What password encryption Hudson is using?

泪湿孤枕 提交于 2019-12-03 09:22:11

The source code responsible for this is found in the hudson.security.HudsonPrivateSecurityRealm class (more specifically, the PasswordEncoder inner class).

Consider your example:

mEDUyJ:0c9e6f2556b9b3a0b9e9046c21490422b4a54877f057b527b2c0bd4dc83342d5

The prefix (mEDUyJ) is actually a six-letter salt. A salt can be any six-letter permutation of uppercase letters and lowercase letters.

Hudson uses the Acegi Security library. More specifically, it uses that library's ShaPasswordEncoder class. It's basically doing this:

String salt = generateSomeSixLetterSalt() // Fictional function
String passwordHash = salt + ":" + new ShaPasswordEncoder(256).encodePassword(password, salt);

Once you view the source code for ShaPasswordEncoder, you find this it's essentially doing this:

// Fictional functions ahead...
String salt = generateSomeSixLetterSalt()
String passwordHash = salt + ":" + hex_encode(sha256_hash(utf8_encode(password + "{" + salt + "}")))
标签
易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!