ITI0011:harjutus 16

Kirjeldus

Kirjutada programm, mis loeb etteantud properties-failist kasutajanime ja parooli ning salvestab turvalisema variandi teise faili. Teise faili salvestatakse sama kasutaja andmed, aga parool on soolatud räsina (salted hash). Mõlemad failid on properties-tüüpi failid (vt viiteid allpool).

Algne fail (user.properties):

username=Juku
password=raskeparool123

Teie peate implementeerima failist lugemise ja kirjutamise meetodid. Failist lugemise jaoks readDataFromFile, mis loeb kõik võti-väärtus paarid ning salvestab need HashMap tüüpi andmestruktuuri, kus näiteks meie näite puhul tekiks üks element, mille võti oleks "username" ja väärtus oleks "Juku". Faili kirjutamise jaoks on vaja implementeerida kaks meetodit: saveNewUserData ja saveDataToFile. saveDataToFile on üldisem meetod, mis kirjutab etteantud võti-väärtus paarid properties-tüüpi faili. Ehk siis selles meetodis peab olema faili kirjutamise osa. saveNewUserData on vahemeetod, mis võtab ette antud ülesande jaoks olulised andmed. Need andmed tuleb teisendada kujutiseks, mis saadetakse edasi saveDataToFile meetodisse. Allolevas mallis on kujutise osa null, selle asemel peaks olema aga instants HashMap tüüpi andmestruktuurist, kuhu on sisse pandud kõik vajalikud väljad.

Programm kontrollib, kas on olemas räsitud parooliga fail "newUser.properties". Kui see puudub, siis tehakse see fail SaveNewUserData meetodiga. Uues failis peavad olema võtmesõnad: "username", "password" ja "salt". Kui aga käivitamisel eksisteerib "newUser.properties" mõnest eelnevast käitamisest, siis programm kutsub esile authenticate meetodi, mis laseb kasutajal parooli pakkuda.

Esmalt oleks mõistlik realiseerida readDataFromFile meetod, kuna uue faili andmed on otseses sõltuvuses meie antud faili sisust - mida võib vabalt muuta, aga kindlasti peavad olema võtmesõnad "username" ja "password". Meetod readDataFromFile peab tagastama HashMap tüüpi objekti, mille võtmed ja väärtused on täpselt need, mis user.properties failis.

Lugemine soolatud räsimise kohta: https://crackstation.net/hashing-security.htm

Kui pikad tekstid pole päris Teie rada, siis järgmine link on ka piisav lugemine: http://security.stackexchange.com/questions/51959/why-are-salted-hashes-more-secure

Kiire ülevaade Java Propertiesist: http://www.mkyong.com/java/java-properties-file-examples/

Mall

<source lang="java">

/**

* Created by odin on 20.04.15.
*/

import java.io.*; import java.security.MessageDigest; import java.util.HashMap; import java.util.Properties; import java.util.Scanner;

public class FromTemplate {

   public static final String INPUT_FILE   = "user.properties";
   public  static final String OUTPUT_FILE  = "newUser.properties";
   public static final int LENGTH_OF_SALT  = 10;
   public static final int MAX_CHANCES_COUNT = 3;

   public static void main(String[] args) {
       try {
           // check whether a user with a hashed password already exists
           if(new File(OUTPUT_FILE).isFile()) {
               HashMap<String, String> data = readDataFromFile(OUTPUT_FILE);
               if (data == null) {
               	System.out.println("Data from " + OUTPUT_FILE + " cannot be read");
               	System.exit(2);
               }
               String username = data.get("username");
               String password = data.get("password");
               String salt     = data.get("salt");
               authenticate(username, password, salt);
           } else {
               // "register" new user with salted hash
               HashMap<String, String> data = readDataFromFile(INPUT_FILE);
               if (data == null) {
               	System.out.println("data cannot be read");
               	System.out.println("(file does not exist, is corrupted, "
               			+ "or readUserDataFromFile not implemented).");
               	System.out.println("Exiting.");
               	System.exit(1);
               }
               String username = data.get("username");
               String password = data.get("password");
               String salt     = md5MyString("saltyRandomString").substring(0, LENGTH_OF_SALT);
               password        = md5MyString(password + salt);
               boolean result = saveNewUserData(username, password, salt);
               if (!result) {
               	System.out.println("Storing hashed data did not work properly.");
               	System.exit(3);
               }
           }
       } catch (Exception e) {
           e.printStackTrace();
       }
   }

   public static void authenticate(String username, String password, String salt) throws Exception {
       Scanner userInput = new Scanner(System.in);
       String guess;
       System.out.println("Hello, You now have " + MAX_CHANCES_COUNT + " chances to guess " + username + "'s password.");
       int chances;
       for (chances = MAX_CHANCES_COUNT - 1; chances >= 0; chances--) {
           guess = userInput.next();
           if (md5MyString(guess + salt).equals(password)) {
               System.out.println("That's correct!");
               break;
           } else if (chances > 0) {
               System.out.println("That's invalid! " + chances + " guess" + (chances > 1 ? "es" : "") + " left.");
           }
       }
       if (chances < 0)
           System.out.println("Sorry, You didn't guess " + username + "'s password");
   }

   /**
    * Reads all the properties from the given input file and returns 
    * a key-value mapping of the contents in the file.
    * In case the file is corrupted or something goes wrong, returns null.
    * @param filename File to be read.
    * @return Hash map of settings in the file, NULL if something goes wrong.
    */
   public static HashMap<String, String> readDataFromFile(String filename) {
       return null;
   }

   /**
    * Writes username, password and salt values to 
    * the corresponding keys (username, password, salt).
    * in the file OUTPUT_FILE.
    * In case the data is successfully stored, returns true.
    * If something goes wrong, returns false.
    * You have to use saveData method inside this method.
    * You have to modify the call to saveData in order to
    * pass the correct key-value map. The actual writing
    * will be done in saveData method.
    * @param username The value of username.
    * @param password The value of hashed password.
    * @param salt The value of salt.
    * @return true if data is stored, false otherwise.
    */
   public static boolean saveNewUserData(String username, String password, String salt) {
   	// TODO: data to be saved
   	return saveData(OUTPUT_FILE, null);
   }
   
   /**
    * Writes key-values from data into properties file which is given
    * by filename. If the file does not exist, the file is created.
    * @param filename The file name to be saved.
    * @param data The data to be stored in the file.
    * @return true, if the file is successfully stored, false otherwise.
    */
   public static boolean saveData(String filename, HashMap<String, String> data) {
   	return false;
   }
   /*
   * Maagia, sellest ei pea aru saama.
   * tl;dr:
   * Hashimist on vaja, et andmete hoiustamisel poleks
   * privaatsed andmed (loe: paroolid) lihtsasti loetavad
   * */
   public static String md5MyString(String str) throws Exception {
       MessageDigest m = MessageDigest.getInstance("MD5");
       m.update(str.getBytes("UTF8"));
       byte s[] = m.digest();
       String result = "";
       for (int i = 0; i < s.length; i++) {
           result += Integer.toHexString((0x000000ff & s[i]) | 0xffffff00).substring(6);
       }
       return result;
   }

} </source>