menzy wrote:
别人的东西，给你看看

/**
 * This is the one-way hash using SHA1. See javadoc on the class to get
 * more methods.
 *
 * This also uses two internal classes from SUN for base 64 encoding. There is
 * another lib from HP too, but they are not officially in java lib and may not
 * be compatible in the future, use in your own risk.
 */
import java.security.*;

import sun.misc.BASE64Encoder;
import sun.misc.BASE64Decoder;

public class MessageDigestTesting
{
    /**
     * This method uses SHA1 to hash the input string and then output the base
     * 64 encoded string of the hashed string.
     * @param dataToHash the string to be hashed
     * @return the base 64 hashed string or null if SHA1 is not available.
     */
    public static String hashSHA1String(String dataToHash)
    {
        String tmp = null;

        try
        {
            //One-way hash
            MessageDigest md = MessageDigest.getInstance("SHA1");
            byte[] byteTmpe = md.digest(dataToHash.getBytes());

            //base 64 encoding, using sun's internal lib
            BASE64Encoder b64encoder = new BASE64Encoder();
            tmp = b64encoder.encode(byteTmpe);
        }
        catch (java.security.NoSuchAlgorithmException e)
        {
            //silence and return null
        }
        
        return tmp;
    }

    public static void main(String[] args)
    {
        String a = "abcdefg";
        String b = "abcdefghijk";
        String c = "abcdefg";

        String aa = hashSHA1String(a);
        String bb = hashSHA1String(b);
        String cc = hashSHA1String(c);

        System.out.println("aa==" + aa);
        System.out.println("bb==" + bb);
        System.out.println("cc==" + cc);
        System.out.println("check a==c: " + aa.equals(cc));
    }
}

/**
  * This is the one-way hash using SHA1. See javadoc on the class to get
  * more methods.
  * This also uses two internal classes from SUN for base 64 encoding. There is
  * another lib from HP too, but they are not officially in java lib and may not
  * be compatible in the future, use in your own risk.
  */
import java.security.*;
import java.security.NoSuchAlgorithmException;
import sun.misc.BASE64Encoder;
import sun.misc.BASE64Decoder;

public class MessageDigestTesting
{
  /**
    * This method uses SHA1 to hash the input string and then output the base
    * 64 encoded string of the hashed string.
    * @param dataToHash the string to be hashed
    * @return the base 64 hashed string or null if SHA1 is not available.
    */
  public static String hashSHA1String(String dataToHash)
  {
    String tmp = null;
    /*
    * While this hashing prevents an attacker from reading the passwords in
    * clear text, the hashed passwords are still open to a so called dictionary
    * attack. The attacker compiles a database of common passwords and their
    * hash value and looks up the hash values. If he finds a match he knows
    * the corresponding password.
    * Even the designers of UNIX noticed this and added a field called "salt"
    * to the passwd file. The salt is a number that is prepended to the
    * password before the hash function is called.
    * */
    String salt = "abcedefghijklmnopqrstuvwxyz";

    try
    {
      //One-way hash
      MessageDigest md = MessageDigest.getInstance("SHA1");
      md.update(salt.getBytes());
      byte[] byteTmpe = md.digest(dataToHash.getBytes());

      //base 64 encoding, using sun's internal lib
        BASE64Encoder b64encoder = new BASE64Encoder();
        tmp = b64encoder.encode(byteTmpe);
    }
    catch (NoSuchAlgorithmException e)
    {
      //silence and return null
        }

    return tmp;
    }

  /**
   * User cases:
   * 1. In addition to salt, you should use iterations of the hash to protect
   *    against brute force attacks on a single password.
     * 2. Unless you know this, ignore for now.
   *    This one is safe:
   *        com.sun.crypto.provider.PBEWithMD5AndTripleDESCipher
   *    This one is not safe:
   *        PBEWithMD5AndDES
   * @param args
   */
  public static void main(String[] args)
  {
    String a = "abcdefg";
    String b = "abcdefghijk";
    String c = "abcdefg";
    String aa = hashSHA1String(a);
    String bb = hashSHA1String(b);
    String cc = hashSHA1String(c);
    String aaa = hashSHA1String(aa); //hash a twice
    System.out.println("aa==" + aa);
    System.out.println("bb==" + bb);
    System.out.println("cc==" + cc);
    System.out.println("aaa==" + aaa);
    System.out.println("check a==c: " + aa.equals(cc));
    }
}

floater wrote:
Also, the number of iterations of hashing is used to make it harder to crack.

floater wrote:
Sorry for the wording, I was kind of rush.

Just hash it several times, like the String aaa in the main() in the above.
For example, get a string A, hash it, get B, then hash it again, get C. So from A to C, the number of iteration is 2. Varying this number would also make the dictionary attack harder since the attacker needs to know how many times you hashed in order to build a dictionary.