0

Is there a way to decrypt a PBKDF2 generated password? I have use the implementation of PBKDF2 algorithm as PBKDF2WithHmacSHA1.

I get the password: test_90 and then I encrypt that password. After that I want to decrypt the encripted password for getting again test_90.

I want to decrypt the passwordEncrypted for obtain the original password.

import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.PBEKeySpec;
import java.math.BigInteger;
import java.security.NoSuchAlgorithmException;
import java.security.SecureRandom;
import java.security.spec.InvalidKeySpecException;


public class Test {


 private static byte[] fromHex(String hex) throws NoSuchAlgorithmException
    {
        byte[] bytes = new byte[hex.length() / 2];
        for(int i = 0; i<bytes.length ;i++)
        {
            bytes[i] = (byte)Integer.parseInt(hex.substring(2 * i, 2 * i + 2), 16);
        }
        return bytes;
    }

private static byte[] getSalt() throws NoSuchAlgorithmException
{
    SecureRandom sr = SecureRandom.getInstance("SHA1PRNG");
    byte[] salt = new byte[16];
    sr.nextBytes(salt);
    return salt;
}

private static String toHex(byte[] array) throws NoSuchAlgorithmException
{
    BigInteger bi = new BigInteger(1, array);
    String hex = bi.toString(16);
    int paddingLength = (array.length * 2) - hex.length();
    if(paddingLength > 0)
    {
        return String.format("%0"  +paddingLength + "d", 0) + hex;
    }else{
        return hex;
    }
}


private static String generateStrongPasswordHash(String password) throws NoSuchAlgorithmException, InvalidKeySpecException {
    int iterations = 50;
    char[] chars = password.toCharArray();
    byte[]salt = getSalt();

    PBEKeySpec spec = new PBEKeySpec(chars, salt, iterations, 64 * 8);
    SecretKeyFactory skf = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1");
    byte[] hash = skf.generateSecret(spec).getEncoded();
    return iterations + ":" + toHex(salt) + ":" + toHex(hash);
}



private static boolean validatePassword(String originalPassword, String storedPassword) throws NoSuchAlgorithmException, InvalidKeySpecException
{
    String[] parts = storedPassword.split(":");
    int iterations = Integer.parseInt(parts[0]);
    byte[] salt = fromHex(parts[1]);
    byte[] hash = fromHex(parts[2]);

    PBEKeySpec spec = new PBEKeySpec(originalPassword.toCharArray(), salt, iterations, hash.length * 8);
    SecretKeyFactory skf = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1");
    byte[] testHash = skf.generateSecret(spec).getEncoded();

    int diff = hash.length ^ testHash.length;
    for(int i = 0; i < hash.length && i < testHash.length; i++)
    {
        diff |= hash[i] ^ testHash[i];
    }
    return diff == 0;
}

public static void main(String[] args) throws NoSuchAlgorithmException, InvalidKeySpecException {

    final String password = "test_90";
    System.out.println("Thats your password: " + password);

    System.out.println("--------------ENCRYPTION-----------");

    final String passwordEncrypted = generateStrongPasswordHash(password);

    System.out.println(passwordEncrypted);
    System.out.println();
    System.out.println("--------------VALIDATION-----------");

    boolean matched = validatePassword(password, passwordEncrypted);

    if(matched) {
        System.out.println("OK: the encrypted password matches the initial one: " + password);
        System.out.println();
    }

    final String password2 = "test_50";
    boolean matched2 = validatePassword(password2,passwordEncrypted);

    if (!matched2) {
        System.out.println("ERROR: the encrypted password doesnt match the initial one " + password2);
        System.out.println();
    }

    System.out.println("-------------DECRYPT PASSWORD---------");

}

}

proera
  • 123
  • 1
  • 3
  • 14
  • No. Use password crackers. – kelalaka Jan 17 '20 at 10:02
  • One of the main purposes of a password-based KDF is to not be able to recover the original password. Hence, brute force cracking (or forcing someone who knows it to reveal it) is the only real way to get it back. – bartonjs Jan 17 '20 at 17:14
  • thanks a lot for your comments. I think I will use AES instead of PBKDF2 – proera Jan 20 '20 at 08:13

0 Answers0