You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 9 Next »

Cleartext refers to text data that is not encrypted.

Any time an application stores a password as cleartext, its value is potentially exposed in a variety of ways. Obviously this exposure must be limited. While a program will receive the password from the user as cleartext, this should be the last time it is in this form. Hash functions allow programs to indirectly compare an input password to the original, without storing a cleartext or decryptable version of the password. This approach will therefore minimize the exposure of the password without presenting any practical disadvantages.

Cryptographic Hash Functions

The value that a hash function outputs is called the hash value. Another term for hash value is message digest. Hash functions are computationally feasible functions whose inverses are computationally infeasible. This means that in practice, one can encode a password to a hash value quickly, while they are also unable to decode it.

Java's MessageDigest class provides the functionality of various cryptographic hash functions. Be careful not to use any defective hash functions, such as MD5.

It is also important that you append a salt to the password you are hashing. A salt is a piece of data that is randomly generated during the creation of the program (and consistent throughout the rest of its implementation). The use of a salt helps prevents dictionary attacks against the hash value, provided the salt is long enough.

  • No labels