All about Carey Brown

Allowing user to change md5 password when logged into system

Again, this is meant as an *example*. You will have to customize it for your particular application and replace PersistentStorage with some managed database or file.

import java.security.MessageDigest;
import java.security.SecureRandom;
import java.util.HashSet;
import java.util.Scanner;
import java.util.Set;
public class PinMain
{
public static void main( String[] args )
{
// RandomMD5.randomMD5(); // use once to come up with NULL_MD5
System.out.print( "Enter name (john.doe): " );
String userName = Login.KBD.nextLine();
if( Login.login( userName ) )
{
// some debug lines to test
System.out.println( "Change pin..." );
Login.changeUserPin( userName );
System.out.println( "Log in with new pin..." );
if( Login.login( userName ) )
{
}
}
}
}
class Login
{
public static final Scanner KBD = new Scanner( System.in );
public static final String NULL_MD5 = "66E90EFD6091BA776C903DF6FD0F7088";
public static boolean login( String userName )
{
String userHash = PersistentStorage.getHash( userName );
if( userHash == null )
{
// means no user by that name was found.
// what do you want to do here?
}
if( userHash.equals( NULL_MD5 ) )
{
String pin = createNewPin();
PersistentStorage.update( userName, md5HexString( pin ) );
return true;
}
else
{
System.out.print( "Enter pin: " );
String pin = KBD.nextLine();
if( isValid( pin ) && userHash.equals( md5HexString( pin ) ) )
{
System.out.println( "Login successful." );
return true;
}
System.out.println( "Login failed, invalid pin." );
return false;
}
}
private static String createNewPin()
{
String pin = "";
while( true )
{
System.out.print( "Enter new pin: " );
pin = KBD.nextLine();
// TODO some way to say "never mind" ??
if( ! isValid(pin) )
{
System.out.println( "The pin you've entered is invalid." );
continue;
}
System.out.print( "Confirm new pin: " );
String confirmPin = KBD.nextLine();
if( pin.equals( confirmPin ) )
break;
System.out.println( "The pin you've entered does not match, start over." );
}
return pin;
}
// Should only be run by an admin. Will force the user to
// create a new pin next time.
public static void resetUserPin( String userName )
{
PersistentStorage.update( userName, NULL_MD5 );
}
// Called from a user that has already logged in with a valid pin.
public static void changeUserPin( String userName )
{
PersistentStorage.update( userName, md5HexString( createNewPin() ) );
}
private static boolean isValid( String s )
{
return s.matches( "\\d{4}" ); // must be 4 digits long
}
public static String md5HexString( String s )
{
return toHexString( md5( s ) );
}
public static byte[] md5( String s )
{
try
{
MessageDigest md = MessageDigest.getInstance( "MD5" );
byte[] buf = s.getBytes();
md.update( buf, 0, buf.length );
return md.digest();
}
catch( Exception ex )
{
return new byte[16];
}
}
public static String toHexString( byte[] byteArray )
{
final String HEX_CHARS = "0123456789ABCDEF";
// result buffer to hold ASCII character values
// to be converted to a String on return.
// Length of byteArray times 2.
byte[] result = new byte[byteArray.length << 1];
int len = byteArray.length;
for( int i = 0 ; i < len ; i++ )
{
byte b = byteArray[i]; // next byte from array
int lo4 =   b & 0x0F; // lo 4 bits, 0-15
int hi4 = ( b & 0xF0 ) >> 4; // hi 4 bits, 0-15
// Fill result with two ASCII characters,
// one for hi 4 bits, and one for lo 4 bits.
result[i * 2    ] = (byte)HEX_CHARS.charAt( hi4 );
result[i * 2 + 1] = (byte)HEX_CHARS.charAt( lo4 );
}
return new String( result ); // convert result to String
}
}
// Dummy place holder. Should be replaced with database or
// file for persistent storage.
class PersistentStorage
{
private static final String VALID_MD5 = "DF3AEBC649F9E3B674EEB790A4DA224E"; // 6357
private static String validHash = VALID_MD5;
private static boolean firstTime = true;
public static String getHash( String userName )
{
if( "john.doe".equals( userName ) )
{
// if( firstTime )
// {
// firstTime = false;
// validHash = Login.NULL_MD5;
// }
return validHash;
}
return null;
}
public static void update( String userName, String hash )
{
validHash = hash;
}
}
// For development only. Use once and take the returned hash
// and hard code it into the Login class.
// Find a random hash that is NOT a hash created by any valid pin
// number. Only works for 4 digit pins.
class RandomMD5
{
public static void randomMD5()
{
Set<String> validMD5s = new HashSet<>();
SecureRandom random = new SecureRandom();
byte[] bytes = new byte[16]; // 16 is length of MD5
String randomHash;
// populate set of valid hashes
for( int i=0 ; i < 10_000 ; i++ )
validMD5s.add( Login.md5HexString( String.format("%04d",i) ) );
do
{
random.nextBytes( bytes );
randomHash = Login.toHexString( bytes );
} while( validMD5s.contains( randomHash ) );
System.out.println( "Random MD5: " + randomHash );
}
}

Carey Brown

Recent posts by Carey Brown