What built-in Java hash function to use for password

Question

I'm working on a school project making a java program including a login/subscribe form.

Because it's for school I'm not supposed to include any third-party library like jBcrypt or other strong hashing function. I think about generating one salt per user with a sha256 of java.security.random but I don't know what hashing function to use for the password. I don't want to use only one iteration of a sha256/512 as it's a bit weak and I also don't want to make a for loop with 100 iteration of a sha256/512 as I guess if bcrypt and others exist it''s because iterating sha isn't enough (and also because I know it's always a bad idea to try reinventing cryptography by yourself).

So what built-in hashing function should I use to store my password ?

NB. I know that in this case (school project) the login data don't deserve a very good security (and it's also not required by my subject) but I want to do it as good as possible so please don't answer that a md5/sha512 hash would be enough for such a situation.

http://stackoverflow.com/questions/10012918/pbe-verify-password-before-attempting-to-decrypt — Sotirios Delimanolis, Jun 05 '13 at 17:25
Use the unoffical stackoverflow search engine to search existing stack overflow question. The url is www.google.com — DwB, Jun 05 '13 at 17:34

score 1 · Answer 1 · answered Jun 05 '13 at 17:37

I suggest that you study how to use SHA256 and 512 for passwords, with some care about salting.

See e.g. http://www.jasypt.org/howtoencryptuserpasswords.html

Section "6. Doing it in Java" describes the Java methods you could use to implement the algorithm if you do not want to use an external library.

Good luck!

score 0 · Answer 2 · answered Jun 05 '13 at 17:39

0

Use PBKDF2WithHmacSHA1 with as many iterations as the user is willing to wait for. I would suggest 10,000.

This is pertinent: http://en.wikipedia.org/wiki/PBKDF2#BlackBerry_vulnerability

answered Jun 05 '13 at 17:39

Sarel Botha

12,419
7
54
59

What built-in Java hash function to use for password

2 Answers2