Java PBEKeySpec.clearPassword方法代码示例

import javax.crypto.spec.PBEKeySpec; //导入方法依赖的package包/类
private SecretKey getPBEKey(char[] password) throws IOException
{
    SecretKey skey = null;

    try {
        PBEKeySpec keySpec = new PBEKeySpec(password);
        SecretKeyFactory skFac = SecretKeyFactory.getInstance("PBE");
        skey = skFac.generateSecret(keySpec);
        keySpec.clearPassword();
    } catch (Exception e) {
       throw new IOException("getSecretKey failed: " +
                             e.getMessage(), e);
    }
    return skey;
}
 

import javax.crypto.spec.PBEKeySpec; //导入方法依赖的package包/类
/**
 * This method will hash the password and salt combination. Be careful, this method will erase the password after hashed it.
 * You must be sure that you do not need it after using this method.
 *
 * @param password the password who needs to be hashed
 * @param salt     some list of <code>byte</code> which will be included in the password
 * @return a hash of the password and salting combination.
 */
public static byte[] hash(char[] password, byte[] salt) {
    final PBEKeySpec spec = new PBEKeySpec(password, salt, SecurityUtils.ITERATIONS, SecurityUtils.KEY_LENGTH);

    try {
        SecretKeyFactory secretKeyFactory = SecretKeyFactory.getInstance(SecurityUtils.ALGORITHM);
        SecretKey key = secretKeyFactory.generateSecret(spec);
        return key.getEncoded();
    } catch (NoSuchAlgorithmException | InvalidKeySpecException e) {
        LOGGER.debug(e.getMessage(), e);
        throw new SecurityException(e);
    } finally {
        // erase the password in the char array in order to not retrieve it in the java memory
        spec.clearPassword();
    }
}
 

import javax.crypto.spec.PBEKeySpec; //导入方法依赖的package包/类
/**
 * Returns a salted and hashed password using the provided hash.<br>
 * Note - side effect: the password is destroyed (the char[] is filled with
 * zeros)
 *
 * @param password
 *            the password to be hashed
 * @param salt
 *            a 16 bytes salt, ideally obtained with the getNextSalt method
 *
 * @return the hashed password with a pinch of salt
 */
public static byte[] hash(final char[] password, final byte[] salt) {
	final PBEKeySpec spec = new PBEKeySpec(password, salt, ITERATIONS, KEY_LENGTH);
	Arrays.fill(password, Character.MIN_VALUE);
	try {
		final SecretKeyFactory skf = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1");
		return skf.generateSecret(spec).getEncoded();
	} catch (NoSuchAlgorithmException | InvalidKeySpecException e) {
		throw new HashingException("Error while hashing a password: " + e.getMessage(), e);
	} finally {
		spec.clearPassword();
	}
}
 

import javax.crypto.spec.PBEKeySpec; //导入方法依赖的package包/类
/** Retrieve a string setting. The {@link SecureString} should be closed once it is used. */
@Override
public SecureString getString(String setting) throws GeneralSecurityException {
    KeyStore.Entry entry = keystore.get().getEntry(setting, keystorePassword.get());
    if (entry instanceof KeyStore.SecretKeyEntry == false) {
        throw new IllegalStateException("Secret setting " + setting + " is not a string");
    }
    // TODO: only allow getting a setting once?
    KeyStore.SecretKeyEntry secretKeyEntry = (KeyStore.SecretKeyEntry) entry;
    PBEKeySpec keySpec = (PBEKeySpec) secretFactory.getKeySpec(secretKeyEntry.getSecretKey(), PBEKeySpec.class);
    SecureString value = new SecureString(keySpec.getPassword());
    keySpec.clearPassword();
    return value;
}
 

import javax.crypto.spec.PBEKeySpec; //导入方法依赖的package包/类
private static byte[] hash(char[] password, byte[] salt) {
    PBEKeySpec spec = new PBEKeySpec(password, salt, HASH_ITERATIONS, HASH_KEY_LENGTH);
    Arrays.fill(password, Character.MIN_VALUE);
    try {
        SecretKeyFactory skf = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1");
        return skf.generateSecret(spec).getEncoded();
    } catch (NoSuchAlgorithmException | InvalidKeySpecException e) {
        throw new AssertionError("Error while hashing a password: " + e.getMessage(), e);
    } finally {
        spec.clearPassword();
    }
}
 

import javax.crypto.spec.PBEKeySpec; //导入方法依赖的package包/类
/**
 * Encrypts the message using password based encryption.
 * @param algo
 *        the encryption algorithm
 * @param plaintext
 *        the message to be encrypted
 * @param password
 *        the password
 * @param iterationCount
 *        the iteration count
 * @param salt
 *        the salt
 * @return iv and the cipher text in form of
 *         len(iv) of 1 byte | iv of len(iv) bytes | cipher text.
 * @throws GeneralSecurityException
 *         if error occurs.
 */
public static byte[] encrypt(PBEAlgo algo, byte[] plaintext, char[] password,
        int iterationCount, byte[] salt) throws GeneralSecurityException {
    ParamUtil.requireNonNull("plaintext", plaintext);
    ParamUtil.requireNonNull("password", password);
    ParamUtil.requireMin("iterationCount", iterationCount, 1);
    ParamUtil.requireNonNull("salt", salt);

    SecretKeyFactory secretKeyFactory = SecretKeyFactory.getInstance(algo.algoName());

    PBEKeySpec pbeKeySpec = new PBEKeySpec(password);
    SecretKey pbeKey = secretKeyFactory.generateSecret(pbeKeySpec);

    Cipher cipher = Cipher.getInstance(algo.algoName());
    PBEParameterSpec pbeParameterSpec = new PBEParameterSpec(salt, iterationCount);
    cipher.init(Cipher.ENCRYPT_MODE, pbeKey, pbeParameterSpec);
    pbeKeySpec.clearPassword();

    byte[] iv = cipher.getIV();
    int ivLen = (iv == null) ? 0 : iv.length;
    if (ivLen > 255) {
        throw new GeneralSecurityException("IV too long: " + ivLen);
    }

    byte[] cipherText = cipher.doFinal(plaintext);
    byte[] ret = new byte[1 + ivLen + cipherText.length];
    // length of IV
    ret[0] = (byte) (ivLen & 0xFF);
    if (ivLen > 0) {
        System.arraycopy(iv, 0, ret, 1, ivLen);
    }

    System.arraycopy(cipherText, 0, ret, 1 + ivLen, cipherText.length);
    return ret;
}
 

import javax.crypto.spec.PBEKeySpec; //导入方法依赖的package包/类
private byte[] pbkdf2(char[] passwordChars, byte[] saltBytes, int pbkdf2Iterations) throws NoSuchAlgorithmException, InvalidKeySpecException {
    PBEKeySpec pbeKeySpec = new PBEKeySpec(passwordChars, saltBytes, pbkdf2Iterations, PBKDF2_KEY_LENGTH);
    SecretKeyFactory secretKeyFactory = SecretKeyFactory.getInstance(PBKDF2_ALGORITHM);
    SecretKey secretKey = secretKeyFactory.generateSecret(pbeKeySpec);
    pbeKeySpec.clearPassword();
    return secretKey.getEncoded();
}