Comparing two digested md5 strings returns false

Question

I have two md5 hash password that are the same and should return true using the MessageDigest.isEqual method. However the comparison returns false.

When using Array.toString to print the byte-Arrays, they are identical. It still doesn't work, neither for Arrays.euqals nor for MessageDigest.isEqual.

public boolean verifyUserCredentials(String username, MessageDigest password) {

        ListIterator<User> iterator = userList.listIterator();
        while (iterator.hasNext()) {
            User user = iterator.next();
            byte md1[] = user.getPassword().digest();
            byte md2[] = password.digest();
            if (user.getUsername() == username && MessageDigest.isEqual(md1, md2)) {
                return true;
            } 
        }
        return false;
    }

I don't think your problem has anything to do with comparing md5s. It's the username you're bungling. — Hot Licks, May 08 '13 at 23:55
I have been doing that same mistake for so many times. Thanks for the input. — mgrstnr, May 09 '13 at 06:31

score 5 · Accepted Answer · answered May 08 '13 at 23:41

5

You have used ==, but for objects like String it compares object references to see if they refer to the same object.

To compare String values, use String#equals instead.

answered May 08 '13 at 23:41

rgettman

176,041
30
275
357

score 0 · Answer 2 · answered May 09 '13 at 01:01

Alternatively you could take an Evil approach and abuse string interning:

user.getUsername().intern() == username.intern()

the following code prints:

String s1 = "asdf";
String s2 = "as"; // break this into two parts to keep the compiler from 
s2 = s2 + "df";   // automatically interning the constant and having the strings
                  // be the same. 

System.out.println( s1 == s2 ? "true" : "false");
System.out.println( s1.intern() == s2.intern() ? "true" : "false");

Output:

false
true

the +"df" is needed to keep the compiler from automatically interning the constant string.

Note: This is more Java Trivia and Language Abuse than something I would suggest you actually do.

Comparing two digested md5 strings returns false

2 Answers2