> Does this generate a fresh, random, secret key? If so, how did you
> get the same output twice with Java 1.3?
I'm not an expert in these Classes but it does print the same output
everytime with jdk 1.3. In fact, this code is being used to generate
hashed password for our application users and the users are able to
login successfully everytime. Now that we're upgrading to 1.4, this
issue has come up. No user is able to login successfully. Is HmacMD5
even the correct thing to use to generate hashed passwords for users?
> Does this generate a fresh, random, secret key? If so, how did you
> get the same output twice with Java 1.3?
I added some debugging messages for testing with 1.3 and found that it
generates different key everytime and still the output from
mac.doFinal is same everytime.
Thanks,
Nash.
Chris - 25 Jul 2004 17:24 GMT
>> Does this generate a fresh, random, secret key? If so, how did you
>> get the same output twice with Java 1.3?
[quoted text clipped - 16 lines]
> Thanks,
> Nash.
Hi,
That sounds like a serious bug in 1.3. With different keys, the output
of the Mac *should* be different. If you are simply trying to use
hashed passwords to avoid storing the passwords in plaintext, use
java.security.MessageDigest, with algorithm, say, "SHA-1".
MessageDigests don't use keys, so they'll return the same hash value
each time. If you were to use a Mac, you'd need to store the key
somewhere, as well as the output, so that you could use the same key
later when Mac-ing the password the user typed in.
Chris
Michael Amling - 25 Jul 2004 20:13 GMT
>>Does this generate a fresh, random, secret key? If so, how did you
>>get the same output twice with Java 1.3?
[quoted text clipped - 5 lines]
> issue has come up. No user is able to login successfully. Is HmacMD5
> even the correct thing to use to generate hashed passwords for users?
You're much better off using SRP, certainly if this login is
occurring across an unencrypted channel. See
http://srp.stanford.edu/design.html. Also, SRP only needs a hash, such
as java.security.MessageDigest("MD5"), and BigInteger, not the JCE or a
JCE provider.
>>Does this generate a fresh, random, secret key? If so, how did you
>>get the same output twice with Java 1.3?
>
> I added some debugging messages for testing with 1.3 and found that it
> generates different key everytime and still the output from
> mac.doFinal is same everytime.
For a correct implementation of HMAC (or any other MAC), the output
would vary with the secret key.
--Mike Amling