public class BcryptSecureHasher extends AbstractSecureHasher
Bcrypt for secure password hashing.
One critical difference is that this implementation uses a
static universal salt unless instructed otherwise, which provides
strict determinism across nodes in a cluster. The purpose for this is to allow for
blind equality comparison of sensitive values hashed on different nodes (with
potentially different nifi.sensitive.props.key values) during flow inheritance
(see FingerprintFactory).
The resulting output is referred to as a hash to be consistent with SecureHasher terminology.
| Modifier and Type | Field and Description |
|---|---|
private int |
cost |
private static int |
DEFAULT_COST
These values can be calculated automatically using the code
BcryptCipherProviderGroovyTest#calculateMinimumParameters or manually updated by a maintainer |
private static int |
DEFAULT_SALT_LENGTH |
private static org.slf4j.Logger |
logger |
private static int |
MAX_COST |
private static int |
MIN_COST |
private static int |
MIN_SALT_LENGTH |
saltLength, UPPER_BOUNDARY| Constructor and Description |
|---|
BcryptSecureHasher()
Instantiates a Bcrypt secure hasher using the default cost parameter
(
cost = DEFAULT_COST |
BcryptSecureHasher(int cost)
Instantiates a Bcrypt secure hasher using the provided cost parameters.
|
BcryptSecureHasher(int cost,
int saltLength)
Instantiates an Bcrypt secure hasher using the provided cost parameters.
|
| Modifier and Type | Method and Description |
|---|---|
(package private) boolean |
acceptsEmptyInput()
Returns
true if the algorithm can accept empty (non-null) inputs. |
static String |
convertBcryptRadix64ToMimeBase64(String radix64) |
static String |
convertMimeBase64ToBcryptRadix64(String base64) |
(package private) String |
getAlgorithmName()
Returns the algorithm-specific name for logging and messages.
|
(package private) int |
getDefaultSaltLength()
Returns the algorithm-specific default salt length in bytes.
|
(package private) int |
getMaxSaltLength()
Returns the algorithm-specific maximum salt length in bytes.
|
(package private) int |
getMinSaltLength()
Returns the algorithm-specific minimum salt length in bytes.
|
(package private) byte[] |
hash(byte[] input)
Internal method to hash the raw bytes.
|
(package private) byte[] |
hash(byte[] input,
byte[] rawSalt)
Internal method to hash the raw bytes.
|
static boolean |
isCostValid(Integer cost)
Returns true if the provided cost factor is within boundaries.
|
private void |
validateParameters(Integer cost,
Integer saltLength)
Enforces valid Scrypt secure hasher cost parameters are provided.
|
getSalt, hashBase64, hashBase64, hashHex, hashHex, hashRaw, hashRaw, initializeSalt, isSaltLengthValid, isUsingStaticSaltprivate static final org.slf4j.Logger logger
private static final int DEFAULT_COST
BcryptCipherProviderGroovyTest#calculateMinimumParameters or manually updated by a maintainerprivate static final int DEFAULT_SALT_LENGTH
private static final int MIN_COST
private static final int MAX_COST
private static final int MIN_SALT_LENGTH
private final int cost
public BcryptSecureHasher()
cost = DEFAULT_COSTpublic BcryptSecureHasher(int cost)
DEFAULT_SALT_LENGTH byte salt will be generated on every hash request.cost - the (log) number of key expansion rounds [4..31]public BcryptSecureHasher(int cost,
int saltLength)
cost - the (log) number of key expansion rounds [4..31]saltLength - the salt length in bytes >= 8)private void validateParameters(Integer cost, Integer saltLength)
cost - the (log) number of key expansion rounds [4..31]saltLength - the salt length in bytes >= 16)public static boolean isCostValid(Integer cost)
cost - the (log) number of key expansion rounds [4..31]public static String convertBcryptRadix64ToMimeBase64(String radix64)
public static String convertMimeBase64ToBcryptRadix64(String base64)
int getDefaultSaltLength()
getDefaultSaltLength in class AbstractSecureHasherint getMinSaltLength()
getMinSaltLength in class AbstractSecureHasherint getMaxSaltLength()
getMaxSaltLength in class AbstractSecureHasherString getAlgorithmName()
getAlgorithmName in class AbstractSecureHasherboolean acceptsEmptyInput()
true if the algorithm can accept empty (non-null) inputs.acceptsEmptyInput in class AbstractSecureHasher"" is allowable inputbyte[] hash(byte[] input)
hash in class AbstractSecureHasherinput - the raw bytes to hash (can be length 0)byte[] hash(byte[] input,
byte[] rawSalt)
hash in class AbstractSecureHasherinput - the raw bytes to hash (can be length 0)rawSalt - the raw bytes to saltCopyright © 2023 Apache NiFi Project. All rights reserved.