spring-security

Commit Graph

Author	SHA1	Message	Date
Rob Winch	0f612bf637	Add crypto PasswordEncoder from 5.0.x Fixes: gh-5302	8 years ago
Antoine	21efbb6ba7	Polish AssertJ assertions Fixes gh-4770	8 years ago
Joris Portegies Zwart	d48079eb19	JavaDoc for Pbkdf2PasswordEncoder refer to constants Fix Javadoc so that it uses the actual values for default hash width and number of iterations Fixes gh-4768	8 years ago
SendilKumar N	c31bdb6390	SCryptPasswordEncoder to take default keyLength value Fixes gh-4225 Closes gh-4231	9 years ago
Rob Winch	bb834bccf6	Polish Exception Message Polish Exception message for bad salt in BCrypt Issue gh-4147	9 years ago
Jan Brennenstuhl	09436649cc	handling null-values for salts properly now - fixes gh-4147	9 years ago
Kazuki Shimizu	a1f771251a	Improve exception message on Hex#decode Fixes gh-4043	10 years ago
Rob Winch	8f880aea0e	Polish Pbkdf2PasswordEncoder Issue gh-3930	10 years ago
vitaliy_kuzmich	5f658b3ffc	Remove double salt in Pbkdf2PasswordEncoder Issue gh-3930	10 years ago
Eddú Meléndez	a2ead4cf7a	Polish Fixes gh-3892	10 years ago
Kim Saabye Pedersen	9fcfeaf225	BCryptPasswordEncoder validates strength Fixes gh-3862	10 years ago
Will Tran	b01437281d	Bouncy Castle 1.47 Support This forces us to avoid using CipherOutputStream, and instead use the BlockCiphers directly. As an extra measure for correctness, test the equivalence of the BC implementations against data sizes from 1 to 2048 bytes. Fixes gh-2917	10 years ago
Will Tran	44fa624b6b	Refactor test assumptions about JCE to common class. (#3817 ) Apply assumptions directly to test methods instead of checking for key length in crypto.gradle.	10 years ago
Will Tran	40208127e8	Skip tests when AesBytesEncryptor can't be created in CBC or GCM mode. (#3816 ) Tests would fail in cases where JCE unlimited strength was available but GCM wasn't, like on JDK7.	10 years ago
Will Tran	63b2cfe1cf	Bouncy Castle implementations of AES-256 Adds "AES/CBC/PKCS5Padding" and "AES/GCM/NoPadding" Fixes gh-2917	10 years ago
Rob Winch	95a3e30d9f	Polish Pbkdf2PasswordEncoder Fixes gh-2158 Fixes gh-51	10 years ago
Rob Worsnop	0ab7126e64	Added PBKDF2PasswordEncoder. - Also moved some logic into a new class, AbstractPasswordEncoder. Both PBKDF2PasswordEncoder and the now-simplified StandardPasswordEncoder extend AbstractPasswordEncoder. - Added tests for PBKDF2PasswordEncoder Issue gh-2158	10 years ago
Rob Winch	f221920a19	Clean up code to conform to basic checkstyle Issue gh-3746	10 years ago
Billy Korando	71d4ce96ad	Convert to assertj Fixes gh-3175	10 years ago
Rob Winch	bb600a473e	Start AssertJ Migration Issue gh-3175	10 years ago
Rob Winch	8fbc7e0d2c	Fix SCryptPasswordEncoder javadoc Issue gh-3702	10 years ago
Rob Winch	fc75a679d9	Polish SCryptPasswordEncoder * JKD8 Base64 -> Spring Security's Base64 to continue to support older JDKs * Spaces to tabs * Javadoc cleanup * Remove of @Override to compile in Eclipse Issue gh-3702	10 years ago
Shazin	7d02e259df	Add SCryptPasswordEncoder Fixes gh-3702	10 years ago
Rob Winch	69274d9aa8	SEC-2521: Improve StandardPasswordEncoder performance	10 years ago
Thomas Darimont	ad1d858e2b	SEC-3056 - Fix JavaDoc errors. Fixed JavaDoc errors accross multiple modules in order to make javadoc happy with Java 8.	11 years ago
Andrew Barchuk	3832647ecf	Remove unused imports	11 years ago
Rob Winch	3db01bd9d6	SEC-3002: Add JUnit Assume to GCM encryption tests Not all JDKs have GCM installed on them.	11 years ago
Dave Syer	a48cc18858	SEC-3002: Add new option for AES encryption with GCM The Galois Counter Mode (GCM) is held to be superior than the current default CBC. This change adds an extra parameter to the constructor of AesBytesEncryptor and a new convenience method in Encryptors.	11 years ago
Rob Winch	ae6af5d73c	SEC-2915: Updated Java Code Formatting	11 years ago
Luke Taylor	743960d2d8	SEC-2122: Fix broken integration tests. Modified BCryptPasswordEncoder to no longer throw an IllegalArgumentException when the encoded password is empty or the incorrect format for bcrypt. Instead it now logs a warning that non bcrypt data was found. The Dms integration tests were failing after being changed to use bcrypt and this fixes the issue.	13 years ago
Luke Taylor	d6524feb62	SEC-2122: Change doc to prioritize bcrypt use	13 years ago
Rob Winch	a6bded86c2	SEC-1990: Polishing code cleanup on BCrypt - Formatting - Renamed test to be BCryptTests to better align with Spring Security's naming conventions	14 years ago
Joseph Walton	14a5135ac3	SEC-1990: Clean up jBCrypt and include its tests. Merge in changes from jBCrypt. - Use a ByteArrayOutputStream to cache bytes. - Pass a StringBuilder into encode_base64. - Refactor string comparison into its own method. - General clean up.	14 years ago
Luke Taylor	3760d792ea	SEC-1890: Add checks for validity of stored bcrypt hash When checking for a match, the BCryptPasswordEncoder validates the stored hash against a pattern to check that it actually is a bcrypt value.	14 years ago
Dave Syer	8565116f20	SEC-1472: Add crypto wrappers for BCrypt	14 years ago
Luke Taylor	45d938566c	Some tests for Base64 encoding.	15 years ago
Luke Taylor	89b7b2b935	SEC-1764: Remove use of Java 6 method Arrays.copyOfRange.	15 years ago
Luke Taylor	e27f655e9d	SEC-1689: Re-instate crypto as separate library (for use in non-Spring Security apps), as well as packaging with core.	15 years ago
Luke Taylor	50828cdd43	SEC-1689: Move crypto module code to core for simplicity.	15 years ago
Rob Winch	8c08eeb57b	SEC-1666: Use constant time comparison for sensitive data. Constant time comparison helps to mitigate timing attacks. See the following link for more information * http://rdist.root.org/2010/07/19/exploiting-remote-timing-attacks/ * http://en.wikipedia.org/wiki/Timing_attack for more information.	15 years ago
Rob Winch	2e822e9abe	SEC-1659: Ensure that Digester is returning digest(digest(value)...) instead of digesting the same value multiple times. Make it so that the Digester returns digest(digest(value)...) instead of digesting the same value multiple times. This alligns with the OWASP recommendations at http://www.owasp.org/index.php/Hashing_Java#Hardening_against_the_attacker.27s_attack	15 years ago
Luke Taylor	162cb64baa	SEC-1659: Label crypto utils package as only for internal use.	15 years ago
Keith Donald	b646e44646	SEC-1659: fixed bundlor step of build	15 years ago
Keith Donald	ea76efdb2c	SEC-1659: favor AES encryption instead of DES as standard symmetric encryption algorithm	15 years ago
Keith Donald	ffa7301e7f	SEC-1569: initial commit of spring-security-crypto module, consisting of encrypt, keygen, password, and util packages	15 years ago

46 Commits (7974f3161dd80b3752eae49fed7f33cdc41b0da9)