Allowing user to change md5 password when logged into system

[Martin McNicholas]

So not too long ago someone had given me an example of using md5 hashed strings to use for a mock security system (yes I know md5 is not secure but it is a good place to start to learn) and I have been wondering how can the user possibly once logged into the system change the password. In order to get the hashes used for strings I use this method:

$ echo -n 1234 | md5sum

and the hash that returns gets put in this line:

private static final String VALID_MD5 = "DF3AEBC649F9E3B674EEB790A4DA224E";

Now here is the thing which confuses me if I want the user to be able to change the password when they log in the has needs to be interchangeable and that 1234 when using echo also can't be set numbers if I want the user to be able to change it. I am confused on how to do this because if I set the hash to be interchangeable so the user can change it to whatever they wish, there is no starting password. The user upon running the program would then have to create a password before doing anything which isn't what I want. How can I allow the user to change password while logged in? Here is the code for reference (example code):

import java.security.MessageDigest;
import java.util.Scanner;
public class pin
{
public static void main( String[] args )
{
    if( Login.login() )
    {

    }
}
}

class Login
{

private static final Scanner ONE = new Scanner( System.in );
private static final String VALID_MD5 = "DF3AEBC649F9E3B674EEB790A4DA224E"; 
public static boolean login()
{
    System.out.print( "Enter pin: " );
    String pin = ONE.nextLine();
    if( isValid( pin ) && VALID_MD5.equals( md5HexString( pin ) ) )
    {
        System.out.println( "Login successful." );
        return true;
    }
    System.out.println( "Login failed, invalid pin." );
    return false;
}
private static boolean isValid( String s )
{
    return s.matches( "\\d{4}" );  
}
private static String md5HexString( String s )
{
    return toHexString( md5( s ) );
}
private static byte[] md5( String s )
{
    try
    {
        MessageDigest md = MessageDigest.getInstance( "MD5" );
        byte[] buf = s.getBytes();
        md.update( buf, 0, buf.length );
        return md.digest();
    }
    catch( Exception ex )
    {
        return new byte[16];
    }
}

private static String toHexString( byte[] byteArray )
{
    final String HEX_CHARS = "0123456789ABCDEF"; 

    byte[] result = new byte[byteArray.length << 1];
    int len = byteArray.length;
    for( int i = 0 ; i < len ; i++ )
    {
        byte b = byteArray[i];
        int lo4 = b & 0x0F;
        int hi4 = ( b & 0xF0 ) >> 4;


        result[i * 2] = (byte)HEX_CHARS.charAt( hi4 );
        result[i * 2 + 1] = (byte)HEX_CHARS.charAt( lo4 );
    }
    return new String( result );
}
}

[Junilu Lacar]

You shouldn't hard code the MD5 value in your code like you're doing on line 18. As I mentioned in another thread, you should keep the "secret" in a variable that's either a class variable or an instance variable. In this case, it looks like a class variable is appropriate.

For example:
private static String pinMD5 = ""; // initialize to empty string ... if (isValid(pin) && (isMatch(pin)) {   // success } ... private static boolean isMatch(String pin) {    return pinMD5.equals(md5HexString(pin)); } private static void changePIN(String newPin) {    if (isValid(newPin)) {        pinMD5 = md5HexString(newPin);    } else {        throw new IllegalArgumentException("Invalid PIN");    } }
At some appropriate point in your program, you'd call the changePIN() method and you can do this even when the user is logged in.

[Junilu Lacar]

Note that having all static methods is probably not the best thing in this type of program but if you haven't touched on object-orientation yet, that's fine for now.

[Junilu Lacar]

If you want to learn about more secure hash algorithms, check this out: http://www.baeldung.com/sha-256-hashing-java

[Carey Brown]

Again, this is meant as an *example*. You will have to customize it for your particular application and replace PersistentStorage with some managed database or file.

import java.security.MessageDigest;
import java.security.SecureRandom;
import java.util.HashSet;
import java.util.Scanner;
import java.util.Set;

public class PinMain
{
	public static void main( String[] args )
	{
//		RandomMD5.randomMD5(); // use once to come up with NULL_MD5
		
		System.out.print( "Enter name (john.doe): " );
		String		userName = Login.KBD.nextLine();
		if( Login.login( userName ) )
		{
			// some debug lines to test
			System.out.println( "Change pin..." );
			Login.changeUserPin( userName );
			
			System.out.println( "Log in with new pin..." );
			if( Login.login( userName ) )
			{
			}
		}
	}
}

class Login
{
	public static final Scanner KBD = new Scanner( System.in );
	public static final String NULL_MD5 = "66E90EFD6091BA776C903DF6FD0F7088";

	public static boolean login( String userName )
	{
		String		userHash = PersistentStorage.getHash( userName );
		
		if( userHash == null )
		{
			// means no user by that name was found.
			// what do you want to do here?
		}
		
		if( userHash.equals( NULL_MD5 ) )
		{
			String			pin = createNewPin();
			PersistentStorage.update( userName, md5HexString( pin ) );
			return true;
		}
		else
		{
			System.out.print( "Enter pin: " );
			String		pin = KBD.nextLine();
			if( isValid( pin ) && userHash.equals( md5HexString( pin ) ) )
			{
				System.out.println( "Login successful." );
				return true;
			}
			System.out.println( "Login failed, invalid pin." );
			return false;
		}
	}
	
	private static String createNewPin()
	{
		String		pin = "";
		while( true )
		{
			System.out.print( "Enter new pin: " );
			pin = KBD.nextLine();
			// TODO some way to say "never mind" ??
			if( ! isValid(pin) )
			{
				System.out.println( "The pin you've entered is invalid." );
				continue;
			}
			System.out.print( "Confirm new pin: " );
			String		confirmPin = KBD.nextLine();
			if( pin.equals( confirmPin ) )
				break;

			System.out.println( "The pin you've entered does not match, start over." );
		}
	
		return pin;
	}
	
	// Should only be run by an admin. Will force the user to
	// create a new pin next time.
	public static void resetUserPin( String userName )
	{
		PersistentStorage.update( userName, NULL_MD5 );
	}
	
	// Called from a user that has already logged in with a valid pin.
	public static void changeUserPin( String userName )
	{
		PersistentStorage.update( userName, md5HexString( createNewPin() ) );
	}
	
	private static boolean isValid( String s )
	{
		return s.matches( "\\d{4}" ); // must be 4 digits long
	}

	public static String md5HexString( String s )
	{
		return toHexString( md5( s ) );
	}

	public static byte[] md5( String s )
	{
		try
		{
			MessageDigest md = MessageDigest.getInstance( "MD5" );
			byte[] buf = s.getBytes();
			md.update( buf, 0, buf.length );
			return md.digest();
		}
		catch( Exception ex )
		{
			return new byte[16];
		}
	}

	public static String toHexString( byte[] byteArray )
	{
		final String HEX_CHARS = "0123456789ABCDEF";

		// result buffer to hold ASCII character values
		// to be converted to a String on return.
		// Length of byteArray times 2.
		byte[] result = new byte[byteArray.length << 1];
		
		int len = byteArray.length;
		for( int i = 0 ; i < len ; i++ )
		{
			byte b = byteArray[i];			// next byte from array
			int lo4 =   b & 0x0F;			// lo 4 bits, 0-15
			int hi4 = ( b & 0xF0 ) >> 4;	// hi 4 bits, 0-15
		
			// Fill result with two ASCII characters,
			// one for hi 4 bits, and one for lo 4 bits.
			result[i * 2    ] = (byte)HEX_CHARS.charAt( hi4 );
			result[i * 2 + 1] = (byte)HEX_CHARS.charAt( lo4 );
		}
		return new String( result ); // convert result to String
	}
}

// Dummy place holder. Should be replaced with database or
// file for persistent storage.
class PersistentStorage
{
	private static final String VALID_MD5 = "DF3AEBC649F9E3B674EEB790A4DA224E"; // 6357
	private static String validHash = VALID_MD5;
	private static boolean firstTime = true;
	
	public static String getHash( String userName )
	{
		if( "john.doe".equals( userName ) )
		{
//			if( firstTime )
//			{
//				firstTime = false;
//				validHash = Login.NULL_MD5;
//			}
			return validHash;
		}
		return null;
	}
	
	public static void update( String userName, String hash )
	{
		validHash = hash;
	}
}

// For development only. Use once and take the returned hash
// and hard code it into the Login class.
// Find a random hash that is NOT a hash created by any valid pin
// number. Only works for 4 digit pins.
class RandomMD5
{
	public static void randomMD5()
	{
		Set<String>		validMD5s = new HashSet<>();
		SecureRandom	random = new SecureRandom();
		byte[]			bytes = new byte[16]; // 16 is length of MD5
		String			randomHash;
		
		// populate set of valid hashes
		for( int i=0 ; i < 10_000 ; i++ )
			validMD5s.add( Login.md5HexString( String.format("%04d",i) ) );
		
		do
		{
			random.nextBytes( bytes );
			randomHash = Login.toHexString( bytes );
		} while( validMD5s.contains( randomHash ) );
		
		System.out.println( "Random MD5: " + randomHash );
	}
}

[Junilu Lacar]

I think you've reached a point where this program is big enough that it requires some attention to design details.  All the code examples you've been given in this thread, including the one I gave, is far from ideal. They are examples, yes, but frankly, they are poor examples and I think it's a bit of a disservice to you to just leave you to figure that out for yourself.

You really need to step back and think about organizing different responsibilities and assigning them appropriately to classes or objects. This goes beyond just providing some kind of authentication functionality using hashes and PINs. Guiding you down that path would be quite a journey though, I think, but I just wanted to point this out before you go any further. The last thing I'd want to see is you "learning" a lot of bad habits and saying that's what the folks at CodeRanch taught you.

[Junilu Lacar]

Let me try to explain what I meant before...

Take this code:

public class pin
{
public static void main( String[] args )
{
    if( Login.login() )
    {
        ...
    }
}
}
 
class Login
{ ...

A main entry point in a class named pin is not that great. Besides the inconsistency with Java naming conventions for class names, it really doesn't fit the intent of the code inside of it.  Getting names right and putting code in right-named classes helps create context and helps you organize your thoughts around the problem.  What this code tells me is that you're very focused on the PIN, which is a small detail when taken in the larger scheme of things that this program could conceivably be about.  Is this supposed to be a banking app? Then why not name the main program something that communicates that better?  Is login really the main focus of this program? Why make it the central idea in the main() method then?

One strong tendency that many programmers have is to dig right into the details of a problem. Try to resist that urge. Get an idea of the big picture first. Create some high-level context around your problem. Think about what are the major parts of the program you want to write. Plan, organize, and write tests as a way to visualize the end state. Then go into the nitty-gritty details of the implementation.

[Martin McNicholas]

Junilu Lacar wrote:I think you've reached a point where this program is big enough that it requires some attention to design details.  All the code examples you've been given in this thread, including the one I gave, is far from ideal. They are examples, yes, but frankly, they are poor examples and I think it's a bit of a disservice to you to just leave you to figure that out for yourself.

You really need to step back and think about organizing different responsibilities and assigning them appropriately to classes or objects. This goes beyond just providing some kind of authentication functionality using hashes and PINs. Guiding you down that path would be quite a journey though, I think, but I just wanted to point this out before you go any further. The last thing I'd want to see is you "learning" a lot of bad habits and saying that's what the folks at CodeRanch taught you.

I will take a look at this and ask if I have any questions and yes maybe they are bad examples but a bit good for me starting anywhere. Once I understood simple string comparison and checking that I did want to look into such things like hashing and even though I will not in the long run use md5 it is ok for learning. The fact doing it this way also just more than doubled the line of codes for the beginning example is also not such a great thing as this is just the beginning of the system I am trying to crate with alarms and much more and having over 200 lines just for a login is just too much of a hassle on so many levels.

[Martin McNicholas]

Carey Brown wrote:Again, this is meant as an *example*. You will have to customize it for your particular application and replace PersistentStorage with some managed database or file.

Thank you for the example and it might not be the best or even close to it but at least I have somewhere to start learning from now that I know how to compare basic strings and check if they are validated, etc.

[Martin McNicholas]

Junilu Lacar wrote:Let me try to explain what I meant before...

Take this code:

public class pin
{
public static void main( String[] args )
{
    if( Login.login() )
    {
        ...
    }
}
}
 
class Login
{ ...

A main entry point in a class named pin is not that great. Besides the inconsistency with Java naming conventions for class names, it really doesn't fit the intent of the code inside of it.  Getting names right and putting code in right-named classes helps create context and helps you organize your thoughts around the problem.  What this code tells me is that you're very focused on the PIN, which is a small detail when taken in the larger scheme of things that this program could conceivably be about.  Is this supposed to be a banking app? Then why not name the main program something that communicates that better?  Is login really the main focus of this program? Why make it the central idea in the main() method then?

One strong tendency that many programmers have is to dig right into the details of a problem. Try to resist that urge. Get an idea of the big picture first. Create some high-level context around your problem. Think about what are the major parts of the program you want to write. Plan, organize, and write tests as a way to visualize the end state. Then go into the nitty-gritty details of the implementation.

To this point I actually already have a program that is the alarm itself that on 1 will disarm and on 2 will arm. The program will be set up to call the login method which includes all of the stuff related to the pin. I have the very base done, my next focus is the pin and the login area. After this comes the sensors and the rest of my program.

[Martin McNicholas]

I would also like to ask what is the purpose of the random MD5 hash?

[Carey Brown]

Martin McNicholas wrote:I would also like to ask what is the purpose of the random MD5 hash?

Well, you need a hash to represent a pin that has been reset, that is, next time an attempt is made to login ask for a new pin. There are a couple of ways of doing this. You could have: userName, pinHash, isReset as fields in a User class (may have been a more straight forward way to do it). I went a different way and have a pinHash that is unique and can't be arrived at by any way of entering a valid pin. I called this NULL_MD5. The reason for "random" is that it should appear scrambled if anyone goes poking around. This "random" code only needs to be run once at the start of development and then cut-n-pasted into NULL_MD5. Once this step has been done you should never modify NULL_MD5 again, so the code is superfluous.