Spring Security 中的 Bcrypt

<div class="post-content" itemprop="articleBody"> 最近在写用户管理相关的微服务，其中比较重要的问题是如何保存用户的密码，加盐哈希是一种常见的做法。知乎上有个问题大家可以先读一下: <a href="https://www.zhihu.com/question/20299384">加盐密码保存的最通用方法是？</a> 对于每个用户的密码，都应该使用独一无二的盐值，每当新用户注册或者修改密码时，都应该使用新的盐值进行加密，并且这个盐值应该足够长，使得有足够的盐值以供加密。随着彩虹表的出现及不断增大，MD5算法不建议再使用了。 存储密码的步骤 <ol> <li>使用基于加密的伪随机数生成器（Cryptographically Secure Pseudo-Random Number Generator – CSPRNG）生成一个足够长的盐值，如Java中的<a href="https://docs.oracle.com/javase/8/docs/api/java/security/SecureRandom.html">java.security.SecureRandom</a></li> <li>将盐值混入密码(常用的做法是置于密码之前)，并使用标准的加密哈希函数进行加密，如SHA256</li> <li>把哈希值和盐值一起存入数据库中对应此用户的那条记录</li> </ol> 校验密码的步骤 <ol> <li>从数据库取出用户的密码哈希值和对应盐值</li> <li>将盐值混入用户输入的密码，并使用相同的哈希函数进行加密</li> <li>比较上一步结果和哈希值是否相同，如果相同那么密码正确，反之密码错误</li> </ol> 加盐使攻击者无法采用特定的查询表或彩虹表快速破解大量哈希值，但不能阻止字典攻击或暴力攻击。这里假设攻击者已经获取到用户数据库，意味着攻击者知道每个用户的盐值，根据<a href="https://en.wikipedia.org/wiki/Kerckhoffs%27s\_principle">Kerckhoffs’s principle</a>，应该假设攻击者知道用户系统使用密码加密算法，如果攻击者使用高端GPU或定制的<a href="https://en.wikipedia.org/wiki/Application-specific\_integrated\_circuit">ASIC</a>，每秒可以进行数十亿次哈希计算，针对每个用户进行字典查询的效率依旧很高效。 为了降低这类攻击，可以用一种叫做密钥扩展的技术，让哈希函数变得很慢，即使GPU或ASIC字典攻击或暴力攻击也会慢得让攻击者无法接受。密钥扩展的实现依赖一种CPU密集型哈希函数，如<a href="https://en.wikipedia.org/wiki/PBKDF2">PBKDF2</a>和本文将要介绍的<a href="https://en.wikipedia.org/wiki/Bcrypt">Bcrypt</a>。这类函数使用一个安全因子或迭代次数作为参数，该值决定了哈希函数会有多慢。 Bcrypt Bcrypt是由Niels Provos和DavidMazières基于Blowfish密码设计的一种密码散列函数，于1999年在USENIX上发布。 wikipedia上Bcrypt词条中有该算法的伪代码: <div class="highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Function bcrypt Input: cost: Number (4..31) // 该值决定了密钥扩展的迭代次数 Iterations = 2^cost salt: array of Bytes (16 bytes) // 随机数 password: array of Bytes (1..72 bytes) // 用户密码 Output: hash: array of Bytes (24 bytes) // 返回的哈希值

1// 使用Expensive key setup算法初始化Blowfish状态
2state &lt;- EksBlowfishSetup(cost, salt, password)     // 这一步是整个算法中最耗时的步骤
3
4ctext &lt;- "OrpheanBeholderScryDoubt"     // 24 bytes，初始向量
5repeat (64)
6    ctext &lt;- EncryptECB(state, ctext)   // 使用 blowfish 算法的ECB模式进行加密
7
8return Concatenate(cost, salt, ctext)

// Expensive key setup Function EksBlowfishSetup Input: cost: Number (4..31) salt: array of Bytes (16 bytes) password: array of Bytes (1..72 bytes) Output: state: opaque BlowFish state structure

1state &lt;- InitialState()
2state &lt;- ExpandKey(state, salt, password)
3repeat (2 ^ cost)           // 计算密集型
4    state &lt;- ExpandKey(state, 0, password)
5    state &lt;- ExpandKey(state, 0, salt)
6
7return state

Function ExpandKey(state, salt, password) Input: state: Opaque BlowFish state structure // 内部包含 P-array 和 S-box salt: array of Bytes (16 bytes) password: array of Bytes (1..72 bytes) Output: state: Opaque BlowFish state structure

// ExpandKey 是对输入参数进行固定的移位异或等运算，这里不列出

</code></pre></div></div>

通过伪代码可以看出，通过制定不同的cost值，可以使得EksBlowfishSetup的运算次数大幅提升，从而达到慢哈希的目的。 Spring Security 中的 Bcrypt 理解了Bcrypt算法的原理，再来看Spring Security中的实现就很简单了。 <div class="language-java highlighter-rouge"><div class="highlight"><pre class="highlight"><code>package org.springframework.security.crypto.bcrypt;

...省略import...

public class BCryptPasswordEncoder implements PasswordEncoder { ...省略log...

1<span class="kd">private</span> <span class="kd">final</span> <span class="kt">int</span> <span class="n">strength</span><span class="o">;</span>         <span class="c1">// 相当于wiki伪代码中的cost，默认为10</span>
2
3<span class="kd">private</span> <span class="kd">final</span> <span class="n">SecureRandom</span> <span class="n">random</span><span class="o">;</span>  <span class="c1">// CSPRNG</span>
4
5<span class="c1">// 构造函数</span>
6<span class="kd">public</span> <span class="nf">BCryptPasswordEncoder</span><span class="o">()</span> <span class="o">{</span>
7    <span class="k">this</span><span class="o">(-</span><span class="mi">1</span><span class="o">);</span>
8<span class="o">}</span>
9
10<span class="c1">// 相当于伪代码中的cost, 长度 4 ~ 31</span>
11<span class="kd">public</span> <span class="nf">BCryptPasswordEncoder</span><span class="o">(</span><span class="kt">int</span> <span class="n">strength</span><span class="o">)</span> <span class="o">{</span>
12    <span class="k">this</span><span class="o">(</span><span class="n">strength</span><span class="o">,</span> <span class="kc">null</span><span class="o">);</span>
13<span class="o">}</span>
14
15<span class="c1">// 构造函数</span>
16<span class="kd">public</span> <span class="nf">BCryptPasswordEncoder</span><span class="o">(</span><span class="kt">int</span> <span class="n">strength</span><span class="o">,</span> <span class="n">SecureRandom</span> <span class="n">random</span><span class="o">)</span> <span class="o">{</span>
17    <span class="k">if</span> <span class="o">(</span><span class="n">strength</span> <span class="o">!=</span> <span class="o">-</span><span class="mi">1</span> <span class="o">&amp;&amp;</span> <span class="o">(</span><span class="n">strength</span> <span class="o">&lt;</span> <span class="n">BCrypt</span><span class="o">.</span><span class="na">MIN_LOG_ROUNDS</span> <span class="o">||</span> <span class="n">strength</span> <span class="o">&gt;</span> <span class="n">BCrypt</span><span class="o">.</span><span class="na">MAX_LOG_ROUNDS</span><span class="o">))</span> <span class="o">{</span>
18        <span class="k">throw</span> <span class="k">new</span> <span class="nf">IllegalArgumentException</span><span class="o">(</span><span class="s">"Bad strength"</span><span class="o">);</span>
19    <span class="o">}</span>
20    <span class="k">this</span><span class="o">.</span><span class="na">strength</span> <span class="o">=</span> <span class="n">strength</span><span class="o">;</span>
21    <span class="k">this</span><span class="o">.</span><span class="na">random</span> <span class="o">=</span> <span class="n">random</span><span class="o">;</span>
22<span class="o">}</span>
23
24<span class="c1">// 加密函数</span>
25<span class="kd">public</span> <span class="n">String</span> <span class="nf">encode</span><span class="o">(</span><span class="n">CharSequence</span> <span class="n">rawPassword</span><span class="o">)</span> <span class="o">{</span>
26    <span class="n">String</span> <span class="n">salt</span><span class="o">;</span>
27    <span class="k">if</span> <span class="o">(</span><span class="n">strength</span> <span class="o">&gt;</span> <span class="mi">0</span><span class="o">)</span> <span class="o">{</span>
28        <span class="k">if</span> <span class="o">(</span><span class="n">random</span> <span class="o">!=</span> <span class="kc">null</span><span class="o">)</span> <span class="o">{</span>
29            <span class="n">salt</span> <span class="o">=</span> <span class="n">BCrypt</span><span class="o">.</span><span class="na">gensalt</span><span class="o">(</span><span class="n">strength</span><span class="o">,</span> <span class="n">random</span><span class="o">);</span>
30        <span class="o">}</span>
31        <span class="k">else</span> <span class="o">{</span>
32            <span class="n">salt</span> <span class="o">=</span> <span class="n">BCrypt</span><span class="o">.</span><span class="na">gensalt</span><span class="o">(</span><span class="n">strength</span><span class="o">);</span>
33        <span class="o">}</span>
34    <span class="o">}</span>
35    <span class="k">else</span> <span class="o">{</span>
36        <span class="n">salt</span> <span class="o">=</span> <span class="n">BCrypt</span><span class="o">.</span><span class="na">gensalt</span><span class="o">();</span>
37    <span class="o">}</span>
38    <span class="k">return</span> <span class="n">BCrypt</span><span class="o">.</span><span class="na">hashpw</span><span class="o">(</span><span class="n">rawPassword</span><span class="o">.</span><span class="na">toString</span><span class="o">(),</span> <span class="n">salt</span><span class="o">);</span>
39<span class="o">}</span>
40
41<span class="c1">// 密码匹配函数</span>
42<span class="kd">public</span> <span class="kt">boolean</span> <span class="nf">matches</span><span class="o">(</span><span class="n">CharSequence</span> <span class="n">rawPassword</span><span class="o">,</span> <span class="n">String</span> <span class="n">encodedPassword</span><span class="o">)</span> <span class="o">{</span>
43    <span class="k">if</span> <span class="o">(</span><span class="n">encodedPassword</span> <span class="o">==</span> <span class="kc">null</span> <span class="o">||</span> <span class="n">encodedPassword</span><span class="o">.</span><span class="na">length</span><span class="o">()</span> <span class="o">==</span> <span class="mi">0</span><span class="o">)</span> <span class="o">{</span>
44        <span class="n">logger</span><span class="o">.</span><span class="na">warn</span><span class="o">(</span><span class="s">"Empty encoded password"</span><span class="o">);</span>
45        <span class="k">return</span> <span class="kc">false</span><span class="o">;</span>
46    <span class="o">}</span>
47
48    <span class="k">if</span> <span class="o">(!</span><span class="n">BCRYPT_PATTERN</span><span class="o">.</span><span class="na">matcher</span><span class="o">(</span><span class="n">encodedPassword</span><span class="o">).</span><span class="na">matches</span><span class="o">())</span> <span class="o">{</span>
49        <span class="n">logger</span><span class="o">.</span><span class="na">warn</span><span class="o">(</span><span class="s">"Encoded password does not look like BCrypt"</span><span class="o">);</span>
50        <span class="k">return</span> <span class="kc">false</span><span class="o">;</span>
51    <span class="o">}</span>
52
53    <span class="k">return</span> <span class="n">BCrypt</span><span class="o">.</span><span class="na">checkpw</span><span class="o">(</span><span class="n">rawPassword</span><span class="o">.</span><span class="na">toString</span><span class="o">(),</span> <span class="n">encodedPassword</span><span class="o">);</span>
54<span class="o">}</span>

}

</code></pre></div></div>

<div class="language-java highlighter-rouge"><div class="highlight"><pre class="highlight"><code>package org.springframework.security.crypto.bcrypt;

public class BCrypt {

1<span class="c1">// 生成盐值的函数 "$2a$" + 2字节log_round + "$" + 22字节随机数Base64编码</span>
2<span class="kd">public</span> <span class="kd">static</span> <span class="n">String</span> <span class="nf">gensalt</span><span class="o">(</span><span class="kt">int</span> <span class="n">log_rounds</span><span class="o">,</span> <span class="n">SecureRandom</span> <span class="n">random</span><span class="o">)</span> <span class="o">{</span>
3    <span class="k">if</span> <span class="o">(</span><span class="n">log_rounds</span> <span class="o">&lt;</span> <span class="n">MIN_LOG_ROUNDS</span> <span class="o">||</span> <span class="n">log_rounds</span> <span class="o">&gt;</span> <span class="n">MAX_LOG_ROUNDS</span><span class="o">)</span> <span class="o">{</span>
4        <span class="k">throw</span> <span class="k">new</span> <span class="nf">IllegalArgumentException</span><span class="o">(</span><span class="s">"Bad number of rounds"</span><span class="o">);</span>
5    <span class="o">}</span>
6    <span class="n">StringBuilder</span> <span class="n">rs</span> <span class="o">=</span> <span class="k">new</span> <span class="n">StringBuilder</span><span class="o">();</span>
7    <span class="kt">byte</span> <span class="n">rnd</span><span class="o">[]</span> <span class="o">=</span> <span class="k">new</span> <span class="kt">byte</span><span class="o">[</span><span class="n">BCRYPT_SALT_LEN</span><span class="o">];</span>
8
9    <span class="n">random</span><span class="o">.</span><span class="na">nextBytes</span><span class="o">(</span><span class="n">rnd</span><span class="o">);</span>
10
11    <span class="n">rs</span><span class="o">.</span><span class="na">append</span><span class="o">(</span><span class="s">"$2a$"</span><span class="o">);</span>
12    <span class="k">if</span> <span class="o">(</span><span class="n">log_rounds</span> <span class="o">&lt;</span> <span class="mi">10</span><span class="o">)</span> <span class="o">{</span>
13        <span class="n">rs</span><span class="o">.</span><span class="na">append</span><span class="o">(</span><span class="s">"0"</span><span class="o">);</span>
14    <span class="o">}</span>
15    <span class="n">rs</span><span class="o">.</span><span class="na">append</span><span class="o">(</span><span class="n">log_rounds</span><span class="o">);</span>
16    <span class="n">rs</span><span class="o">.</span><span class="na">append</span><span class="o">(</span><span class="s">"$"</span><span class="o">);</span>
17    <span class="n">encode_base64</span><span class="o">(</span><span class="n">rnd</span><span class="o">,</span> <span class="n">rnd</span><span class="o">.</span><span class="na">length</span><span class="o">,</span> <span class="n">rs</span><span class="o">);</span>
18    <span class="k">return</span> <span class="n">rs</span><span class="o">.</span><span class="na">toString</span><span class="o">();</span>   <span class="c1">// 总长度29字节</span>
19<span class="o">}</span>
20
21<span class="cm">/**
22 * Hash a password using the OpenBSD bcrypt scheme
23 * @param password the password to hash
24 * @param salt the salt to hash with (perhaps generated using BCrypt.gensalt)
25 * @return the hashed password
26 * @throws IllegalArgumentException if invalid salt is passed
27 */</span>
28<span class="kd">public</span> <span class="kd">static</span> <span class="n">String</span> <span class="nf">hashpw</span><span class="o">(</span><span class="n">String</span> <span class="n">password</span><span class="o">,</span> <span class="n">String</span> <span class="n">salt</span><span class="o">)</span> <span class="kd">throws</span> <span class="n">IllegalArgumentException</span> <span class="o">{</span>
29    <span class="c1">// 该函数在验证阶段也会用到，因为前29字节为盐值，所以可以将之前计算过的密码哈希值做为盐值</span>
30    <span class="n">BCrypt</span> <span class="n">B</span><span class="o">;</span>
31    <span class="n">String</span> <span class="n">real_salt</span><span class="o">;</span>
32    <span class="kt">byte</span> <span class="n">passwordb</span><span class="o">[],</span> <span class="n">saltb</span><span class="o">[],</span> <span class="n">hashed</span><span class="o">[];</span>
33    <span class="kt">char</span> <span class="n">minor</span> <span class="o">=</span> <span class="o">(</span><span class="kt">char</span><span class="o">)</span> <span class="mi">0</span><span class="o">;</span>
34    <span class="kt">int</span> <span class="n">rounds</span><span class="o">,</span> <span class="n">off</span> <span class="o">=</span> <span class="mi">0</span><span class="o">;</span>
35    <span class="n">StringBuilder</span> <span class="n">rs</span> <span class="o">=</span> <span class="k">new</span> <span class="n">StringBuilder</span><span class="o">();</span>
36
37    <span class="k">if</span> <span class="o">(</span><span class="n">salt</span> <span class="o">==</span> <span class="kc">null</span><span class="o">)</span> <span class="o">{</span>
38        <span class="k">throw</span> <span class="k">new</span> <span class="nf">IllegalArgumentException</span><span class="o">(</span><span class="s">"salt cannot be null"</span><span class="o">);</span>
39    <span class="o">}</span>
40
41    <span class="kt">int</span> <span class="n">saltLength</span> <span class="o">=</span> <span class="n">salt</span><span class="o">.</span><span class="na">length</span><span class="o">();</span>
42
43    <span class="k">if</span> <span class="o">(</span><span class="n">saltLength</span> <span class="o">&lt;</span> <span class="mi">28</span><span class="o">)</span> <span class="o">{</span>
44        <span class="k">throw</span> <span class="k">new</span> <span class="nf">IllegalArgumentException</span><span class="o">(</span><span class="s">"Invalid salt"</span><span class="o">);</span>
45    <span class="o">}</span>
46
47    <span class="k">if</span> <span class="o">(</span><span class="n">salt</span><span class="o">.</span><span class="na">charAt</span><span class="o">(</span><span class="mi">0</span><span class="o">)</span> <span class="o">!=</span> <span class="sc">'$'</span> <span class="o">||</span> <span class="n">salt</span><span class="o">.</span><span class="na">charAt</span><span class="o">(</span><span class="mi">1</span><span class="o">)</span> <span class="o">!=</span> <span class="sc">'2'</span><span class="o">)</span> <span class="o">{</span>
48        <span class="k">throw</span> <span class="k">new</span> <span class="nf">IllegalArgumentException</span><span class="o">(</span><span class="s">"Invalid salt version"</span><span class="o">);</span>
49    <span class="o">}</span>
50    <span class="k">if</span> <span class="o">(</span><span class="n">salt</span><span class="o">.</span><span class="na">charAt</span><span class="o">(</span><span class="mi">2</span><span class="o">)</span> <span class="o">==</span> <span class="sc">'$'</span><span class="o">)</span> <span class="o">{</span>
51        <span class="n">off</span> <span class="o">=</span> <span class="mi">3</span><span class="o">;</span>
52    <span class="o">}</span>
53    <span class="k">else</span> <span class="o">{</span>
54        <span class="n">minor</span> <span class="o">=</span> <span class="n">salt</span><span class="o">.</span><span class="na">charAt</span><span class="o">(</span><span class="mi">2</span><span class="o">);</span>
55        <span class="k">if</span> <span class="o">(</span><span class="n">minor</span> <span class="o">!=</span> <span class="sc">'a'</span> <span class="o">||</span> <span class="n">salt</span><span class="o">.</span><span class="na">charAt</span><span class="o">(</span><span class="mi">3</span><span class="o">)</span> <span class="o">!=</span> <span class="sc">'$'</span><span class="o">)</span> <span class="o">{</span>
56            <span class="k">throw</span> <span class="k">new</span> <span class="nf">IllegalArgumentException</span><span class="o">(</span><span class="s">"Invalid salt revision"</span><span class="o">);</span>
57        <span class="o">}</span>
58        <span class="n">off</span> <span class="o">=</span> <span class="mi">4</span><span class="o">;</span>
59    <span class="o">}</span>
60
61    <span class="k">if</span> <span class="o">(</span><span class="n">saltLength</span> <span class="o">-</span> <span class="n">off</span> <span class="o">&lt;</span> <span class="mi">25</span><span class="o">)</span> <span class="o">{</span>
62        <span class="k">throw</span> <span class="k">new</span> <span class="nf">IllegalArgumentException</span><span class="o">(</span><span class="s">"Invalid salt"</span><span class="o">);</span>
63    <span class="o">}</span>
64
65    <span class="c1">// Extract number of rounds</span>
66    <span class="k">if</span> <span class="o">(</span><span class="n">salt</span><span class="o">.</span><span class="na">charAt</span><span class="o">(</span><span class="n">off</span> <span class="o">+</span> <span class="mi">2</span><span class="o">)</span> <span class="o">&gt;</span> <span class="sc">'$'</span><span class="o">)</span> <span class="o">{</span>
67        <span class="k">throw</span> <span class="k">new</span> <span class="nf">IllegalArgumentException</span><span class="o">(</span><span class="s">"Missing salt rounds"</span><span class="o">);</span>
68    <span class="o">}</span>
69    <span class="n">rounds</span> <span class="o">=</span> <span class="n">Integer</span><span class="o">.</span><span class="na">parseInt</span><span class="o">(</span><span class="n">salt</span><span class="o">.</span><span class="na">substring</span><span class="o">(</span><span class="n">off</span><span class="o">,</span> <span class="n">off</span> <span class="o">+</span> <span class="mi">2</span><span class="o">));</span>
70
71    <span class="n">real_salt</span> <span class="o">=</span> <span class="n">salt</span><span class="o">.</span><span class="na">substring</span><span class="o">(</span><span class="n">off</span> <span class="o">+</span> <span class="mi">3</span><span class="o">,</span> <span class="n">off</span> <span class="o">+</span> <span class="mi">25</span><span class="o">);</span>
72    <span class="k">try</span> <span class="o">{</span>
73        <span class="n">passwordb</span> <span class="o">=</span> <span class="o">(</span><span class="n">password</span> <span class="o">+</span> <span class="o">(</span><span class="n">minor</span> <span class="o">&gt;=</span> <span class="sc">'a'</span> <span class="o">?</span> <span class="s">"\000"</span> <span class="o">:</span> <span class="s">""</span><span class="o">)).</span><span class="na">getBytes</span><span class="o">(</span><span class="s">"UTF-8"</span><span class="o">);</span>
74    <span class="o">}</span>
75    <span class="k">catch</span> <span class="o">(</span><span class="n">UnsupportedEncodingException</span> <span class="n">uee</span><span class="o">)</span> <span class="o">{</span>
76        <span class="k">throw</span> <span class="k">new</span> <span class="nf">AssertionError</span><span class="o">(</span><span class="s">"UTF-8 is not supported"</span><span class="o">);</span>
77    <span class="o">}</span>
78
79    <span class="c1">// 解析成16字节的字节数组</span>
80    <span class="n">saltb</span> <span class="o">=</span> <span class="n">decode_base64</span><span class="o">(</span><span class="n">real_salt</span><span class="o">,</span> <span class="n">BCRYPT_SALT_LEN</span><span class="o">);</span>
81
82    <span class="c1">// 这里new了一个新的对象是因为会用到BCrypt中int P[]和 int S[]，扩展的密钥存放在这两个结构体</span>
83    <span class="n">B</span> <span class="o">=</span> <span class="k">new</span> <span class="n">BCrypt</span><span class="o">();</span>
84    <span class="n">hashed</span> <span class="o">=</span> <span class="n">B</span><span class="o">.</span><span class="na">crypt_raw</span><span class="o">(</span><span class="n">passwordb</span><span class="o">,</span> <span class="n">saltb</span><span class="o">,</span> <span class="n">rounds</span><span class="o">);</span>
85
86    <span class="n">rs</span><span class="o">.</span><span class="na">append</span><span class="o">(</span><span class="s">"$2"</span><span class="o">);</span>
87    <span class="k">if</span> <span class="o">(</span><span class="n">minor</span> <span class="o">&gt;=</span> <span class="sc">'a'</span><span class="o">)</span> <span class="o">{</span>
88        <span class="n">rs</span><span class="o">.</span><span class="na">append</span><span class="o">(</span><span class="n">minor</span><span class="o">);</span>
89    <span class="o">}</span>
90    <span class="n">rs</span><span class="o">.</span><span class="na">append</span><span class="o">(</span><span class="s">"$"</span><span class="o">);</span>
91    <span class="k">if</span> <span class="o">(</span><span class="n">rounds</span> <span class="o">&lt;</span> <span class="mi">10</span><span class="o">)</span> <span class="o">{</span>
92        <span class="n">rs</span><span class="o">.</span><span class="na">append</span><span class="o">(</span><span class="s">"0"</span><span class="o">);</span>
93    <span class="o">}</span>
94    <span class="n">rs</span><span class="o">.</span><span class="na">append</span><span class="o">(</span><span class="n">rounds</span><span class="o">);</span>
95    <span class="n">rs</span><span class="o">.</span><span class="na">append</span><span class="o">(</span><span class="s">"$"</span><span class="o">);</span>
96    <span class="n">encode_base64</span><span class="o">(</span><span class="n">saltb</span><span class="o">,</span> <span class="n">saltb</span><span class="o">.</span><span class="na">length</span><span class="o">,</span> <span class="n">rs</span><span class="o">);</span>
97    <span class="n">encode_base64</span><span class="o">(</span><span class="n">hashed</span><span class="o">,</span> <span class="n">bf_crypt_ciphertext</span><span class="o">.</span><span class="na">length</span> <span class="o">*</span> <span class="mi">4</span> <span class="o">-</span> <span class="mi">1</span><span class="o">,</span> <span class="n">rs</span><span class="o">);</span>
98    <span class="k">return</span> <span class="n">rs</span><span class="o">.</span><span class="na">toString</span><span class="o">();</span>
99<span class="o">}</span>
100
101<span class="cm">/**
102 * Perform the central password hashing step in the bcrypt scheme
103 * @param password the password to hash
104 * @param salt the binary salt to hash with the password
105 * @param log_rounds the binary logarithm of the number of rounds of hashing to apply
106 * @return an array containing the binary hashed password
107 */</span>
108<span class="kd">private</span> <span class="kt">byte</span><span class="o">[]</span> <span class="nf">crypt_raw</span><span class="o">(</span><span class="kt">byte</span> <span class="n">password</span><span class="o">[],</span> <span class="kt">byte</span> <span class="n">salt</span><span class="o">[],</span> <span class="kt">int</span> <span class="n">log_rounds</span><span class="o">)</span> <span class="o">{</span>
109    <span class="kt">int</span> <span class="n">cdata</span><span class="o">[]</span> <span class="o">=</span> <span class="o">(</span><span class="kt">int</span><span class="o">[])</span> <span class="n">bf_crypt_ciphertext</span><span class="o">.</span><span class="na">clone</span><span class="o">();</span>
110    <span class="kt">int</span> <span class="n">clen</span> <span class="o">=</span> <span class="n">cdata</span><span class="o">.</span><span class="na">length</span><span class="o">;</span>
111    <span class="kt">byte</span> <span class="n">ret</span><span class="o">[];</span>
112
113    <span class="c1">// rounds = 1 &lt;&lt; log_round</span>
114    <span class="kt">long</span> <span class="n">rounds</span> <span class="o">=</span> <span class="n">roundsForLogRounds</span><span class="o">(</span><span class="n">log_rounds</span><span class="o">);</span>
115
116    <span class="n">init_key</span><span class="o">();</span>
117    <span class="n">ekskey</span><span class="o">(</span><span class="n">salt</span><span class="o">,</span> <span class="n">password</span><span class="o">);</span>
118    <span class="k">for</span> <span class="o">(</span><span class="kt">long</span> <span class="n">i</span> <span class="o">=</span> <span class="mi">0</span><span class="o">;</span> <span class="n">i</span> <span class="o">&lt;</span> <span class="n">rounds</span><span class="o">;</span> <span class="n">i</span><span class="o">++)</span> <span class="o">{</span> <span class="c1">// 最耗时的密钥扩展</span>
119        <span class="n">key</span><span class="o">(</span><span class="n">password</span><span class="o">);</span>
120        <span class="n">key</span><span class="o">(</span><span class="n">salt</span><span class="o">);</span>
121    <span class="o">}</span>
122
123    <span class="k">for</span> <span class="o">(</span><span class="kt">int</span> <span class="n">i</span> <span class="o">=</span> <span class="mi">0</span><span class="o">;</span> <span class="n">i</span> <span class="o">&lt;</span> <span class="mi">64</span><span class="o">;</span> <span class="n">i</span><span class="o">++)</span> <span class="o">{</span>
124        <span class="k">for</span> <span class="o">(</span><span class="kt">int</span> <span class="n">j</span> <span class="o">=</span> <span class="mi">0</span><span class="o">;</span> <span class="n">j</span> <span class="o">&lt;</span> <span class="o">(</span><span class="n">clen</span> <span class="o">&gt;&gt;</span> <span class="mi">1</span><span class="o">);</span> <span class="n">j</span><span class="o">++)</span> <span class="o">{</span>
125            <span class="n">encipher</span><span class="o">(</span><span class="n">cdata</span><span class="o">,</span> <span class="n">j</span> <span class="o">&lt;&lt;</span> <span class="mi">1</span><span class="o">);</span>
126        <span class="o">}</span>
127    <span class="o">}</span>
128
129    <span class="n">ret</span> <span class="o">=</span> <span class="k">new</span> <span class="kt">byte</span><span class="o">[</span><span class="n">clen</span> <span class="o">*</span> <span class="mi">4</span><span class="o">];</span>
130    <span class="k">for</span> <span class="o">(</span><span class="kt">int</span> <span class="n">i</span> <span class="o">=</span> <span class="mi">0</span><span class="o">,</span> <span class="n">j</span> <span class="o">=</span> <span class="mi">0</span><span class="o">;</span> <span class="n">i</span> <span class="o">&lt;</span> <span class="n">clen</span><span class="o">;</span> <span class="n">i</span><span class="o">++)</span> <span class="o">{</span>
131        <span class="n">ret</span><span class="o">[</span><span class="n">j</span><span class="o">++]</span> <span class="o">=</span> <span class="o">(</span><span class="kt">byte</span><span class="o">)</span> <span class="o">((</span><span class="n">cdata</span><span class="o">[</span><span class="n">i</span><span class="o">]</span> <span class="o">&gt;&gt;</span> <span class="mi">24</span><span class="o">)</span> <span class="o">&amp;</span> <span class="mh">0xff</span><span class="o">);</span>
132        <span class="n">ret</span><span class="o">[</span><span class="n">j</span><span class="o">++]</span> <span class="o">=</span> <span class="o">(</span><span class="kt">byte</span><span class="o">)</span> <span class="o">((</span><span class="n">cdata</span><span class="o">[</span><span class="n">i</span><span class="o">]</span> <span class="o">&gt;&gt;</span> <span class="mi">16</span><span class="o">)</span> <span class="o">&amp;</span> <span class="mh">0xff</span><span class="o">);</span>
133        <span class="n">ret</span><span class="o">[</span><span class="n">j</span><span class="o">++]</span> <span class="o">=</span> <span class="o">(</span><span class="kt">byte</span><span class="o">)</span> <span class="o">((</span><span class="n">cdata</span><span class="o">[</span><span class="n">i</span><span class="o">]</span> <span class="o">&gt;&gt;</span> <span class="mi">8</span><span class="o">)</span> <span class="o">&amp;</span> <span class="mh">0xff</span><span class="o">);</span>
134        <span class="n">ret</span><span class="o">[</span><span class="n">j</span><span class="o">++]</span> <span class="o">=</span> <span class="o">(</span><span class="kt">byte</span><span class="o">)</span> <span class="o">(</span><span class="n">cdata</span><span class="o">[</span><span class="n">i</span><span class="o">]</span> <span class="o">&amp;</span> <span class="mh">0xff</span><span class="o">);</span>
135    <span class="o">}</span>
136    <span class="k">return</span> <span class="n">ret</span><span class="o">;</span>
137<span class="o">}</span>
138
139<span class="cm">/**
140 * Check that a plaintext password matches a previously hashed one
141 * @param plaintext the plaintext password to verify
142 * @param hashed the previously-hashed password
143 * @return true if the passwords match, false otherwise
144 */</span>
145<span class="kd">public</span> <span class="kd">static</span> <span class="kt">boolean</span> <span class="nf">checkpw</span><span class="o">(</span><span class="n">String</span> <span class="n">plaintext</span><span class="o">,</span> <span class="n">String</span> <span class="n">hashed</span><span class="o">)</span> <span class="o">{</span>
146    <span class="k">return</span> <span class="nf">equalsNoEarlyReturn</span><span class="o">(</span><span class="n">hashed</span><span class="o">,</span> <span class="n">hashpw</span><span class="o">(</span><span class="n">plaintext</span><span class="o">,</span> <span class="n">hashed</span><span class="o">));</span>
147<span class="o">}</span>
148
149<span class="kd">static</span> <span class="kt">boolean</span> <span class="nf">equalsNoEarlyReturn</span><span class="o">(</span><span class="n">String</span> <span class="n">a</span><span class="o">,</span> <span class="n">String</span> <span class="n">b</span><span class="o">)</span> <span class="o">{</span>
150    <span class="kt">char</span><span class="o">[]</span> <span class="n">caa</span> <span class="o">=</span> <span class="n">a</span><span class="o">.</span><span class="na">toCharArray</span><span class="o">();</span>
151    <span class="kt">char</span><span class="o">[]</span> <span class="n">cab</span> <span class="o">=</span> <span class="n">b</span><span class="o">.</span><span class="na">toCharArray</span><span class="o">();</span>
152
153    <span class="k">if</span> <span class="o">(</span><span class="n">caa</span><span class="o">.</span><span class="na">length</span> <span class="o">!=</span> <span class="n">cab</span><span class="o">.</span><span class="na">length</span><span class="o">)</span> <span class="o">{</span>
154        <span class="k">return</span> <span class="kc">false</span><span class="o">;</span>
155    <span class="o">}</span>
156
157    <span class="kt">byte</span> <span class="n">ret</span> <span class="o">=</span> <span class="mi">0</span><span class="o">;</span>
158    <span class="k">for</span> <span class="o">(</span><span class="kt">int</span> <span class="n">i</span> <span class="o">=</span> <span class="mi">0</span><span class="o">;</span> <span class="n">i</span> <span class="o">&lt;</span> <span class="n">caa</span><span class="o">.</span><span class="na">length</span><span class="o">;</span> <span class="n">i</span><span class="o">++)</span> <span class="o">{</span>
159        <span class="n">ret</span> <span class="o">|=</span> <span class="n">caa</span><span class="o">[</span><span class="n">i</span><span class="o">]</span> <span class="o">^</span> <span class="n">cab</span><span class="o">[</span><span class="n">i</span><span class="o">];</span>
160    <span class="o">}</span>
161    <span class="k">return</span> <span class="n">ret</span> <span class="o">==</span> <span class="mi">0</span><span class="o">;</span>
162<span class="o">}</span>

} </code></pre></div></div>

性能 慢哈希既要防止攻击者无法使用暴力破击，又不能影响用户体验，由于机器性能的差异，获取强度参数最好的办法就是执行一个简短的性能基准测试，找到使哈希函数大约耗费0.5秒的值。 <div class="language-java highlighter-rouge"><div class="highlight"><pre class="highlight"><code>public class BCryptBench { public static void main(String\[\] args) { long startTime, endTime, duration;

1    <span class="c1">// the default strength 10</span>
2    <span class="n">BCryptPasswordEncoder</span> <span class="n">bCryptPasswordEncoder10</span> <span class="o">=</span> <span class="k">new</span> <span class="n">BCryptPasswordEncoder</span><span class="o">();</span>
3    <span class="n">duration</span> <span class="o">=</span> <span class="mi">0</span><span class="o">;</span>
4
5    <span class="k">for</span> <span class="o">(</span><span class="kt">int</span> <span class="n">i</span> <span class="o">=</span> <span class="mi">0</span><span class="o">;</span> <span class="n">i</span> <span class="o">&lt;</span> <span class="mi">10</span><span class="o">;</span> <span class="n">i</span><span class="o">++)</span> <span class="o">{</span>
6        <span class="n">startTime</span> <span class="o">=</span> <span class="n">System</span><span class="o">.</span><span class="na">currentTimeMillis</span><span class="o">();</span>
7        <span class="n">System</span><span class="o">.</span><span class="na">out</span><span class="o">.</span><span class="na">println</span><span class="o">(</span><span class="n">bCryptPasswordEncoder10</span><span class="o">.</span><span class="na">encode</span><span class="o">(</span><span class="s">"admin"</span><span class="o">));</span>
8        <span class="n">endTime</span> <span class="o">=</span> <span class="n">System</span><span class="o">.</span><span class="na">currentTimeMillis</span><span class="o">();</span>
9        <span class="n">duration</span> <span class="o">+=</span> <span class="o">(</span><span class="n">endTime</span> <span class="o">-</span> <span class="n">startTime</span><span class="o">);</span>
10    <span class="o">}</span>
11
12    <span class="n">System</span><span class="o">.</span><span class="na">out</span><span class="o">.</span><span class="na">println</span><span class="o">(</span><span class="n">duration</span> <span class="o">/</span> <span class="mf">10.0</span><span class="o">);</span>    <span class="c1">// 88.4ms</span>
13
14    <span class="c1">// strength 11</span>
15    <span class="c1">// the default strength 10</span>
16    <span class="n">BCryptPasswordEncoder</span> <span class="n">bCryptPasswordEncoder11</span> <span class="o">=</span> <span class="k">new</span> <span class="n">BCryptPasswordEncoder</span><span class="o">(</span><span class="mi">11</span><span class="o">);</span>
17    <span class="n">duration</span> <span class="o">=</span> <span class="mi">0</span><span class="o">;</span>
18
19    <span class="k">for</span> <span class="o">(</span><span class="kt">int</span> <span class="n">i</span> <span class="o">=</span> <span class="mi">0</span><span class="o">;</span> <span class="n">i</span> <span class="o">&lt;</span> <span class="mi">10</span><span class="o">;</span> <span class="n">i</span><span class="o">++)</span> <span class="o">{</span>
20        <span class="n">startTime</span> <span class="o">=</span> <span class="n">System</span><span class="o">.</span><span class="na">currentTimeMillis</span><span class="o">();</span>
21        <span class="n">System</span><span class="o">.</span><span class="na">out</span><span class="o">.</span><span class="na">println</span><span class="o">(</span><span class="n">bCryptPasswordEncoder11</span><span class="o">.</span><span class="na">encode</span><span class="o">(</span><span class="s">"admin"</span><span class="o">));</span>
22        <span class="n">endTime</span> <span class="o">=</span> <span class="n">System</span><span class="o">.</span><span class="na">currentTimeMillis</span><span class="o">();</span>
23        <span class="n">duration</span> <span class="o">+=</span> <span class="o">(</span><span class="n">endTime</span> <span class="o">-</span> <span class="n">startTime</span><span class="o">);</span>
24    <span class="o">}</span>
25
26    <span class="n">System</span><span class="o">.</span><span class="na">out</span><span class="o">.</span><span class="na">println</span><span class="o">(</span><span class="n">duration</span> <span class="o">/</span> <span class="mf">10.0</span><span class="o">);</span>    <span class="c1">// 175.3ms</span>
27
28    <span class="c1">// strength 12</span>
29    <span class="n">BCryptPasswordEncoder</span> <span class="n">bCryptPasswordEncoder12</span> <span class="o">=</span> <span class="k">new</span> <span class="n">BCryptPasswordEncoder</span><span class="o">(</span><span class="mi">12</span><span class="o">);</span>
30    <span class="n">duration</span> <span class="o">=</span> <span class="mi">0</span><span class="o">;</span>
31
32    <span class="k">for</span> <span class="o">(</span><span class="kt">int</span> <span class="n">i</span> <span class="o">=</span> <span class="mi">0</span><span class="o">;</span> <span class="n">i</span> <span class="o">&lt;</span> <span class="mi">10</span><span class="o">;</span> <span class="n">i</span><span class="o">++)</span> <span class="o">{</span>
33        <span class="n">startTime</span> <span class="o">=</span> <span class="n">System</span><span class="o">.</span><span class="na">currentTimeMillis</span><span class="o">();</span>
34        <span class="n">System</span><span class="o">.</span><span class="na">out</span><span class="o">.</span><span class="na">println</span><span class="o">(</span><span class="n">bCryptPasswordEncoder12</span><span class="o">.</span><span class="na">encode</span><span class="o">(</span><span class="s">"admin"</span><span class="o">));</span>
35        <span class="n">endTime</span> <span class="o">=</span> <span class="n">System</span><span class="o">.</span><span class="na">currentTimeMillis</span><span class="o">();</span>
36        <span class="n">duration</span> <span class="o">+=</span> <span class="o">(</span><span class="n">endTime</span> <span class="o">-</span> <span class="n">startTime</span><span class="o">);</span>
37    <span class="o">}</span>
38
39    <span class="n">System</span><span class="o">.</span><span class="na">out</span><span class="o">.</span><span class="na">println</span><span class="o">(</span> <span class="n">duration</span> <span class="o">/</span> <span class="mf">10.0</span><span class="o">);</span>   <span class="c1">// 344.3ms</span>
40
41    <span class="c1">// strength 13</span>
42    <span class="n">BCryptPasswordEncoder</span> <span class="n">bCryptPasswordEncoder13</span> <span class="o">=</span> <span class="k">new</span> <span class="n">BCryptPasswordEncoder</span><span class="o">(</span><span class="mi">13</span><span class="o">);</span>
43    <span class="n">duration</span> <span class="o">=</span> <span class="mi">0</span><span class="o">;</span>
44
45    <span class="k">for</span> <span class="o">(</span><span class="kt">int</span> <span class="n">i</span> <span class="o">=</span> <span class="mi">0</span><span class="o">;</span> <span class="n">i</span> <span class="o">&lt;</span> <span class="mi">10</span><span class="o">;</span> <span class="n">i</span><span class="o">++)</span> <span class="o">{</span>
46        <span class="n">startTime</span> <span class="o">=</span> <span class="n">System</span><span class="o">.</span><span class="na">currentTimeMillis</span><span class="o">();</span>
47        <span class="n">System</span><span class="o">.</span><span class="na">out</span><span class="o">.</span><span class="na">println</span><span class="o">(</span><span class="n">bCryptPasswordEncoder13</span><span class="o">.</span><span class="na">encode</span><span class="o">(</span><span class="s">"admin"</span><span class="o">));</span>
48        <span class="n">endTime</span> <span class="o">=</span> <span class="n">System</span><span class="o">.</span><span class="na">currentTimeMillis</span><span class="o">();</span>
49        <span class="n">duration</span> <span class="o">+=</span> <span class="o">(</span><span class="n">endTime</span> <span class="o">-</span> <span class="n">startTime</span><span class="o">);</span>
50    <span class="o">}</span>
51
52    <span class="n">System</span><span class="o">.</span><span class="na">out</span><span class="o">.</span><span class="na">println</span><span class="o">(</span><span class="n">duration</span> <span class="o">/</span> <span class="mf">10.0</span><span class="o">);</span>    <span class="c1">// 703.8ms</span>
53
54    <span class="c1">// strength 14</span>
55    <span class="n">BCryptPasswordEncoder</span> <span class="n">bCryptPasswordEncoder14</span> <span class="o">=</span> <span class="k">new</span> <span class="n">BCryptPasswordEncoder</span><span class="o">(</span><span class="mi">14</span><span class="o">);</span>
56    <span class="n">duration</span> <span class="o">=</span> <span class="mi">0</span><span class="o">;</span>
57
58    <span class="k">for</span> <span class="o">(</span><span class="kt">int</span> <span class="n">i</span> <span class="o">=</span> <span class="mi">0</span><span class="o">;</span> <span class="n">i</span> <span class="o">&lt;</span> <span class="mi">10</span><span class="o">;</span> <span class="n">i</span><span class="o">++)</span> <span class="o">{</span>
59        <span class="n">startTime</span> <span class="o">=</span> <span class="n">System</span><span class="o">.</span><span class="na">currentTimeMillis</span><span class="o">();</span>
60        <span class="n">System</span><span class="o">.</span><span class="na">out</span><span class="o">.</span><span class="na">println</span><span class="o">(</span><span class="n">bCryptPasswordEncoder14</span><span class="o">.</span><span class="na">encode</span><span class="o">(</span><span class="s">"admin"</span><span class="o">));</span>
61        <span class="n">endTime</span> <span class="o">=</span> <span class="n">System</span><span class="o">.</span><span class="na">currentTimeMillis</span><span class="o">();</span>
62        <span class="n">duration</span> <span class="o">+=</span> <span class="o">(</span><span class="n">endTime</span> <span class="o">-</span> <span class="n">startTime</span><span class="o">);</span>
63    <span class="o">}</span>
64
65    <span class="n">System</span><span class="o">.</span><span class="na">out</span><span class="o">.</span><span class="na">println</span><span class="o">(</span><span class="n">duration</span> <span class="o">/</span> <span class="mf">10.0</span><span class="o">);</span>    <span class="c1">// 1525.0ms</span>
66
67    <span class="c1">// strength 15</span>
68    <span class="n">BCryptPasswordEncoder</span> <span class="n">bCryptPasswordEncoder15</span> <span class="o">=</span> <span class="k">new</span> <span class="n">BCryptPasswordEncoder</span><span class="o">(</span><span class="mi">15</span><span class="o">);</span>
69    <span class="n">duration</span> <span class="o">=</span> <span class="mi">0</span><span class="o">;</span>
70
71    <span class="k">for</span> <span class="o">(</span><span class="kt">int</span> <span class="n">i</span> <span class="o">=</span> <span class="mi">0</span><span class="o">;</span> <span class="n">i</span> <span class="o">&lt;</span> <span class="mi">10</span><span class="o">;</span> <span class="n">i</span><span class="o">++)</span> <span class="o">{</span>
72        <span class="n">startTime</span> <span class="o">=</span> <span class="n">System</span><span class="o">.</span><span class="na">currentTimeMillis</span><span class="o">();</span>
73        <span class="n">System</span><span class="o">.</span><span class="na">out</span><span class="o">.</span><span class="na">println</span><span class="o">(</span><span class="n">bCryptPasswordEncoder15</span><span class="o">.</span><span class="na">encode</span><span class="o">(</span><span class="s">"admin"</span><span class="o">));</span>
74        <span class="n">endTime</span> <span class="o">=</span> <span class="n">System</span><span class="o">.</span><span class="na">currentTimeMillis</span><span class="o">();</span>
75        <span class="n">duration</span> <span class="o">+=</span> <span class="o">(</span><span class="n">endTime</span> <span class="o">-</span> <span class="n">startTime</span><span class="o">);</span>
76    <span class="o">}</span>
77
78    <span class="n">System</span><span class="o">.</span><span class="na">out</span><span class="o">.</span><span class="na">println</span><span class="o">(</span><span class="n">duration</span> <span class="o">/</span> <span class="mf">10.0</span><span class="o">);</span>    <span class="c1">// 2921.9ms</span>
79<span class="o">}</span>

} </code></pre></div></div>

从测试的结果可以看出，如果想选定一个执行时间为0.5秒的慢哈希，需要将Bcrypt函数的强度设置为12或13。而在我们自己的微服务中，使用了默认的强度10。 Reference: 1 <a href="https://crackstation.net/hashing-security.htm">Salted Password Hashing - Doing it Right</a> 2 <a href="http://blog.jobbole.com/61872/">Salted Password Hashing - Doing it Right 译文</a> 原文地址：https://zhjwpku.com/2017/11/30/bcrypt-in-spring-security.html </div>

Spring Security 中的 Bcrypt

评论区

相关推荐