Re: Storing encrypted passwords on AS400 -- JAVA400-L

Sorry...

import java.security.*;

/** * @author fbi * */ public class SecurityHandler { /** * @param arg1 java.lang.String * @return byte[] * @throws NoSuchAlgorithmException */ public static byte[] encrypt( String arg1 ) throws NoSuchAlgorithmException { byte[] buf = new byte[ arg1.length( ) ]; buf = arg1.getBytes( );

       MessageDigest algorithm = MessageDigest.getInstance( "SHA-1" );

       algorithm.reset(  );
       algorithm.update( buf );
       return algorithm.digest(  );
   }

   /**
    * @param arg1 java.lang.String
    * @return java.lang.String
    * @throws NoSuchAlgorithmException
    */
   public static String encryptToString( String arg1 )
       throws NoSuchAlgorithmException {
       byte[] encrypted = encrypt( arg1 );

       String out = "";

for ( int i = 0; i < encrypted.length; i++ ) { java.math.BigInteger en = new java.math.BigInteger( "" + encrypted[ i ] );

           // Avoid negative values
           en = en.abs(  );
           String tmp = en.toString( 16 ).toUpperCase(  );
           if ( tmp.length(  ) == 1 ) {
               tmp = "0" + tmp;
           }

           out += tmp;
       }

       return out;
   }
}


Brett Slocum wrote:

Where does SecurityHandler come from? It's not in the J2SE or J2EE platforms.

Brett

On Wed, 09 Feb 2005 20:05:26 +0100, Franco Biaggi <fbiaggi@xxxxxxxxxx> wrote:

Hi Brett,

this is possible, due to data conversions...
try to store the passwords in plain text like:

String encrypted_pwd = SecurityHandler.encryptToString( enteredPassword );


Brett Slocum wrote:

I have a Java web application that uses a servlet to store userids and
encrypted passwords, as well as a stored procedure on the AS400 that
checks to see if the password is correct.

I'm having an problem where certain passwords (e.g. 'password99')
always fail when the stored procedure checks the encrypted passwords
against each other.

Below is a code sniplet of the encryption. The String returned gets
stored via JDBC into the AS400.

Is there some issue with storing UTF-8 characters in the DB2 database?
Should I use EBCDIC-US instead?

Any help would be greatly appreciated. Thanks in advance.

--
-----------------------------------------------------------------------------
*** This messages was scanned for malicious contents ***
-----------------------------------------------------------------------------
Franco Biaggi
CH-6807 Taverne

--
This is the Java Programming on and around the iSeries / AS400 (JAVA400-L) 
mailing list
To post a message email: JAVA400-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/java400-l
or email: JAVA400-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/java400-l.

--
-----------------------------------------------------------------------------
*** This messages was scanned for malicious contents ***
-----------------------------------------------------------------------------
Franco Biaggi
CH-6807 Taverne