Re: Storing encrypted passwords on AS400

["Joe Sam Shirah" <jshirah@xxxxxxxxxxxxx>]

    Hi Brett,

> Is there some issue with storing UTF-8 characters in the DB2 database?
> Should I use EBCDIC-US instead?

    Depends on your release and the CCSID of the target field.  As of V5R3,
UCS-2, UTF-8 and UTF-16 are supported.  Before that only UCS-2 was
supported.  As always, encoding in the data and field must match to get
reasonable results.  How is the column set up in the database?

    Also, I don't know your application and so am probbaly missing
something, but one of the outstanding features of the AS/400 is its
security.  Rather than go through all this roll your own stuff, why not use
the built in ID/password mechanism and use the Toolbox/JTOpen password
validation support for automatic handling?


                                                         Joe Sam

Joe Sam Shirah -        http://www.conceptgo.com
conceptGO       -        Consulting/Development/Outsourcing
Java Filter Forum:       http://www.ibm.com/developerworks/java/
Just the JDBC FAQs: http://www.jguru.com/faq/JDBC
Going International?    http://www.jguru.com/faq/I18N
Que Java400?            http://www.jguru.com/faq/Java400


----- Original Message ----- 
From: "Brett Slocum" <brett.slocum@xxxxxxxxx>
To: <java400-l@xxxxxxxxxxxx>
Sent: Wednesday, February 09, 2005 11:30 AM
Subject: Storing encrypted passwords on AS400


> I have a Java web application that uses a servlet to store userids and
> encrypted passwords, as well as a stored procedure on the AS400 that
> checks to see if the password is correct.
>
> I'm having an problem where certain passwords (e.g. 'password99')
> always fail when the stored procedure checks the encrypted passwords
> against each other.
>
> Below is a code sniplet of the encryption. The String returned gets
> stored via JDBC into the AS400.
>
> Is there some issue with storing UTF-8 characters in the DB2 database?
> Should I use EBCDIC-US instead?
>
> Any help would be greatly appreciated. Thanks in advance.
> -- 
> Brett Slocum
> <slocum@xxxxxxxxxxxxxx>
> ---------------------------------------------------------------
> Code Sniplet:
>
>     public static String encrypt(String data) {
>         String encrypted_Data = null;
>         MessageDigest md = null;
>         try{
>             md = MessageDigest.getInstance("SHA-1");
>             md.update(data.getBytes("UTF-8"));
>             byte[] result = md.digest();
>             encrypted_Data = new String(result, "UTF-8");
>         } catch(Exception e) {
>             e.printStackTrace();
>         }
>         return encrypted_Data;
>     }