有什么方法可以模拟Python的端口密码加密吗？

Question

一些遗留Java使用名为jasypt的包加密密码。
它使用strongpasswordencryptor加密密码。

 public StrongPasswordEncryptor() {
        super();
        this.digester = new StandardStringDigester();
        this.digester.setAlgorithm("SHA-256");
        this.digester.setIterations(100000);
        this.digester.setSaltSizeBytes(16);
        this.digester.initialize();
    }

示例明文密码为:testing123
盐为:0DD2E486FAE5B121491CBE78A9B67AF1
加密密码为:D1JAI76BWIKEKOIY7IZOLASAFKX0YY7UJU/M7UBEZC7NQXSD3CLDYAFB1LZ96K98

下面是Java代码中实际加密密码的片段：

import javax.inject.Inject;
import javax.inject.Named;
import org.jasypt.util.password.StrongPasswordEncryptor;
import com.foobar.users.PasswordEncoder;

public class PasswordEncoderImpl implements PasswordEncoder {

    private String salt;
    private StrongPasswordEncryptor encryptor;

    @Inject
    public PasswordEncoderImpl(@Named("appHash") String appHash) {
        this.salt = appHash;
        encryptor = new StrongPasswordEncryptor();
    }

    @Override
    public String encode(String password) {
        return encryptor.encryptPassword(password + salt);
    }

    @Override
    public boolean verifyPassword(String password, String encryptedPassword){
        return encryptor.checkPassword(password+salt, encryptedPassword);
    }

}

Answer 1

好吧，我现在有一半的解决办法：

下面是一个简化的Java代码，用于检查给定的密码是否有效：

private void start() throws Exception {

    String salt = "0DD2E486FAE5B121491CBE78A9B67AF1";
    String password = "Testing123";
    String previousResult = "QI2KU2VsI/aNr4U3XQ0AdaOk6Qhl4XTaN2ym5cYXxRr8tz/23EvWQHI8sNhRmoP1";

    StrongPasswordEncryptor passwordEncryptor = new StrongPasswordEncryptor();
    String encryptedPass = passwordEncryptor.encryptPassword(password + salt);


    System.out.println(checkPass(salt, password, previousResult));
    System.out.println(passwordEncryptor.checkPassword(password + salt, previousResult));
}

private boolean checkPass(String salt, String password, String previousResult) throws NoSuchAlgorithmException {
    byte[] bytes = previousResult.getBytes(StandardCharsets.US_ASCII);
    byte[] decode = Base64.getDecoder().decode(bytes);

    byte[] secretSalt = new byte[16];
    System.arraycopy(decode, 0, secretSalt, 0, 16);

    byte [] message = (password + salt).getBytes(StandardCharsets.UTF_8);
    byte[] digest = digest(message, secretSalt);

    return Arrays.equals(digest, decode);
}


private byte[] digest(byte [] message, final byte[] salt) throws NoSuchAlgorithmException {

    byte[] digest;

    MessageDigest md = MessageDigest.getInstance("sha-256");
    md.reset();

    md.update(salt);
    md.update(message);


    digest = md.digest();
    for (int i = 0; i < (100000 - 1); i++) {
        md.reset();
        digest = md.digest(digest);
    }

    byte[] secondArray = digest;
    final byte[] result = new byte[salt.length + secondArray.length];

    System.arraycopy(salt, 0, result, 0, salt.length);
    System.arraycopy(secondArray, 0, result, salt.length, secondArray.length);

    return result;
}