Coding Interview Questions

import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.PBEKeySpec;
import java.security.MessageDigest;
import java.util.Base64;

public class Main {
    static final int ITERATIONS = 100_000;

    static byte[] pbkdf2(String password, byte[] salt, int iterations) throws Exception {
        PBEKeySpec spec = new PBEKeySpec(password.toCharArray(), salt, iterations, 256);
        return SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256").generateSecret(spec).getEncoded();
    }

    static String encode(String password, byte[] salt) throws Exception {
        Base64.Encoder b64 = Base64.getEncoder().withoutPadding();
        return "pbkdf2$" + ITERATIONS + "$" + b64.encodeToString(salt) + "$"
            + b64.encodeToString(pbkdf2(password, salt, ITERATIONS));
    }

    static boolean matches(String raw, String stored) throws Exception {
        String[] parts = stored.split("\\$");
        int iterations = Integer.parseInt(parts[1]);
        byte[] salt = Base64.getDecoder().decode(parts[2]);
        byte[] expected = Base64.getDecoder().decode(parts[3]);
        return MessageDigest.isEqual(expected, pbkdf2(raw, salt, iterations));
    }

    public static void main(String[] args) throws Exception {
        byte[] saltA = "salt-for-asha-01".getBytes();   // demo only: use SecureRandom
        byte[] saltB = "salt-for-ravi-02".getBytes();
        String asha = encode("Mumbai@123", saltA);
        String ravi = encode("Mumbai@123", saltB);
        System.out.println("asha stored: " + asha);
        System.out.println("ravi stored: " + ravi);
        System.out.println("Same password, same hash? " + asha.equals(ravi));
        System.out.println("asha logs in with Mumbai@123 -> " + matches("Mumbai@123", asha));
        System.out.println("asha logs in with mumbai@123 -> " + matches("mumbai@123", asha));
    }
}

asha stored: pbkdf2$100000$c2FsdC1mb3ItYXNoYS0wMQ$IkP9y0UjQ0rBlJ056H3OA7Znhka223Sl+7z3hBL4F14
ravi stored: pbkdf2$100000$c2FsdC1mb3ItcmF2aS0wMg$cxr7VT0FSQJjQ1pXIUfNKcmNAfcIstr2DPnNHbeiIV4
Same password, same hash? false
asha logs in with Mumbai@123 -> true
asha logs in with mumbai@123 -> false

Key points to say: unique salt per user (defeats rainbow tables), many iterations (slow brute force), constant-time comparison, and parameters stored with the hash so they can be raised later.

import java.util.*;

public class Main {
    static final int MAX_FAILURES = 3;
    static final long WINDOW_SEC = 15 * 60, LOCK_SEC = 30 * 60;
    static final Map<String, Deque<Long>> failures = new HashMap<>();
    static final Map<String, Long> lockedUntil = new HashMap<>();
    static final Map<String, String> passwords = Map.of("[email protected]", "Mumbai@123");

    static String login(String user, String password, long now) {
        Long until = lockedUntil.get(user);
        if (until != null && now < until) return "LOCKED (try after t=" + until + ")";
        if (password.equals(passwords.get(user))) {
            failures.remove(user);
            lockedUntil.remove(user);
            return "SUCCESS";
        }
        Deque<Long> times = failures.computeIfAbsent(user, k -> new ArrayDeque<>());
        times.addLast(now);
        while (!times.isEmpty() && now - times.peekFirst() > WINDOW_SEC) times.pollFirst();
        if (times.size() >= MAX_FAILURES) {
            lockedUntil.put(user, now + LOCK_SEC);
            times.clear();
            return "BAD CREDENTIALS -> account locked";
        }
        return "BAD CREDENTIALS (" + times.size() + "/" + MAX_FAILURES + ")";
    }

    public static void main(String[] args) {
        String u = "[email protected]";
        long[] times = {0, 60, 120, 180, 2000};
        String[] tries = {"wrong1", "wrong2", "wrong3", "Mumbai@123", "Mumbai@123"};
        for (int i = 0; i < times.length; i++) {
            System.out.printf("t=%-5d %-11s -> %s%n", times[i], tries[i], login(u, tries[i], times[i]));
        }
    }
}

t=0     wrong1      -> BAD CREDENTIALS (1/3)
t=60    wrong2      -> BAD CREDENTIALS (2/3)
t=120   wrong3      -> BAD CREDENTIALS -> account locked
t=180   Mumbai@123  -> LOCKED (try after t=1920)
t=2000  Mumbai@123  -> SUCCESS

In Spring Security, record failures in an ApplicationListener<AuthenticationFailureBadCredentialsEvent> and return accountNonLocked = false from UserDetails; DaoAuthenticationProvider then throws LockedException.