Spring Security Encrypt MD5

Question

I have a java web application using spring framework and spring security for its login. In my database I have my passwords encrypted to MD5 before being saved. I added in my app

Answer 1

How are you creating your MD5 hashes? Something like the following works well in Java:

MessageDigest messageDigest = MessageDigest.getInstance("MD5");  
messageDigest.update(user.getPassword().getBytes(),0, user.getPassword().length());  
String hashedPass = new BigInteger(1,messageDigest.digest()).toString(16);  
if (hashedPass.length() < 32) {
   hashedPass = "0" + hashedPass; 
}

When you encode "koala" do you get "a564de63c2d0da68cf47586ee05984d7"?

Answer 2

I realize this is a little late, but Spring has built-in classes that make this a lot easier.

@Test
public void testSpringEncoder() {
    PasswordEncoder encoder = new Md5PasswordEncoder();
    String hashedPass = encoder.encodePassword("koala", null);

    assertEquals("a564de63c2d0da68cf47586ee05984d7", hashedPass);
}

This is a unit test that I wrote using the built in Spring Security code, it is a lot smaller than the MessageDigest code and since you are using Spring Security already, you should have the classes in your classpath already.

Answer 3

Have you read 6.3.3 Hashing and Authentication section from Spring Security reference manual? It mentioned some possible issues that you might encounter in using password hashing.

Some possibilities it listed:

• Database password hash might be in Base64, while the result from MD5PasswordEncoder is in hexadecimal strings
• Your password hash might be in upper-case, while the result from the encoder is in lower case strings