Added XOR compare passwords method

dschadow · dschadow · commit 55a7693ae544 · 2014-05-12T21:19:48.000+02:00
diff --git a/crypto-java/src/main/java/de/dominikschadow/javasecurity/hash/PBKDF2HashSample.java b/crypto-java/src/main/java/de/dominikschadow/javasecurity/hash/PBKDF2HashSample.java
@@ -39,7 +39,7 @@
 public class PBKDF2HashSample {
     private static final Logger logger = LoggerFactory.getLogger(PBKDF2HashSample.class);
     private static final String ALGORITHM = "PBKDF2WithHmacSHA1";
-    private static final int ITERATIONS = 100000;
+    private static final int ITERATIONS = 1000000;
     private static final int SALT_SIZE = 24;
     private static final int HASH_SIZE = 192;
 
@@ -82,6 +82,22 @@ private boolean verifyPassword(byte[] originalHash, String password, byte[] salt
         logger.info("hash 1: {}", BaseEncoding.base64().encode(originalHash));
         logger.info("hash 2: {}", BaseEncoding.base64().encode(comparisonHash));
 
-        return Arrays.equals(originalHash, comparisonHash);
+        return comparePasswords(originalHash, comparisonHash);
+    }
+
+    /**
+     * Compares the two byte arrays in length-constant time using XOR.
+     *
+     * @param originalHash The original password hash
+     * @param comparisonHash The comparison password hash
+     * @return True if both match, false otherwise
+     */
+    private boolean comparePasswords(byte[] originalHash, byte[] comparisonHash) {
+        int diff = originalHash.length ^ comparisonHash.length;
+        for (int i = 0; i < originalHash.length && i < comparisonHash.length; i++) {
+            diff |= originalHash[i] ^ comparisonHash[i];
+        }
+
+        return diff == 0;
     }
 }
diff --git a/crypto-java/src/main/java/de/dominikschadow/javasecurity/hash/SHA512HashSample.java b/crypto-java/src/main/java/de/dominikschadow/javasecurity/hash/SHA512HashSample.java
@@ -88,6 +88,22 @@ private boolean verifyPassword(byte[] originalHash, String password, byte[] salt
         logger.info("hash 1: {}", BaseEncoding.base64().encode(originalHash));
         logger.info("hash 2: {}", BaseEncoding.base64().encode(comparisonHash));
 
-        return Arrays.equals(originalHash, comparisonHash);
+        return comparePasswords(originalHash, comparisonHash);
+    }
+
+    /**
+     * Compares the two byte arrays in length-constant time using XOR.
+     *
+     * @param originalHash The original password hash
+     * @param comparisonHash The comparison password hash
+     * @return True if both match, false otherwise
+     */
+    private boolean comparePasswords(byte[] originalHash, byte[] comparisonHash) {
+        int diff = originalHash.length ^ comparisonHash.length;
+        for (int i = 0; i < originalHash.length && i < comparisonHash.length; i++) {
+            diff |= originalHash[i] ^ comparisonHash[i];
+        }
+
+        return diff == 0;
     }
 }
