Package io.keikai.model.impl.sys

Class PasswordHashUtil

java.lang.Object

io.keikai.model.impl.sys.PasswordHashUtil

public final class PasswordHashUtil
extends Object

Static utility for the two Excel password-hashing algorithms used by sheet/workbook protection. Replaces the small subset of POI's CryptoFunctions we need without pulling POI onto the Keikai compile classpath.

Since:

7.0.0

Method Summary

Modifier and Type	Method	Description
static int	createXorVerifier1(String password)	Computes Excel's legacy 16-bit XOR password verifier for pre-2007 worksheet/workbook protection.
static byte[]	hashPassword(String password, String algName, byte[] salt, int spinCount)	Computes the OOXML iterated SHA password hash.
static byte[]	hashPassword(String password, String algName, byte[] salt, int spinCount, boolean iteratorFirst)	Computes the OOXML iterated SHA password hash.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

createXorVerifier1

public static int createXorVerifier1(String password)

Computes Excel's legacy 16-bit XOR password verifier for pre-2007 worksheet/workbook protection. Returns the value as a 16-bit unsigned int packed into the low 16 bits of an int (so the caller can safely (short) v without sign issues).

Algorithm: ECMA-376 Part 4 §3.2.29. Iterate password bytes in reverse, rotate-left within bits 0-14 with bit 15 fed back, XOR each byte; finish with rotate + XOR password length, then XOR with magic constant 0xCE4B.

hashPassword

public static byte[] hashPassword(String password,
 String algName,
 byte[] salt,
 int spinCount)

Computes the OOXML iterated SHA password hash. Equivalent to POI's CryptoFunctions.hashPassword(p, alg, salt, spinCount) with default iteratorFirst = true.

hashPassword

public static byte[] hashPassword(String password,
 String algName,
 byte[] salt,
 int spinCount,
 boolean iteratorFirst)

Computes the OOXML iterated SHA password hash.

Algorithm: ECMA-376 Part 1 §18.2.29: H_0 = HASH(salt || password_utf16le); for i in 0..spinCount-1: H_{i+1} = HASH(iterator_i_le || H_i) when iteratorFirst is true (read protection), or HASH(H_i || iterator_i_le) otherwise (write protection).

Parameters:

password - the user-typed password (UTF-16 LE encoded before hashing)

algName - hash algorithm friendly name: "SHA-1", "SHA-256", "SHA-384", "SHA-512" (case-insensitive)

salt - random salt bytes from the saltValue attribute (already base64-decoded by the caller)

spinCount - number of hash iterations

iteratorFirst - true for read protection (sheet/workbook), false for write protection