Adding a Salt in the password Field When Creating a Node

Python

To salt a password in the Python 3.7.7 environment, perform the following steps:

NOTE:

The python crypt package has compatibility issues in macOS. If the package cannot be executed, run it in Linux.

1. Add \ before $ in the salt. Generate a ciphertext password based on the updated salt.

   python3 -c "import crypt;print(crypt.crypt('******', crypt.mksalt()))"
2. Encode the value of the password field using Base64.

   echo -n '******' | base64 | tr "\n" " " | sed s/[[:space:]]//g

Java

To salt a password in the Java environment, perform the following steps:

1. Obtain a random number as the salt.

       private static String getCharAndNumr(int length) {
           String val = "";
           Random random = new SecureRandom();
           for (int i = 0; i < length; i++) {
               // Indicates whether to output letters or digits.
               String charOrNum = random.nextInt(2) % 2 == 0 ? "char" : "num";
               // Character string
               if ("char".equalsIgnoreCase(charOrNum)) {
                   // Indicates whether an upper-case or lower-case letter is obtained.
                   int choice = random.nextInt(2) % 2 == 0 ? 65 : 97;
                   val += (char) (choice + random.nextInt(26));
               } else if ("num".equalsIgnoreCase(charOrNum)) {// Digit
                   val += String.valueOf(random.nextInt(10));
               }
           }
           return val;
       }
2. Generate a salt.

       private static String generateSalt() {
           String salt;
           try {
               salt = "$6$" + getCharAndNumr(16);
           }catch (Exception e){
               salt = defaultSalt;
           }
   
           return salt;
       }
3. Generate a ciphertext password based on the salt.

       public static String getSaltPassword(String password) {
           if(StringUtils.isBlank(password)) {
               throw new BizException("password is empty");
           }
   
           String salt = generateSalt();
   
           Crypt crypt = new Crypt();
           return crypt.crypt(password, salt);
       }
4. Encode the value of the password field using Base64.

   (Base64.getEncoder().encodeToString(AddSaltPasswordUtil.getSaltPassword(cceNodeCreateVo.getPassword()).getBytes()))
5. A complete example is as follows:

   import java.util.Base64;
   import java.util.Random;
   import java.security.SecureRandom;
   
   import org.apache.commons.codec.digest.Crypt;
   import org.apache.commons.lang.StringUtils;
   
   public class PassWord {
       
       static String defaultSalt = null;
       
       public static void main(String[] args) throws Exception {
           System.out.println(Base64.getEncoder().encodeToString(PassWord.getSaltPassword("Custom password").getBytes()));
       }   
       
       
   	//Generate a ciphertext password based on the salt.
       public static String getSaltPassword(String password) throws Exception {
           if(StringUtils.isBlank(password)) {
               throw new Exception("password is empty");
           }
           String salt = generateSalt();
           return Crypt.crypt(password, salt);
       }
       
   	//Generate a salt.
       private static String generateSalt() {
           String salt;
           try {
               salt = "$6$" + getCharAndNumr(16);
           }catch (Exception e){
               salt = defaultSalt;
           }
           return salt;
       }
       
   	//Obtain a random number as the salt.
       private static String getCharAndNumr(int length) {
           String val = "";
           Random random = new SecureRandom();
           for (int i = 0; i < length; i++) {
               // Indicates whether to output letters or digits.
               String charOrNum = random.nextInt(2) % 2 == 0 ? "char" : "num";
               // Character string
               if ("char".equalsIgnoreCase(charOrNum)) {
                   // Indicates whether an upper-case or lower-case letter is obtained.
                   int choice = random.nextInt(2) % 2 == 0 ? 65 : 97;
                   val += (char) (choice + random.nextInt(26));
               } else if ("num".equalsIgnoreCase(charOrNum)) {// Digit
                   val += String.valueOf(random.nextInt(10));
               }
           }
           return val;
       }
   }

Go

You can use either of the following methods to salt passwords for the Go language:

• https://github.com/amoghe/go-crypt
• https://github.com/GehirnInc/crypt