I’m working on a spray framework REST based tech demo project, and I want to securely store passwords as salted hashes in a database. I took a look around at existing projects, and couldn’t find quite what I was looking for.
- simple to use and understand
- based on JVM built in crypto libraries
- written in Scala
The closest thing I found was this: Java PBKDF2 Password Hashing Code
But it is written in Java…. So I took a crack at porting it to Scala.
It lives here on github:
The public methods
validatePassword() are for the most part the same as the Java version. Some of the private methods are quite a bit different.
This is an interesting method in the Java implementation. It is designed to always take the same amount of time to determine equality regardless of the length of the arrays being compared. Additionally it uses the XOR operator
^ to produce consistent branching. I suspect using XOR in Java this way is somewhat controversial, regardless I used a similar approach in my Scala implementation.
1 2 3 4 5 6 7
The most significant change in the Scala port is making
diff immutable. The same result is achieved by folding over a range, and using an accumulator seeded by the initial test of
a.length ^ b.length.
1 2 3 4 5 6 7
fromHex / toHex
The utility functions
toHex saw a big size reduction.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20
1 2 3 4 5
I tested the code by using it in conjunction with the existing Java implementation. Verifying that passwords created by each side were interoperable with the other. I used ScalaCheck to randomly generate a set of passwords to test.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25
The conversion from Blogger to Octopress/Jekyll went a lot smoother than I expected it to. The DNS now seems to be working correctly, I’ve updated Google Analytics to use the new site, and I added some redirect pages that match the old site so searches can still find the old content.
I still have a few things I want to do.
- Change the default Octopress favicon.
- Add a top categories sidebar
- Categorize old articles
As an aside, I’m really enjoying using Markdown to author blog posts. I’m using MakrdownPad 2 on Windows and it is very slick.
Some of the formatting of the old site has been lost, and there seems to be no good way of bringing the comments over. Expect my next post to be about how it all worked out.
Note: The old site is still available here.