英文:
Checking if hashed values are the same
问题
我正在使用SHA-256对用户令牌进行哈希处理，然后将该哈希值保存到数据库中，最后当新令牌到达时，我会检索先前保存的令牌并仅使用equals方法进行检查，这样可以吗？还是说byte[]需要以某种不同的方式进行检查？
简短地说，如果 !Arrays.equals(hashedToken, tokenEntity.get().getToken())，则执行以下操作：
private byte[] hashToken(String token) {
try {
MessageDigest digest = MessageDigest.getInstance("SHA-256");
return digest.digest(token.getBytes(StandardCharsets.UTF_8));
} catch (NoSuchAlgorithmException e) {
throw new RuntimeException("No such algorithm exist");
}
}
英文:
I am using SHA-256 to hash user token, then I am saving that hash value to db , finally when new tokens reaches i am pulling the one i saved previously and checking just with equals method, is that fine? or byte[] needs to be checked differently somehow?
short if (!Arrays.equals(hashedToken, tokenEntity.get().getToken()))
private byte[] hashToken(String token) {
try {
MessageDigest digest = MessageDigest.getInstance("SHA-256");
return digest.digest(token.getBytes(StandardCharsets.UTF_8));
} catch (NoSuchAlgorithmException e) {
throw new RuntimeException("No such algorithm exist");
}
}
答案1
得分: 1
你的代码没问题。
Arrays.equals() 进行逐个元素的比较。引用官方文档：
> 如果两个指定的字节数组彼此相等，则返回 true。如果两个数组包含相同数量的元素，并且两个数组中对应的元素对相等，则认为这两个数组是相等的。换句话说，如果两个数组按相同顺序包含相同的元素，则它们是相等的。此外，如果两个数组引用都为 null，则认为它们相等。
英文:
Your code is fine.
Arrays.equals() does an element-for-element comparison. Quoting the javadoc:
>Returns true if the two specified arrays of bytes are equal to one another. Two arrays are considered equal if both arrays contain the same number of elements, and all corresponding pairs of elements in the two arrays are equal. In other words, two arrays are equal if they contain the same elements in the same order. Also, two array references are considered equal if both are null.
答案2
得分: 1
你的代码能够运行，但仍有改进空间。如果我理解正确，攻击者可以通过猜测散列的用户令牌来窃取用户的开放会话。
你目前的比较在第一个字节不相等时就返回false。因此，在较早位置的不等情况比后面位置的差异更快返回。攻击者可以利用响应时间的时间攻击来逆向工程当前的令牌。因此，你应该使用一种缓慢的equals方法，始终比较数组中的所有字节，并始终花费相同的时间来比较这些值。
private static boolean slowEquals(byte[] a, byte[] b) {
int diff = a.length ^ b.length;
for(int i = 0; i < a.length && i < b.length; i++) {
diff |= a[i] ^ b[i];
}
return diff == 0;
}
这里有一篇关于哈希和安全性的好文章：https://crackstation.net/hashing-security.htm，还解释了时间攻击的问题。
英文:
You code works, but it could be improved. If I understood it correctly an attacker could steal an open session of a user, if he would be able to guess the hashed user token.
Your current comparison returns false, as soon as the first byte is not equal. So an unequality on an earlier position returns faster than a difference on a later position. An attacker could use a timing attack on the response time to reverse engineer the current token. Therefore you should use a slow equals method, that always compare all bytes in the array and always spends the same time to compare the values.
private static boolean slowEquals(byte[] a, byte[] b) {
int diff = a.length ^ b.length;
for(int i = 0; i < a.length && i < b.length; i++) {
diff |= a[i] ^ b[i];
}
return diff == 0;
}
here is a good ready about hasing and security: https://crackstation.net/hashing-security.htm
also explaining the timing attack problem.
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库，让每个人都能够通过互相帮助和分享经验来进步。
评论