How to Use MD5 Hash for securing Login passwords in JSP with Javascript?

Question

How can I use md5 hashing in the client side to secure the password transmission from the client side (JSP) to a Servlet in the server? The following post seems to answer the question but I can not understand it fully as the code blocks are incomplete. http://www.techlabs4u.com/2010/03/how-to-use-salted-md5-hash-for-securing.html

Answer 1

How can I use md5 hashing in the client side to secure the password transmission from the client side (JSP) to a Servlet in the server?

You can't.

Password hashing is used to avoid storing original passwords so that they are protected in the event of a database compromise. (And MD5 is broken, so you shouldn't use it for that anyway).

To secure the password in transmission, use SSL (via HTTPS).

Answer 2

Hashing and salting a password and then sending the hash in cleartext provides no additional security at all over just sending the password in cleartext. If an attacker is able to intercept the clear text password and log in with it, then they can just as easily intercept the hashed password and log in with that.

It doesn't matter how good the client side code is, or how strong the hash algorithm is - the principle is fundamentally flawed.

As suggested already, use SSL. Instead of sending in cleartext, this will encrypt all transmission between the client and server preventing evesdropping.

Answer 3

If you are looking for complete code for MD5 encryption in Java and JSP, here it is. First create a Java class which can encrypt the text. I created mdjavahash.java as shown below.

package mdhash;

import java.security.*;

public class mdjavahash {
    private String hashpass="";

    public String getHashPass(String password) throws 
        NoSuchAlgorithmException{

        String plainText = password;
        MessageDigest mdAlgorithm = MessageDigest.getInstance("MD5");
        mdAlgorithm.update(plainText.getBytes());

        byte[] digest = mdAlgorithm.digest();
        StringBuffer hexString = new StringBuffer();

        for (int i = 0; i < digest.length; i++) {
            plainText = Integer.toHexString(0xFF & digest[i]);

            if (plainText.length() < 2) {
                plainText = "0" + plainText;
            }

            hexString.append(plainText);
        }
        hashpass = hexString.toString();

        return hashpass;
    }
}

Now you can use mdjavahash class in jsp file to encrypt. For example:

<%@ page import="java.security.*, mdhash.*" %>
<%
  String mypassword = "";

  mdjavahash md = new mdjavahash();

  mypassword = "Hello World";
  out.println("Actual String is : "+mypassword+" <br/>MD5 String is : 
  "+md.getHashPass(mypassword));
%>

And you are done with the encryption in JSP.

Answer 4

If you want such a medium security without using SSL, try this direction:

1. Read the current time
2. Concat the time with the password input by user
3. Generate the hash, md5 is simply one of the hashing algorithm you can choose, not mandatory.
4. POST all of username, timestamp, and the hash to the server.

On server side

1. Collect the three POST variables
2. Check the timestamp, only accept for an agreeable time difference
3. Retrieve the password from the database
4. Calculate the hash in the same way on server side
5. Compare the calculated result against the POST hash

Cons: you need to keep the plain text password on server side

Alternative: pre-hashing the password, and double hash on javascript side during login.