Chotchki.us

This is an example of how to do the secure hashing for use in Spring Security. However that git repo is only availible over IPV6. For those who do not have access to that, I have reproduced the file below:

import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.util.ArrayList;

import javax.crypto.KeyGenerator;
import javax.crypto.Mac;
import javax.crypto.SecretKey;
import javax.crypto.spec.SecretKeySpec;

import org.apache.commons.codec.binary.Base64;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.dao.DataAccessException;
import org.springframework.dao.InvalidDataAccessApiUsageException;
import org.springframework.security.authentication.encoding.PasswordEncoder;

public class SHA512PasswordEncoder implements PasswordEncoder {
        protected Logger log = LoggerFactory.getLogger(this.getClass());
        private final int iterations = 200000;
        private final String algorithum = "HmacSHA512";

        @Override
        public String encodePassword(String rawPassword, Object salt)
                        throws DataAccessException {
                StringBuilder password = new StringBuilder("1$" + iterations + "$");

                try {
                        KeyGenerator keygen = KeyGenerator.getInstance(algorithum);
                        keygen.init(512);
                        SecretKey hmac_key = keygen.generateKey();

                        password.append(Base64.encodeBase64URLSafeString(hmac_key.getEncoded()));
                        password.append("$");

                        password.append(this.calculateHash(hmac_key, iterations, rawPassword));
                } catch (NoSuchAlgorithmException e) {
                        throw new InvalidDataAccessApiUsageException("Could not use hmac512", e);
                } catch (InvalidKeyException e) {
                        throw new InvalidDataAccessApiUsageException("Bad hmac512 key", e);
                }
                return password.toString();
        }

        @Override
        public boolean isPasswordValid(String encPass, String rawPass, Object salt)
                        throws DataAccessException {
                log.info("Checking hash " + encPass + " to Pass " + rawPass);
                String[] hash_parts = encPass.split("\\$");
                if(!hash_parts[0].equals("1")){
                        log.error("Bad hash version! " + hash_parts[0]);
                        return false;
                }

                int valid_iter = Integer.parseInt(hash_parts[1]);
                SecretKey hmac_key = new SecretKeySpec(Base64.decodeBase64(hash_parts[2]), algorithum);

                try {
                        String calcPass = this.calculateHash(hmac_key, valid_iter, rawPass);

                        if(calcPass.equals(hash_parts[3])){
                                return true;
                        } else {
                                log.error("Hash " + hash_parts[3] + " does not match, calculated " + calcPass);
                                return false;
                        }
                } catch (Exception e) {
                        log.error("Could not run validators.", e);
                        return false;
                }
        }

        private String calculateHash(SecretKey key, int iterations, String password) throws InvalidKeyException, NoSuchAlgorithmException{
                ArrayList hmacs = new ArrayList(iterations);

                byte[] output = new byte[64];
                Mac hasher = Mac.getInstance(algorithum);
                for(int i = 0; i= 0; i--){
                        hasher.update(hmacs.get(i));
                }
                return Base64.encodeBase64URLSafeString(hasher.doFinal());
        }
}

I have been getting calls from an automated voice system with a spoofed caller id number ’223-2′. When I pick up i claims to be from the National Credit Union Administration and says that my pin has been compromised. It next asked for my card number so I could reset my pin. Duh, complete scam! However all my attempts to find out who really called me so I can report them to the police have been frustrated:

1. 800notes only supports full phone numbers
2. Google shows a million search results.
3. Finally my phone bill claims that I got an incoming call from myself the one time I picked up. The other calls I ignored don’t even register.

So I’ve opened a case with my phone provider and written this blog post in the hopes others will be warned.

I’m working on a rewrite of my website and have been struggling with how to store passwords reasonably despite all the advances in password hacking that have come out in the past year. As a result of that I have been researching password strengthening systems such as bcrypt and scrypt. I like the rationale behind both of them but don’t like that they each use non standardised components. So I propose the following for password hashing:

1. Generate a 512-bit random string.
2. Generate a SHA-512 HMAC using the password as input and the random string as the salt.
3. Store the output of the HMAC
1. reHMAC the password and the last output X times (I recommend 100,000).
2. Each time you HMAC the output again, store it in an array.
4. Once you hit the limit take the array of outputs and HMAC them iterating through the array backwards.

This requires all the memory that scrypt suggests without using another random number generator. Also it uses a standardised hash algorithm with a large amount of internal state. Thoughts?

Background

• Java as a Language
• Java EE as a Platform
• Setting up a Java Project

Tools

• Eclipse IDE
• Maven Build System
• Jenkins Continuous Integration

Typical Architecture

• Logging – Logback
• ORM – iBatis
• Controller – Spring
• View – JSP
• Templating – Sitemesh

Examples

• Helium.chotchki.us
• Chotchki.us / JSafe
• Getting to Helium – ssh -L 9999:helium.chotchki.us:80 -N chotchki.us

My finance got a nasty surprise when she was shopping last week. A store clerk asked her if she would like 3 free magazines. When she got home she discovered how nasty getting out of those “free” subscriptions is.

She got to call an automated line 1-877-754-4894 and jump through some deep voice response menus to get anywhere. Even then based on my Googling there is no guarantee that the subscriptions have been cancelled.

In short beware of anything free.