IssueTracker

https://android.googlesource.com/platform/frameworks/base/+/HEAD/core/java/com/android/internal/widget/LockPatternUtils.java.

Also see http://groups.google.com/group/android-security-discuss/browse_thread/thread/2eca2318d3daa56c for more comments on the file.

Not mentioned in the comments from Android Security Discuss: a PBKDF or memory-hard function should be used in 2012. Solar Designer (author of John the Ripper) provides a nice treatment of state of the art at http://www.openwall.com/presentations/PHDays2012-Password-Security/PHDays2012-Password-Security.pdf.

771.    public byte[] passwordToHash(String password) {
772.        if (password == null) {
773.            return null;
774.        }
775.        String algo = null;
776.        byte[] hashed = null;
777.        try {
778.            byte[] saltedPassword = (password + getSalt()).getBytes();
779.            byte[] sha1 = MessageDigest.getInstance(algo = "SHA-1").digest(saltedPassword);
780.            byte[] md5 = MessageDigest.getInstance(algo = "MD5").digest(saltedPassword);
781.            hashed = (toHex(sha1) + toHex(md5)).getBytes();
782.        } catch (NoSuchAlgorithmException e) {
783.            Log.w(TAG, "Failed to encode string because of missing algorithm: " + algo);
784.        }
785.        return hashed;
786.    }