issue-link js-issue-link notranslate" rel="noopener noreferrer nofollow" href="https://issues.apache.org/jira/browse/SHIRO-290">SHIRO-290] WIP: Implement Unix crypt format, starting with bcrypt. - TBD: HashRequest - TBD: PasswortMatcher doesn’t know about the new hash format yet [SHIRO-290] Rework to use existing Shiro1CryptFormat. - Hashes can now compare themselves to a given password. Reviwers: Review method placement and HAsh class description. - removed hashrequest - removed UnixCryptFormat - API change: made salt not-nullable. Additional constructor is supplied for hashing without or with default salt, the former and other methods/fields using SimpleByteSource.empty(). Reviewers: Pay attention to method logic, so no empty salt is being used where a former `null` value would have created a new, random salt. - Modified tests to not expect exceptions in certain cases. - Modified tests to not expect passwordService calls when supplying an existing hash. - TBD: Fix Javadocs - TBD: Fix Hasher utility - TBD: Deprecate old non-KDF hash classes [SHIRO-290] Prepare argon2 implementation. - BCrypt iterations vs cost: make iterations return iterations - add validate methods [SHIRO-290] Implement Argon2Hash.java. - expand iterations field to take a comma separated list. Maybe just create a Shiro2CryptFormat instead? - Hex and Base64 formats are not fixed. Maybe we can drop them? - Fixed parameter "algorithm name" not taken into account for bcrypt. - Allow Hasher to read from stdin - Added a short test for Hasher.java. - Changed default DefaultPasswordService.java algorithm to "Argon2id". [SHIRO-290] Implement Shiro2CryptFormat.java. - Only fields 1 and two are defined, rest is defined by the hash implementation - Therefore fully backwards-compatible to Shiro1CryptFormat.java. - Loads formats from ProvidedKdfHashes.java. We could also think of a pluggable mechanism, like using service loaders to hide classes like OpenBSDBase64. - In AbstractCryptHash.java, renamed `version` to `algorithmName`. - Removed iterations from AbstractCryptHash.java, they are possibly an implementation detail not present in other implementations (like bcrypt). - Signature change: `PasswordService.encryptPassword(Object plaintext)` will now throw a NullPointerException on `null` parameter. It was never specified how this method would behave. [SHIRO-290] Add hasher tests - fix invalid cost factor for bcrypt when input is 0. - output Hasher messages using slf4j. [SHIRO-290] ServiceLoadable KDF algorithms. - Move BCrypt and Argon2 into their own modules - Add a SPI - Remove hardcoded parameters, replace with ParameterMap for the hashRequest [SHIRO-290] implemented review comments - remove at least MD2, MD5 and Sha1 - Remove unused support-hashes module - changed group and artifact-ids for new modules - fixed compilation issue in Hasher (needs more work though) - add "since 2.0" comments [SHIRO-290] add some javadoc, make implementation classes package-private. [SHIRO-290] doc updates

Commits

Commits on May 10, 2021

[SHIRO-290] Implement BCrypt and Argon2

[SHIRO-290] doc fix, remove backwards compatibility for SimpleHash.

[SHIRO-290] add review suggestions:

Commits on May 12, 2021

[SHIRO-290] remove obsolete legacy-tests.

[SHIRO-290 ] Implement BCrypt and Argon2

[SHIRO-290 ] doc fix, remove backwards compatibility for SimpleHash.

[SHIRO-290 ] add review suggestions:

[SHIRO-290 ] remove obsolete legacy-tests.