Encrypt Password

사용자의 비밀번호는 모두 강력한 암호화 기법을 사용해 암호화 해야한다.

일반적인 방법으로 단방향 암호화 기법인 MD5를 사용하는데, 이 알고리즘은 출현한지 오래되어 이미 해킹이 가능한 수준이 되어 더 이상 안전한 방법이 아니다.

일반적으로 AES / SHA / DES를 많이 사용하는데 DES 알고리즘은 AES 알고리즘이 출현한 이후 더이상 사용하지 않는다.

그런데, 위 AES / SHA / DES 는 메시지 인증 및 무결성 체크를 위한 알고리즘이지, 패스워드 암호화를 위한 알고리즘이 아니다.
따라서, 이 알고리즘들을 패스워드 암호화에 사용한다면 "복호화"가 가능하다는 취약점이 있다.

원래 위 3개 알고리즘은 "단방향"의 복호화가 불가능한 암호화 알고리즘이지만, 이미 많은 해커들이 "복호화"를 시도했고, 그 시도는 성공을 이룬지 오래되었기 때문에 암호화에 사용해서는 안된다.

암호화에 사용되는 기법은 http://helloworld.naver.com/helloworld/textyle/318732 에서 소개하고 있는 PBKDF2 / bcrypt / scrypt 중 하나를 사용한다.

본 예제는 bscrypt를 사용하고 있다.

좌측 Check Salt 를 클릭하면 Salt를 생성하고 기존의 패스워드에 Salt를 추가해 암호화(Digest) 한다.

EncryptoPasswordController.makeSalt
- Salt 컬럼 추가
- Salt 생성
- Salt 값을 기존 Password에 추가하여 Digest

Salt 값이 추가되면 Login의 로직도 함께 변경되어야 한다

• dispatcherServlet.java 에 csrfInterceptor 주석 처리시켜야 실행 가능하다.

• 암호화 시키는 java 파일 - EncryptoPasswordServiceImpl.java

package kr.co.hucloud.security.code.example.encrypto.password.service.impl;
 
import java.util.List;
 
import org.mindrot.jbcrypt.BCrypt;
 
import kr.co.hucloud.security.code.example.encrypto.password.dao.EncryptoPasswordDAO;
import kr.co.hucloud.security.code.example.encrypto.password.service.EncryptoPasswordService;
import kr.co.hucloud.security.code.example.member.dao.MemberDAO;
import kr.co.hucloud.security.code.example.member.vo.MemberVO;
import kr.co.hucloud.security.code.example.valid.table.dao.TableValidDAO;
 
public class EncryptoPasswordServiceImpl implements EncryptoPasswordService {
 
    private EncryptoPasswordDAO encryptoPasswordDAO;
    private MemberDAO memberDAO;
    private TableValidDAO tableValidDAO;
    
    public void setEncryptoPasswordDAO(EncryptoPasswordDAO encryptoPasswordDAO) {
        this.encryptoPasswordDAO = encryptoPasswordDAO;
    }
 
    public void setMemberDAO(MemberDAO memberDAO) {
        this.memberDAO = memberDAO;
    }
    
    public void setTableValidDAO(TableValidDAO tableValidDAO) {
        this.tableValidDAO = tableValidDAO;
    }
 
    @Override
    public boolean isExistsSaltColumn() {
        return encryptoPasswordDAO.isExistsSaltColumn();
    }
 
    @Override
    public boolean makeSaltColumn() {
        
        tableValidDAO.addSaltColumn();
        
        String salt = "";
        String bcryptPassword = "";
        
        List<MemberVO> memberList = memberDAO.getAllMemberInfo();
        
        // 암호화 시키는 부분
        for(MemberVO member : memberList) {
            salt = BCrypt.gensalt();
            bcryptPassword = BCrypt.hashpw(member.getPassword(), salt);
            member.setSalt(salt);
            member.setPassword(bcryptPassword);
            
            memberDAO.updateMemberPassword(member);
        }
        
        return true;
    }
    
}
 

 

• 암호화를 위한 POM Dependency - pom.xml

    <dependency>
      <groupId>org.mindrot</groupId>
      <artifactId>jbcrypt</artifactId>
      <version>0.3m</version>
    </dependency>
    <dependency>
        <groupId>com.navercorp.lucy</groupId>
        <artifactId>lucy-xss</artifactId>
        <version>1.6.3</version>
    </dependency>

 

• MemberRegistryVO에 salt 추가

package kr.co.hucloud.security.code.example.member.vo;
 
public class MemberRegistryVO {
 
    private String userId;
    private String userPassword;
    private String userPasswordConfirm;
    private String userName;
    private String salt;
    
    public String getSalt() {
        return salt;
    }
    public void setSalt(String salt) {
        this.salt = salt;
    }
    public String getUserId() {
        return userId;
    }
    public void setUserId(String userId) {
        this.userId = userId;
    }
    public String getUserPassword() {
        return userPassword;
    }
    public void setUserPassword(String userPassword) {
        this.userPassword = userPassword;
    }
    public String getUserPasswordConfirm() {
        return userPasswordConfirm;
    }
    public void setUserPasswordConfirm(String userPasswordConfirm) {
        this.userPasswordConfirm = userPasswordConfirm;
    }
    public String getUserName() {
        return userName;
    }
    public void setUserName(String userName) {
        this.userName = userName;
    }
}
 

 

• MemberDAOImpl에 salt 추가

package kr.co.hucloud.security.code.example.member.dao.impl;
 
import java.sql.Connection;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;
import java.util.ArrayList;
import java.util.List;
 
import javax.sql.DataSource;
 
import kr.co.hucloud.security.code.example.common.util.DBCloseUtil;
import kr.co.hucloud.security.code.example.member.dao.MemberDAO;
import kr.co.hucloud.security.code.example.member.vo.LoginVO;
import kr.co.hucloud.security.code.example.member.vo.MemberRegistryVO;
import kr.co.hucloud.security.code.example.member.vo.MemberVO;
 
public class MemberDAOImpl implements MemberDAO {
 
    private DataSource dataSource;
 
    public void setDataSource(DataSource dataSource) {
        this.dataSource = dataSource;
    }
    
    @Override
    public void addMember(MemberRegistryVO memberVO) {
        
        Connection conn = null;
        PreparedStatement pstmt = null;
        
        String query = "INSERT INTO USERS ( " +
                "   USER_ID, USER_NAME, USER_PASSWORD,  " +
                "   IS_ADMIN_YN, CRT_DT, MDFY_DT, SALT)  " +
                "VALUES ( ?, ?, ?, ?, SYSDATE, SYSDATE,?) "; 
        try {
            conn = dataSource.getConnection();
            pstmt = conn.prepareStatement(query);
            pstmt.setString(1, memberVO.getUserId());
            pstmt.setString(2, memberVO.getUserName());
            pstmt.setString(3, memberVO.getUserPassword());
            pstmt.setString(4, "Y");
            pstmt.setString(5, memberVO.getSalt());
            pstmt.execute();
        }
        catch(SQLException sqle) {
            throw new RuntimeException(sqle.getMessage(), sqle);
        }
        finally {
            DBCloseUtil.close(conn, pstmt, null);
        }
        
    }
    
    @Override
    public MemberVO login(LoginVO loginVO) {
        Connection conn = null;
        //Statement stmt = null;
        PreparedStatement stmt = null;
        ResultSet rs = null;
        
        // String query = " SELECT USER_ID, USER_NAME, USER_PASSWORD FROM USER WHERE USER_ID= 
        //                    +"'loginVO.getId()'"+ AND USER_PASSWORD = +"'loginVO.getPassword()'"";
        String query = " SELECT USER_ID, USER_NAME, USER_PASSWORD FROM USERS WHERE USER_ID = ? AND USER_PASSWORD = ?";
        try {
            conn = dataSource.getConnection();
            //stmt = conn.createStatement();
            stmt = conn.prepareStatement(query);
            stmt.setString(1, loginVO.getId());
            stmt.setString(2, loginVO.getPassword());
            
            //rs = stmt.executeQuery(query);
            rs = stmt.executeQuery();
            
            MemberVO memberVO = null;
            
            if(rs.next()) {
                memberVO = new MemberVO();
                memberVO.setId(rs.getString(1));
                memberVO.setUserName(rs.getString(2));
                memberVO.setPassword(rs.getString(3));
            }
            return memberVO;
        }
        catch(SQLException sqle) {
            throw new RuntimeException(sqle.getMessage(), sqle);
        }
        finally {
            DBCloseUtil.close(conn, stmt, rs);
        }
    }
    
    @Override
    public List<MemberVO> getUserInfo(String parameter) {
        Connection conn = null;
        //Statement stmt = null;
        PreparedStatement stmt = null;
        ResultSet rs = null;
        
        List<MemberVO> memberList = new ArrayList<MemberVO>();
        
        String query = " SELECT USER_ID, USER_NAME, USER_PASSWORD FROM USERS WHERE USER_ID = ?";
        try {
            conn = dataSource.getConnection();
            stmt = conn.prepareStatement(query);
            stmt.setString(1, parameter);
            rs = stmt.executeQuery();
            
            MemberVO memberVO = null;
            
            while(rs.next()) {
                memberVO = new MemberVO();
                memberVO.setId(rs.getString(1));
                memberVO.setUserName(rs.getString(2));
                memberVO.setPassword(rs.getString(3));
                memberList.add(memberVO);
            }
            return memberList;
        }
        catch(SQLException sqle) {
            throw new RuntimeException(sqle.getMessage(), sqle);
        }
        finally {
            DBCloseUtil.close(conn, stmt, rs);
        }
        
    }
    
    @Override
    public List<MemberVO> getAllMemberInfo() {
        
        Connection conn = null;
        PreparedStatement stmt = null;
        ResultSet rs = null;
        
        List<MemberVO> memberList = new ArrayList<MemberVO>();
        
        String query = " SELECT USER_ID, USER_PASSWORD FROM USERS ";
        try {
            conn = dataSource.getConnection();
            stmt = conn.prepareStatement(query);
            rs = stmt.executeQuery();
            
            MemberVO memberVO = null;
            
            while(rs.next()) {
                memberVO = new MemberVO();
                memberVO.setId(rs.getString(1));
                memberVO.setPassword(rs.getString(2));
                memberList.add(memberVO);
            }
            return memberList;
        }
        catch(SQLException sqle) {
            throw new RuntimeException(sqle.getMessage(), sqle);
        }
        finally {
            DBCloseUtil.close(conn, stmt, rs);
        }
        
    }
    
    @Override
    public void updateMemberPassword(MemberVO memberVO) {
        Connection conn = null;
        PreparedStatement pstmt = null;
        
        String query = "UPDATE SYSTEM.USERS " +
                        "SET    USER_PASSWORD = ? " +
                        "       , SALT = ? " +
                        "       , MDFY_DT       = SYSDATE " +
                        "WHERE  USER_ID       = ? ";
                
        try {
            conn = dataSource.getConnection();
            pstmt = conn.prepareStatement(query);
            pstmt.setString(1, memberVO.getPassword());
            pstmt.setString(2, memberVO.getSalt());
            pstmt.setString(3, memberVO.getId());
            pstmt.execute();
        }
        catch(SQLException sqle) {
            throw new RuntimeException(sqle.getMessage(), sqle);
        }
        finally {
            DBCloseUtil.close(conn, pstmt, null);
        }
    }
    
    @Override
    public String getSaltById(String id) {
        
        Connection conn = null;
        PreparedStatement stmt = null;
        ResultSet rs = null;
        
        String query = " SELECT SALT FROM USERS WHERE USER_ID = ? ";
        try {
            conn = dataSource.getConnection();
            stmt = conn.prepareStatement(query);
            stmt.setString(1, id);
            rs = stmt.executeQuery();
            
            String salt = "";
            
            if(rs.next()) {
                salt = rs.getString(1);
            }
            
            return salt;
        }
        catch(SQLException sqle) {
            throw new RuntimeException(sqle.getMessage(), sqle);
        }
        finally {
            DBCloseUtil.close(conn, stmt, rs);
        }
    }
    
}
 

• MemberServiceImpl에 addMember 메소드 수정

    @Override
    public void addMember(MemberRegistryVO memberVO) {
        
        if(encryptoPasswordDAO.isExistsSaltColumn()) {
            //String salt = memberDAO.getSaltById(loginVO.getId());
            String salt = BCrypt.gensalt();
            String hashedPassword = BCrypt.hashpw(memberVO.getUserPassword(), salt);
            memberVO.setUserPassword(hashedPassword);
            memberVO.setSalt(salt);
        }
        memberDAO.addMember(memberVO);
    }