javaphphashsymfony-3.1

Symfony FOSUser Hash algorithm in java


hey everyone am trying to find out which algorithm of hash is used my symfony FOS User Bundle I've done some research , and it's mentioned that FOSUser Bundle default security config uses Sha512() and itirate it over 5000 times + salt then bas64 encoding i'm actually new with these hash algorithms ,however this is the algorithm in php

$password = 'toto';
$salt = '1234';
$salted = $password.'{'.$salt.'}';
$digest = hash('sha512', $salted, true);

for ($i=1; $i<5000; $i++) {
  $digest = hash('sha512', $digest.$salted, true);
}

$encodedPassword = base64_encode($digest); 
}

taking from this post How do I generate a SALT in Java for Salted-Hash?

since am not familiar with java hash libraries can anyone help me how to translated this code into Java !


Solution

  • Symfony default setting for password encryption is Bcrypt this code mentioned in your security.yml config file

    encoders:
        Symfony\Component\Security\Core\User\User:
            algorithm: bcrypt
            cost:      15
    

    in my case i used a trick since all my password start with 13 am assuming that the salt equals to 13 so i tried translating it into java by using the java BCrypt library

    public boolean checkPassword(String passwordText, String DbHash) {
        boolean password_verified = false;
        if (null == DbHash || !DbHash.startsWith("$2a$")) {
            throw new java.lang.IllegalArgumentException("Invalid hash provided for comparison");
        }
        password_verified = BCrypt.checkpw(passwordText, DbHash);
        return (password_verified);
     }
    

    passwordText you actual password , DbHash stored hash

    This code check a password hash if password match or not

    there's a trick symfony hashed password start with $2y$ so to make this work you need to need change $2y$ to $2a$

    for exemple i have password with a hash value that is stored in my database

    String passwordText = "admin"; 
    String DbHash  = "$2y$13$VVmaKXzaS2QWgU1S4I8h5eJgC/DduF2fXmnhvcynro004GCUAQfr2";
    

    change this :

    String DbHash  = "$2y$13$VVmaKXzaS2QWgU1S4I8h5eJgC/DduF2fXmnhvcynro004GCUAQfr2"; 
    

    to this :

    String DbHash  = "$2a$13$VVmaKXzaS2QWgU1S4I8h5eJgC/DduF2fXmnhvcynro004GCUAQfr2";