0

We are trying to hash user password using MD5 algorithm, following is our sample code:

import java.security.MessageDigest;

public class EncodingUtil {
    private static MessageDigest digester = MessageDigest.getInstance("MD5");

    public static String hashPassword(String input) {
        if (digester != null) {
            digester.reset();
            digester.update(input.getBytes());
            byte[] messageDigest = digester.digest();
            StringBuffer hexString = new StringBuffer();
            for (byte element : messageDigest) {
                hexString.append(Integer.toHexString(0xFF & element));
            }
            return hexString.toString();
        }
        return input;
    }
}

But we are getting following error during concurrency test (5 simultaneous users):

java.lang.ArrayIndexOutOfBoundsException
    at com.ibm.crypto.provider.MD5.engineUpdate(Unknown Source)
    at java.security.MessageDigest$Delegate.engineUpdate(MessageDigest.java:595)
    at java.security.MessageDigest.update(MessageDigest.java:346)

So we are getting this error in the following line of code:

digester.update(input.getBytes());

So basically we are using java.security.MessageDigest.update(), which is a SPI and the concrete implementation in WebSphere is com.ibm.crypto.provider.MD5.engineUpdate, where we are having this ArrayIndexOutOfBoundsException.

We are running our application in IBM Websphere 8.5 and Java 8. I tried to find if IBM has any issues related to this [com.ibm.crypto.provider.MD5.engineUpdate()], but not able to find any details. Also not able to find any solution for fixing or getting around this issue.

Rajib Biswas
  • 772
  • 10
  • 27
  • 3
    `MessageDigest` [isn't thread safe](https://stackoverflow.com/questions/17554998/need-thread-safe-messagedigest-in-java) - you can't share a single static instance amongst your threads. Create a new instance for each thread. – StuartLC Jul 24 '18 at 04:49
  • @StuartLC, Thanks fr your suggestion. I will try to move the class level initialization of MessageDigest to method level and see if the issue gets resolved or not. – Rajib Biswas Jul 24 '18 at 05:20
  • 1
    This could be a fairly rare use case for a [lazy initialized thread local](http://www.baeldung.com/java-threadlocal) `MessageDigest` – StuartLC Jul 24 '18 at 05:58

0 Answers0