密码加密方法永远不会为相同的参数返回相同的结果

Question

I have found code leveraging java.security.* in order to encrypt passwords. But when I use it, It's not working. Each time I call the encrypt method with the same parameters (which are displayed in the encrypt() method, and are really each time the same), I get a different result, which of course makes the code useless. Here my code:

public byte[] encrypt(String clearPassword, byte[] salt) throws NoSuchAlgorithmException, InvalidKeySpecException {
    System.out.println(clearPassword+"     **********     "+salt);
    String algorithm = "PBKDF2WithHmacSHA1";
    int derivedKeyLength = 1600;
    int iterations = 20000;

    KeySpec spec = new PBEKeySpec(clearPassword.toCharArray(), salt, iterations, derivedKeyLength);
    SecretKeyFactory f = SecretKeyFactory.getInstance(algorithm);
    byte [] truc = f.generateSecret(spec).getEncoded();
    System.out.println(truc);
    return truc;
}

public byte[] generateSalt() throws NoSuchAlgorithmException {
    SecureRandom random = SecureRandom.getInstance("SHA1PRNG");
    byte[] salt = new byte[8];
    random.nextBytes(salt);

    return salt;
}

I think I introduced an error in the original code at some point, but I can't see where. Any idea?

Answer 1

It's because System.out.println(truc); does not do what you think it does. If you tried:

System.out.println(Arrays.toString(truc));

you would print the actual content of the array, which should be the same every time you call the method with the same parameters.

See for example: printing arrays