Take the 2-minute tour ×
Stack Overflow is a question and answer site for professional and enthusiast programmers. It's 100% free, no registration required.

This is what I see in hudson/users/me/config.xml:

[...]
<hudson.security.HudsonPrivateSecurityRealm_-Details>
  <passwordHash>mEDUyJ:0c9e6f2556b9b3a0b9e9046c21490422b4a54877f057b527b2c0bd4dc83342d5</passwordHash>
</hudson.security.HudsonPrivateSecurityRealm_-Details>
[...]

What is the algorithm (if SHA1, than what is the mEDUyJ prefix)? How can I get this hash in PHP, for example?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

The source code responsible for this is found in the hudson.security.HudsonPrivateSecurityRealm class (more specifically, the PasswordEncoder inner class).

Consider your example:

mEDUyJ:0c9e6f2556b9b3a0b9e9046c21490422b4a54877f057b527b2c0bd4dc83342d5

The prefix (mEDUyJ) is actually a six-letter salt. A salt can be any six-letter permutation of uppercase letters and lowercase letters.

Hudson uses the Acegi Security library. More specifically, it uses that library's ShaPasswordEncoder class. It's basically doing this:

String salt = generateSomeSixLetterSalt() // Fictional function
String passwordHash = salt + ":" + new ShaPasswordEncoder(256).encodePassword(password, salt);

Once you view the source code for ShaPasswordEncoder, you find this it's essentially doing this:

// Fictional functions ahead...
String salt = generateSomeSixLetterSalt()
String passwordHash = salt + ":" + hex_encode(sha256_hash(utf8_encode(password + "{" + salt + "}")))
share|improve this answer
    
@Vincenzo: You're welcome! I like finding out how software "stores" passwords. –  Adam Paynter Dec 5 '10 at 12:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.