MD5编码结果不同

Question

I've run into this weird issue with MD5 encodings. Actually, before everyone jumps in to tell me not to use MD5: it's a legacy system and the algorithm has already been chosen.

Anyway - I have a MySQL table with the MD5 hashed password stored. In the same table, the salt is also stored.

I have a test user, whose password is "test" and the salt is "salt" . Using MySQLs MD5 function (select md5('testsalt')) , I found the hash to be "315240c61218a4a861ec949166a85ef0" . I also verified this expected result with the admin of an external PHP system that sends user information to our system.

In one module of the system, we calculate MD5 hashes using this code:

    public static String md5EncryptString(String string, String salt) {
    MessageDigest messageDigest;
    String encryptString = string + salt;
    String result;
    try {
        messageDigest = MessageDigest.getInstance("MD5");
        messageDigest.reset();
        messageDigest.update(encryptString.getBytes(Charset.forName("UTF8")));
        final byte[] resultByte = messageDigest.digest();
        result = new String(Hex.encodeHex(resultByte));
        return result;
    } catch (NoSuchAlgorithmException e) {
        logger.error("NoSuchAlgorithmException in encryptString");
        result = encryptString;
    }
    return result;
}

This method outputs the exact same md5 hash.

I then configured an Md5PasswordEncoder in the Spring security part of this sytem and ran into problems, because it would not let me log in. By extending the Md5PasswordEncoder class and overriding the encodePassword() method with some logging, I was able to determine that it outputs a different md5 hash: "150671e7a5fb8ace58aaa012de7f9b5c" when given the same password ("test") and salt ("salt") .

Can anyone explain this or give me some hint on what might be causing this?

Answer 1

According to some sources on Github Spring merges password and salt this way:

return password + "{" + salt.toString() + "}";

See method mergePasswordAndSalt(..) in BasePasswordEncoder.java