Does JBCryptPasswordEncoder reuse the same salt?

[Ioan Eugen Stan]

Hello,

I'm loking at the code and it seems that the way JBCryptPasswordEncoder is used in the salt is reused for all passwords.

The salt is saved for the lifetime of the encoder.

public class JBCryptPasswordEncoder implements PasswordEncoder {

private String salt;

public JBCryptPasswordEncoder(final String salt) {
this.salt = salt;
}

Compared with the Spring implementation, where the salt is generated during the encoding phase.

public String encode(CharSequence rawPassword) {
byte[] salt = this.saltGenerator.generateKey();
byte[] hash = new byte[this.hashLength];

IMO, JBCryptPasswordEncoder is insecure and should be fixed / removed.

Regards,

Eugen

[Jérôme LELEU]

Hi,

I'm in line. See: https://github.com/pac4j/pac4j/commit/3f6c46ac6b2abdfe6e52a652be315b32b267f708

Thanks.

Best regards,

Jérôme

--
You received this message because you are subscribed to the Google Groups "Pac4j development mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to pac4j-dev+...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/pac4j-dev/36d62795-52e0-49a7-a320-8ac7df568231n%40googlegroups.com.

[Ioan Eugen Stan]

Merci :)