HashGUI: Hash Utility GUI

By Mitch Stuart
Copyright © 2005 FullSpan Software  -  Usage subject to license
Software Version: 1.0  -  Document Version: $Revision: 1.1 $, $Date: 2005/03/18 08:16:14 $

Introduction

It might seem like overkill to have an entire GUI program just to deal with passwords and hash values. But imagine if we used a text-mode (console) program: how would we allow the user to input private data, like passwords?

• We could use a command line argument, but on a multi-user or networked machine, that is vulnerable to command line snooping (for example, the ps command on Unix systems).
• We could prompt the user to type in the value. Unfortunately, one of the limitations of the Java platform is that there is not a good cross-platform way to do no-echo console input. There is a longstanding bug report requesting this enhancement. There are some workarounds for this issue, such as password masking, or using native (platform specific) code, but I'm not fond of those methods.

I decided to write a GUI program to avoid the console-mode issues mentioned above, plus the fact that I wanted a user-friendly, self-explanatory program.

Getting HashGUI

• Download a package including binary JAR files, source code, and documentation:   [hashgui.zip]   [hashgui.tar.gz]
• Browse the JavaDoc (generated with the -linksource option which allows you to also browse the source code)

Background and Terminology

Salt Values
A salt value is an additional input (besides the original plaintext) into a hash function. Using a salt makes the hash value more secure.

Base64
Hash and salt values are made up of binary data. To work with such values in a user interface like HashGUI, they need to be encoded in a way that makes them easy to read and type. HashGUI uses the Base64 encoding.

Installing and Running HashGUI

To run HashGUI, open a shell or command window and type the following command:

   java -jar HASHGUI_DIR/build/lib/hashgui.jar

Windows
Once you have confirmed that HashGUI runs properly by manually entering the above command, you might want to do one or more of the following:

• Create a batch file to launch the program.
• Create a desktop shortcut to launch the program. For help on this, search for "create shortcut" in Windows Help.
• Use javaw instead of java in the command line. This tells the Java environment that you are running a graphical program, so it will not require a text-mode command window.

Unix (Linux or other)
Once you have confirmed that HashGUI runs properly by manually entering the above command, you might want to do one or more of the following:

• Create a shell script to launch the program.
• Create a shell alias to launch the program.
• Create a desktop icon to run the program. Refer to your operating system documentation for information on how to do this.

Using HashGUI

Menu Screen
The menu screen (below) shows the functions that are available in HashGUI. The input(s) and output(s) of each function are listed. Click the associated button to access the function. For example, click button 3 to access the value generation screen described in the next section.

Value Generation Screen
When you click button 3 on the menu screen, you will see the value generation screen below. This screen:

• Generates a random plaintext string (such as a password)
• Generates a random salt value
• Computes the hash value of the generated plaintext using the generated salt

You can click the Compute button to repeat the above process. Each time you click Compute, new values will be generated.

Click the Back button to go back to the menu, or the Exit button to exit HashGUI.

When you first access this screen, the default values will be present in the editable fields. You can type over these values to specify your own:

• Plaintext Characters. These are the characters that the random plaintext will be created from. You should have a reasonably large set of characters to choose from. The default set is the upper and lower case letters, plus numbers. Some letters and numbers have been purposely excluded: for example, the letter l (el) and the number 1 (one) can be confused depending on the case of the letter and the font being used, so these characters are not in the default set.
• Characters per Group. The default mode for random plaintext generation is to generate characters in groups with a separator, such as: abc-456-def. Having the separators makes random text easier to read and type. This parameter specifies how many characters will be in each group.
• Number of Groups. This parameter specifies how many groups will be in the generated string. If you just want a string of random characters with no separators, you can set this value to 1.
• Group Separator. This parameter specifies the separator that will appear between the groups.

Building HashGUI

HashGUI was programmed using the NetBeans 4.0 development environment and GUI builder. To build HashGUI using NetBeans, open the top-level HashGUI directory as a NetBeans project. NetBeans will automatically detect the presence of the nbproject subdirectory, and will allow you to import and build the project.

License and External Libraries

HashGUI is released under the FullSpan license. HashGUI uses the FSJUtil library, which is released under the same license.

In addition, HashGUI uses the following external libraries, which are distributed under license from their copyright holders: