java.lang.Object
net.i2p.util.PasswordManager
Direct Known Subclasses:
RouterPasswordManager
public class PasswordManagerextends Object
Manage both plaintext and salted/hashed password storage in router.config.

There's no state here, so instantiate at will.

  • Field Details

    • _context

      private final I2PAppContext _context
      Used for the log and for reading and writing the password file.

    • SALT_LENGTH

      protected static final int SALT_LENGTH
      Length of the random salt prefixed to each stored hash, in bytes.
      See Also:

    • SHASH_LENGTH

      protected static final int SHASH_LENGTH
      Stored hash length in bytes (salt + session key, 48).
      See Also:

    • PROP_PW

      protected static final String PROP_PW
      Stored as plain text.
      See Also:

    • PROP_B64

      protected static final String PROP_B64
      Stored obfuscated as b64 of the UTF-8 bytes.
      See Also:

    • PROP_MD5

      protected static final String PROP_MD5
      Stored as the hex of the MD5 hash of the UTF-8 bytes. Compatible with Jetty.
      See Also:

    • PROP_SHASH

      protected static final String PROP_SHASH
      Stored as the b64 of the 16 byte salt + the 32 byte hash of the UTF-8 bytes.
      See Also:

  • Constructor Details

    • PasswordManager

      public PasswordManager(I2PAppContext ctx)
      Remember the app context so lookups reach the property store.
      Parameters:
      ctx - the app context supplying the property store that holds the passwords

  • Method Details

    • check

      public boolean check(String realm, String user, String pw)
      Checks both plaintext and hash.
      Parameters:
      realm - e.g. i2cp, routerconsole, etc.
      user - null or "" for no user, already trimmed
      pw - plain text, already trimmed
      Returns:
      if pw verified

    • checkPlain

      public boolean checkPlain(String realm, String user, String pw)
      Checks a password stored in plaintext.
      Parameters:
      realm - e.g. i2cp, routerconsole, etc.
      user - null or "" for no user, already trimmed
      pw - plain text, already trimmed
      Returns:
      if pw verified

    • checkB64

      public boolean checkB64(String realm, String user, String pw)
      Checks a password stored base64-encoded.
      Parameters:
      realm - e.g. i2cp, routerconsole, etc.
      user - null or "" for no user, already trimmed
      pw - plain text, already trimmed
      Returns:
      if pw verified

    • checkHash

      public boolean checkHash(String realm, String user, String pw)
      With random salt.
      Parameters:
      realm - e.g. i2cp, routerconsole, etc.
      user - null or "" for no user, already trimmed
      pw - plain text, already trimmed
      Returns:
      if pw verified

    • checkHash

      public boolean checkHash(String shash, String pw)
      Check pw against b64 salt+hash, as generated by createHash(String).
      Parameters:
      shash - b64 string
      pw - plain text non-null, already trimmed
      Returns:
      if pw verified

    • createHash

      public String createHash(String pw)
      Create a salt+hash, to be saved and verified later by verifyHash().
      Parameters:
      pw - plain text non-null, already trimmed
      Returns:
      salted+hash b64 string

    • get

      public String get(String realm, String user)
      Either plain or b64.
      Parameters:
      realm - e.g. i2cp, routerconsole, etc.
      user - null or "" for no user, already trimmed
      Returns:
      the pw or null

    • getPlain

      public String getPlain(String realm, String user)
      Retrieve the plaintext-stored password.
      Parameters:
      realm - e.g. i2cp, routerconsole, etc.
      user - null or "" for no user, already trimmed
      Returns:
      the pw or null

    • getB64

      public String getB64(String realm, String user)
      Retrieve the base64-stored password.
      Parameters:
      realm - e.g. i2cp, routerconsole, etc.
      user - null or "" for no user, already trimmed
      Returns:
      the decoded pw or null

    • md5Hex

      public static String md5Hex(String subrealm, String user, String pw)
      Straight MD5, no salt Will return the MD5 sum of "user:subrealm:pw", compatible with Jetty and RFC 2617.

      Updated in 0.9.26 to use UTF-8, as implied in RFC 7616/7617 See also http://stackoverflow.com/questions/7242316/what-encoding-should-i-use-for-http-basic-authentication http://stackoverflow.com/questions/702629/utf-8-characters-mangled-in-http-basic-auth-username

      Parameters:
      subrealm - to be used in creating the checksum
      user - non-null, non-empty, already trimmed
      pw - non-null, plain text, already trimmed
      Returns:
      lower-case hex with leading zeros, 32 chars, or null on error

    • md5Hex

      public static String md5Hex(String fullpw)
      Straight MD5, no salt Will return the MD5 sum of the data, compatible with Jetty and RFC 2617.

      Updated in 0.9.26 to use UTF-8, as implied in RFC 7616/7617 See also http://stackoverflow.com/questions/7242316/what-encoding-should-i-use-for-http-basic-authentication

      Parameters:
      fullpw - non-null, plain text, already trimmed
      Returns:
      lower-case hex with leading zeros, 32 chars, or null on error

    • sha256Sum

      public static byte[] sha256Sum(byte[] data)
      Standard SHA-256 checksum.
      Parameters:
      data - non-null
      Returns:
      32 bytes, or empty on error

    • md5Sum

      public static byte[] md5Sum(byte[] data)
      Standard MD5 checksum.
      Parameters:
      data - non-null
      Returns:
      16 bytes, or null on error

    • sha256Hex

      public static String sha256Hex(String subrealm, String user, String pw)
      Straight SHA256, no salt Will return the SHA256 sum of "user:subrealm:pw", compatible with RFC 7616. NOT currently supported by Jetty.
      Parameters:
      subrealm - to be used in creating the checksum
      user - non-null, non-empty, already trimmed
      pw - non-null, plain text, already trimmed
      Returns:
      lower-case hex with leading zeros, 32 chars, or null on error

    • sha256Hex

      public static String sha256Hex(String fullpw)
      Return the SHA256 sum of the data, compatible with RFC 7616. NOT currently supported by Jetty.
      Parameters:
      fullpw - non-null, plain text, already trimmed
      Returns:
      lower-case hex with leading zeros, 64 chars, or null on error