@ Override protected boolean validatePassword ( String inputPassword , String expectedPassword ) { boolean verifyOK = false ; for ( ; ; ) { // single point of exit if ( inputPassword == null || expectedPassword == null ) { break ; } PBKDF2Parameters p = getEngineParameters ( ) ; if ( p == null ) { break ; } PBKDF2Formatter f = getFormatter ( ) ; if ( f == null ) { break ; } if ( f . fromString ( p , expectedPassword ) ) { break ; } PBKDF2 pBKDF2Engine = getEngine ( p ) ; if ( pBKDF2Engine == null ) { break ; } verifyOK = pBKDF2Engine . verifyKey ( inputPassword ) ; break ; } return verifyOK ; }
Actual salt - enabled verification function . Get parameters from database password then compute candidate derived key from user - supplied password and parameters then compare database derived key and candidate derived key . Login if match .