang.String sha256Crypt​(byte[] keyBytes, java.lang.String salt, java.util.Random random)
      Generates a libc6 crypt() compatible "$5$" hash value.
      static java.lang.String sha512Crypt​(byte[] keyBytes)
      Generates a libc crypt() compatible "$6$" hash value with random salt.
      static java.lang.String sha512Crypt​(byte[] keyBytes, java.lang.String salt)
      Generates a libc6 crypt() compatible "$6$" hash value.
      static java.lang.String sha512Crypt​(byte[] keyBytes, java.lang.String salt, java.util.Random random)
      Generates a libc6 crypt() compatible "$6$" hash value.

      • Methods inherited from class java.lang.Object

        clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    • Constructor Detail

      • Sha2Crypt

        @Deprecated
public Sha2Crypt()
        Deprecated.
        Will be private in the next major version.
        Consider private.

    • Method Detail

      • sha256Crypt

        public static java.lang.String sha256Crypt​(byte[] keyBytes)
        Generates a libc crypt() compatible "$5$" hash value with random salt.

        See Crypt.crypt(String, String) for details.

        A salt is generated for you using SecureRandom.

        Parameters:
        keyBytes - Plaintext to hash. Each array element is set to 0 before returning.
        Returns:
        The Complete hash value.
        Throws:
        java.lang.IllegalArgumentException - Thrown if keyBytes exceeds the configured maximum length
        java.lang.IllegalArgumentException - Thrown if a NoSuchAlgorithmException is caught.

      • sha256Crypt

        public static java.lang.String sha256Crypt​(byte[] keyBytes,
                                           java.lang.String salt)
        Generates a libc6 crypt() compatible "$5$" hash value.

        See Crypt.crypt(String, String) for details.

        Parameters:
        keyBytes - Plaintext to hash. Each array element is set to 0 before returning.
        salt - real salt value without prefix or "rounds=". The salt may be null, in which case a salt is generated for you using SecureRandom. If one does not want to use SecureRandom, you can pass your own Random in sha256Crypt(byte[], String, Random).
        Returns:
        The Complete hash value including salt.
        Throws:
        java.lang.IllegalArgumentException - Thrown if keyBytes exceeds the configured maximum length
        java.lang.IllegalArgumentException - Thrown if the salt does not match the allowed pattern.
        java.lang.IllegalArgumentException - Thrown if a NoSuchAlgorithmException is caught.

      • sha256Crypt

        public static java.lang.String sha256Crypt​(byte[] keyBytes,
                                           java.lang.String salt,
                                           java.util.Random random)
        Generates a libc6 crypt() compatible "$5$" hash value.

        See Crypt.crypt(String, String) for details.

        Parameters:
        keyBytes - plaintext to hash. Each array element is set to 0 before returning.
        salt - real salt value without prefix or "rounds=".
        random - The instance of Random to use for generating the salt. Consider using SecureRandom for more secure salts.
        Returns:
        The Complete hash value including salt.
        Throws:
        java.lang.IllegalArgumentException - Thrown if keyBytes exceeds the configured maximum length
        java.lang.IllegalArgumentException - Thrown if the salt does not match the allowed pattern.
        java.lang.IllegalArgumentException - Thrown if a NoSuchAlgorithmException is caught.
        Since:
        1.12

      • sha512Crypt

        public static java.lang.String sha512Crypt​(byte[] keyBytes)
        Generates a libc crypt() compatible "$6$" hash value with random salt.

        See Crypt.crypt(String, String) for details.

        A salt is generated for you using SecureRandom.

        Parameters:
        keyBytes - Plaintext to hash. Each array element is set to 0 before returning.
        Returns:
        Complete hash value.
        Throws:
        java.lang.IllegalArgumentException - Thrown if keyBytes exceeds the configured maximum length
        java.lang.IllegalArgumentException - Thrown if a NoSuchAlgorithmException is caught.

      • sha512Crypt

        public static java.lang.String sha512Crypt​(byte[] keyBytes,
                                           java.lang.String salt)
        Generates a libc6 crypt() compatible "$6$" hash value.

        See Crypt.crypt(String, String) for details.

        Parameters:
        keyBytes - Plaintext to hash. Each array element is set to 0 before returning.
        salt - Real salt value without prefix or "rounds=". The salt may be null, in which case a salt is generated for you using SecureRandom; if you want to use a Random object other than SecureRandom then we suggest you provide it using sha512Crypt(byte[], String, Random).
        Returns:
        Complete hash value including salt.
        Throws:
        java.lang.IllegalArgumentException - Thrown if keyBytes exceeds the configured maximum length
        java.lang.IllegalArgumentException - Thrown if the salt does not match the allowed pattern.
        java.lang.IllegalArgumentException - Thrown if a NoSuchAlgorithmException is caught.

      • sha512Crypt

        public static java.lang.String sha512Crypt​(byte[] keyBytes,
                                           java.lang.String salt,
                                           java.util.Random random)
        Generates a libc6 crypt() compatible "$6$" hash value.

        See Crypt.crypt(String, String) for details.

        Parameters:
        keyBytes - Plaintext to hash. Each array element is set to 0 before returning.
        salt - Real salt value without prefix or "rounds=". The salt may be null, in which case a salt is generated for you using SecureRandom.
        random - The instance of Random to use for generating the salt. Consider using SecureRandom for more secure salts.
        Returns:
        Complete hash value including salt.
        Throws:
        java.lang.IllegalArgumentException - Thrown if the salt does not match the allowed pattern.
        java.lang.IllegalArgumentException - Thrown if a NoSuchAlgorithmException is caught.
        Since:
        1.12