我正在使用Bouncy Castle实现Argon2id,因为它允许设置参数和盐,而不是解析输出。
下面的完整程序使用了4个参数集 - 这些参数来自PHP的OpenSSL实现,但您当然可以单独选择参数。
由于该程序来自跨平台项目,它使用了一个固定的盐,这是不安全的 - 在生产环境中,您需要使用随机生成的盐。
这是一个输出:
Generate a 32 byte long encryption key with Argon2id
password: secret password
salt (Base64): AAAAAAAAAAAAAAAAAAAAAA==
encryptionKeyArgon2id (Base64) minimal: e9G7+HHmftUaCEP2O1NwCSJkfyAT0QBzod3Szm1elf0=
encryptionKeyArgon2id (Base64) interactive: FZcsUwo7wf7V24qWTwKeSN9//+Pxy2gCKN35KZX2hXs=
encryptionKeyArgon2id (Base64) moderate: gdizE6kia1W/CgTA3bRKKjtaf8cgZL1BIe6jeDegg0c=
encryptionKeyArgon2id (Base64) sensitive: 19Uym9wI6e/l5f0NocZmNEaouoHvsSyVfrp9iRYl/C8=
代码:
import org.bouncycastle.crypto.generators.Argon2BytesGenerator;
import org.bouncycastle.crypto.params.Argon2Parameters;
import java.nio.charset.StandardCharsets;
import java.security.SecureRandom;
import java.util.Base64;
public class Argon2id {
public static void main(String[] args) {
System.out.println("Generate a 32 byte long encryption key with Argon2id");
String password = "secret password";
System.out.println("password: " + password);
byte[] salt = generateFixedSalt16Byte();
System.out.println("salt (Base64): " + base64Encoding(salt));
String encryptionKeyArgon2id = base64Encoding(generateArgon2idMinimal(password, salt));
System.out.println("encryptionKeyArgon2id (Base64) minimal: " + encryptionKeyArgon2id);
encryptionKeyArgon2id = base64Encoding(generateArgon2idInteractive(password, salt));
System.out.println("encryptionKeyArgon2id (Base64) interactive: " + encryptionKeyArgon2id);
encryptionKeyArgon2id = base64Encoding(generateArgon2idModerate(password, salt));
System.out.println("encryptionKeyArgon2id (Base64) moderate: " + encryptionKeyArgon2id);
encryptionKeyArgon2id = base64Encoding(generateArgon2idSensitive(password, salt));
System.out.println("encryptionKeyArgon2id (Base64) sensitive: " + encryptionKeyArgon2id);
}
public static byte[] generateArgon2idMinimal(String password, byte[] salt) {
int opsLimit = 2;
int memLimit = 8192;
int outputLength = 32;
int parallelism = 1;
Argon2Parameters.Builder builder = new Argon2Parameters.Builder(Argon2Parameters.ARGON2_id)
.withVersion(Argon2Parameters.ARGON2_VERSION_13)
.withIterations(opsLimit)
.withMemoryAsKB(memLimit)
.withParallelism(parallelism)
.withSalt(salt);
Argon2BytesGenerator gen = new Argon2BytesGenerator();
gen.init(builder.build());
byte[] result = new byte[outputLength];
gen.generateBytes(password.getBytes(StandardCharsets.UTF_8), result, 0, result.length);
return result;
}
public static byte[] generateArgon2idInteractive(String password, byte[] salt) {
int opsLimit = 2;
int memLimit = 66536;
int outputLength = 32;
int parallelism = 1;
Argon2Parameters.Builder builder = new Argon2Parameters.Builder(Argon2Parameters.ARGON2_id)
.withVersion(Argon2Parameters.ARGON2_VERSION_13)
.withIterations(opsLimit)
.withMemoryAsKB(memLimit)
.withParallelism(parallelism)
.withSalt(salt);
Argon2BytesGenerator gen = new Argon2BytesGenerator();
gen.init(builder.build());
byte[] result = new byte[outputLength];
gen.generateBytes(password.getBytes(StandardCharsets.UTF_8), result, 0, result.length);
return result;
}
public static byte[] generateArgon2idModerate(String password, byte[] salt) {
int opsLimit = 3;
int memLimit = 262144;
int outputLength = 32;
int parallelism = 1;
Argon2Parameters.Builder builder = new Argon2Parameters.Builder(Argon2Parameters.ARGON2_id)
.withVersion(Argon2Parameters.ARGON2_VERSION_13)
.withIterations(opsLimit)
.withMemoryAsKB(memLimit)
.withParallelism(parallelism)
.withSalt(salt);
Argon2BytesGenerator gen = new Argon2BytesGenerator();
gen.init(builder.build());
byte[] result = new byte[outputLength];
gen.generateBytes(password.getBytes(StandardCharsets.UTF_8), result, 0, result.length);
return result;
}
public static byte[] generateArgon2idSensitive(String password, byte[] salt) {
int opsLimit = 4;
int memLimit = 1048576;
int outputLength = 32;
int parallelism = 1;
Argon2Parameters.Builder builder = new Argon2Parameters.Builder(Argon2Parameters.ARGON2_id)
.withVersion(Argon2Parameters.ARGON2_VERSION_13)
.withIterations(opsLimit)
.withMemoryAsKB(memLimit)
.withParallelism(parallelism)
.withSalt(salt);
Argon2BytesGenerator gen = new Argon2BytesGenerator();
gen.init(builder.build());
byte[] result = new byte[outputLength];
gen.generateBytes(password.getBytes(StandardCharsets.UTF_8), result, 0, result.length);
return result;
}
private static byte[] generateSalt16Byte() {
SecureRandom secureRandom = new SecureRandom();
byte[] salt = new byte[16];
secureRandom.nextBytes(salt);
return salt;
}
private static byte[] generateFixedSalt16Byte() {
byte[] salt = new byte[16];
return salt;
}
private static String base64Encoding(byte[] input) {
return Base64.getEncoder().encodeToString(input);
}
}
Argon2BytesGenerator
类,而不是Argon2PasswordEncoder
类? - Austin Brown