public boolean checkPassword ( final String iPassword , final String iHash ) { if ( iHash . startsWith ( HASH_ALGORITHM_PREFIX ) ) { final String s = iHash . substring ( HASH_ALGORITHM_PREFIX . length ( ) ) ; return createSHA256 ( iPassword ) . equals ( s ) ; } else if ( iHash . startsWith ( PBKDF2_ALGORITHM_PREFIX ) ) { final String s = iHash . substring ( PBKDF2_ALGORITHM_PREFIX . length ( ) ) ; return checkPasswordWithSalt ( iPassword , s , PBKDF2_ALGORITHM ) ; } else if ( iHash . startsWith ( PBKDF2_SHA256_ALGORITHM_PREFIX ) ) { final String s = iHash . substring ( PBKDF2_SHA256_ALGORITHM_PREFIX . length ( ) ) ; return checkPasswordWithSalt ( iPassword , s , PBKDF2_SHA256_ALGORITHM ) ; } // Do not compare raw strings against each other, to avoid timing attacks. // Instead, hash them both with a cryptographic hash function and // compare their hashes with a constant-time comparison method. return MessageDigest . isEqual ( digestSHA256 ( iPassword ) , digestSHA256 ( iHash ) ) ; }
Checks if an hash string matches a password based on the algorithm found on hash string .