SHA-256 Password Hashing for ISMS (Java Module)

PII is usually protected with reversible encryption so it can be encrypted and decrypted when needed. Account passwords are different: they should not be decrypted.

In the past, some systems also used reversible encryption for passwords. That made “forgot password” flows possible by recovering the original password. These days, the usual approach is to reset the password to a random value, send it through email or another verified contact channel, and then ask the user to change it to a password of their choice.

Because the password cannot be decrypted, even the service provider does not know the user’s real password. That reduces security issues for ordinary users. It is also a point that auditors almost always check during accounting audits, ISMS (Information Security Management System) reviews, and similar assessments.

For integrity, cryptographic controls should use a proven one-way algorithm such as a hash function of SHA-256 or stronger, with an encryption key length of at least 128 bits, so the value cannot be decrypted.

Encryption targets: passwords, distributed programs, and similar assets.

Choosing SHA-256

Based on that standard, I used SHA-256. At the time of writing, it still had no known collision attacks and produces a 64-byte hex digest (256 bits).

Oracle 11g does not support SHA-256 in the DBMS_CRYPTO package, so I built a Java module (JAR) instead.

Module source: SHA-256.jar

import java.security.MessageDigest;

public class SHA256 {
    public String encrypt(String str) {
        try {
            // Create a SHA-256 MessageDigest instance
            MessageDigest md = MessageDigest.getInstance("SHA-256");
            // Compute the digest
            md.update(str.getBytes("UTF-8"));
            // Convert the result to uppercase hex and return it
            return byteArrayToHex(md.digest()).toUpperCase();
        } catch (Exception e) {
            return null;
        }
    }

    // byte[] -> hex String
    private String byteArrayToHex(byte[] encrypted) {
        if (encrypted == null || encrypted.length == 0) {
            return null;
        }
        StringBuffer sb = new StringBuffer();
        for (byte b : encrypted) {
            // Format as 2-digit hex, zero-padded
            sb.append(String.format("%02x", b));
        }
        return sb.toString();
    }
}

Caller: Util.java

public class Util {
    public static String getSHA256(String plainText) {
        SHA256 sha256 = new SHA256();
        String encText = null;
        try {
            encText = sha256.encrypt(plainText);
        } catch (Exception e) {
            e.printStackTrace();
        } finally {
            return encText;
        }
    }
}

Usage in the service layer

String passwd = Util.getSHA256(paramData.get("passwd"));