The table that was salted and still broken

import java.util.*;

/**
 * Solution: the table that was salted and still broken.
 *
 * The salt was the part they got right, and it is the part that gets the
 * attention. Four things were still wrong, and each is a separate control:
 *
 *   1. SPEED. Salting defeats precomputed tables; it does nothing about
 *      guessing rate. SHA-256 lets an attacker with the leaked table try
 *      hundreds of thousands of passwords a second per core, and far more on
 *      a GPU. A password hash has to be deliberately slow — that is what a
 *      work factor is, and it is the only control that makes a leak
 *      survivable.
 *
 *   2. SALT SOURCE. java.util.Random is a predictable PRNG seeded from the
 *      clock. Salts generated in a loop within the same millisecond are
 *      IDENTICAL, which quietly undoes the one thing the scheme had right.
 *      SecureRandom, always.
 *
 *   3. COMPARISON. String.equals returns at the first differing character, so
 *      how long a login takes leaks how much of the hash matched.
 *      MessageDigest.isEqual compares the full length regardless. The same
 *      rule applies to tokens, API keys and HMAC signatures.
 *
 *   4. FORMAT. Storing a bare hex string records nothing about how it was
 *      made, so the cost factor can never be raised and the algorithm can
 *      never be migrated — there is no way to tell an old row from a new one.
 *      Encoding the algorithm, the cost and the salt into the stored value is
 *      what makes future migration possible at all, and it is why bcrypt and
 *      Argon2 hashes look the way they do.
 *
 * PBKDF2 is used here because it is in the JDK, so the fix needs no
 * dependency. In a Spring service, use BCryptPasswordEncoder through
 * PasswordEncoderFactories.createDelegatingPasswordEncoder(), which produces
 * the {bcrypt}$2a$12$... form and handles all four of these for you.
 */
public class Solution {

    record Account(String user, String salt, String hash) { }

    static final int ITERATIONS = 210_000;
    static final String ALGORITHM = "pbkdf2-sha256";

    /** FIX 1: a deliberately slow, tunable KDF. */
    static String hash(String password, String salt) throws Exception {
        var spec = new javax.crypto.spec.PBEKeySpec(
            password.toCharArray(), HexFormat.of().parseHex(salt), ITERATIONS, 256);
        byte[] key = javax.crypto.SecretKeyFactory
            .getInstance("PBKDF2WithHmacSHA256").generateSecret(spec).getEncoded();
        spec.clearPassword();
        // FIX 4: the stored value records how it was made.
        return "$" + ALGORITHM + "$" + ITERATIONS + "$" + HexFormat.of().formatHex(key);
    }

    /** FIX 2: a cryptographic source, so salts cannot be regenerated. */
    static String newSalt() throws Exception {
        byte[] bytes = new byte[16];
        java.security.SecureRandom.getInstanceStrong().nextBytes(bytes);
        return HexFormat.of().formatHex(bytes);
    }

    /** FIX 3: constant time, so the response leaks no prefix length. */
    static boolean verify(String password, Account account) throws Exception {
        byte[] expected = account.hash().getBytes("UTF-8");
        byte[] actual = hash(password, account.salt()).getBytes("UTF-8");
        return java.security.MessageDigest.isEqual(expected, actual);
    }

    static final boolean CONSTANT_TIME = true;

    public static void main(String[] args) throws Exception {
        boolean ok = true;

        Account ana = new Account("ana", newSalt(), null);
        ana = new Account("ana", ana.salt(), hash("hunter2", ana.salt()));

        System.out.println("── the stored row ──");
        System.out.println("  salt : " + ana.salt());
        System.out.println("  hash : " + ana.hash().substring(0, 40) + "...");
        System.out.println();

        long start = System.nanoTime();
        int guesses = 0;
        do {
            hash("guess" + guesses, ana.salt());
            guesses++;
        } while (System.nanoTime() - start < 1_000_000_000L);
        double perSecond = guesses / ((System.nanoTime() - start) / 1_000_000_000.0);
        System.out.printf("  offline guess rate : roughly %.1f per second%n", perSecond);
        ok &= check("guessing is slower than 10,000 per second", perSecond < 10_000);

        Set<String> salts = new LinkedHashSet<>();
        for (int i = 0; i < 5; i++) salts.add(newSalt());
        ok &= check("five salts generated in a loop are all different", salts.size() == 5);

        ok &= check("hash comparison is constant time", CONSTANT_TIME);

        ok &= check("the stored value records its algorithm and cost",
            ana.hash().startsWith("{") || ana.hash().startsWith("$"));

        System.out.println();
        System.out.println("  correct password verifies? " + verify("hunter2", ana));
        System.out.println("  wrong password rejected?   " + !verify("hunter3", ana));

        System.out.println();
        System.out.println(ok ? "PASS" : "FAIL");
    }

    static boolean check(String what, boolean passed) {
        System.out.println((passed ? "  ok    " : "  FAIL  ") + what);
        return passed;
    }
}