Java: how to write/read encrypted password in/from a file

Question

In my application there are some operations which are allowed only by entering a password by authorized users. So I need to store an encrypted password in a file and then, after when required, read the encrypted password and compare it with the one entered. I have never done anything similar before and I need the simplest way to do it. Here I have found this tutorial but then I have seen that it is much better not to use sun.misc.BASE64Decoder/Encoder. Can you help?

Base64 won't encrypt anything indeed. You probably want to use a hash, like SHA1 or SHA256. — fge, Jan 09 '15 at 15:42
You can google about how to work with property files in java. — Naman Gala, Jan 09 '15 at 15:46

score 3 · Accepted Answer · answered Jan 09 '15 at 15:44

3

Instead of storing password you can store it's hash. In order to compare it with another password you should compare the hashes, not the real passwords. The easy way to make hashes (with salt) would be using MessageDigest:

public byte[] makeDigest(String value, byte[] salt) throws NoSuchAlgorithmException {
    MessageDigest md = MessageDigest.getInstance("SHA-256");
    md.update(salt);
    return md.digest(value.getBytes());
}

You can make a digest of the password, then store resulting byte array (and salt) in the file. Then use this method (and original salt) to make a digest from the second password. And at last just compare two byte arrays with Arrays.equals

answered Jan 09 '15 at 15:44

nogard

9,432
6
33
53

2

Totally agree. That way you can skip the decoding! – wassgren Jan 09 '15 at 15:44
This seems to be very useful and good. I will have a trial at once. A question: would you please tell me why it is bad to use sun.misc.BASE64Decoder/Encoder? – SagittariusA Jan 09 '15 at 15:49
2

One reason is [this](http://stackoverflow.com/questions/2267036/work-sun-misc-base64encoder-decoder-for-getting-byte). Another one is that if you can decrypt a password it is simply not safe. Password encryption should be one-way. – wassgren Jan 09 '15 at 15:51

Clau St · Answer 2 · 2021-02-19T10:15:34.417

2

I think you can also:

salt+hash (eg: sha256) the password before storing it, also save the salt. Random generated salt is better.
Use saved salts + rehash the password which the user input-ed.
Just plain compare them. If they match, you give access to the user

edited Feb 19 '21 at 10:15

answered Jan 09 '15 at 15:48

Clau St

970
9
14

score 0 · Answer 3 · edited May 23 '17 at 11:45

0

Have a look here: Encrypt Password in Configuration Files? and perhaps here: https://crackstation.net/hashing-security.htm

edited May 23 '17 at 11:45

Community

1
1

answered Jan 09 '15 at 15:42

Augustin

2,444
23
24

Thanks but that link is the one I was talking about. It uses sun.misc.BASE64Decoder/Encoder which is said to be bad to use...I don't know why. – SagittariusA Jan 09 '15 at 15:44
1

Sorry, I haven't noticed that. What about this library then: http://www.jasypt.org/ – Augustin Jan 09 '15 at 15:46
1

@Lory: Base64 encoding is data representation, not encryption – fmgp Jan 09 '15 at 15:46
@Augustin: I had noticed that library but I couldn't find a simple tutorial. Do you have one to link? – SagittariusA Jan 09 '15 at 15:52
I found this to be quite understandable: http://blog.sortedset.com/how-to-encrypt-decrypt-a-password-stored-in-a-properties-file-with-java-jasypt-apache-commons-configuration/ – Augustin Jan 09 '15 at 15:56

Java: how to write/read encrypted password in/from a file

3 Answers3