Path: csiph.com!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail From: Robert Klemme Newsgroups: sci.crypt,comp.lang.java.programmer Subject: Re: Why is Java 7 converting the Password toCharArray instead of Byte in it's PBKDF2 function? Date: Mon, 18 Jun 2018 18:41:55 +0200 Lines: 31 Message-ID: References: Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-Trace: individual.net E4aebdeQeyk8rfKJntg97wkBi6B1eiKX53EBDqbWAE1xCV2rA= Cancel-Lock: sha1:DjMSuoJ/IuI+oorvWovavk+Ib9s= User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.8.0 In-Reply-To: Content-Language: en-US Xref: csiph.com sci.crypt:43711 comp.lang.java.programmer:38388 On 15.05.2018 23:37, Karl.Frank wrote: > Holy moley! It's a buggy Java Library I'm currently using!! You are converting a byte array to a String without explicit mention of the encoding. Maybe the way Java picks up the default encoding has changed between versions. Anyway, this is an unsafe practice. Also, you are reading only once, there is the chance that there is still data in the pipe which you will miss. Even worse, depending on how data is written to stdin you might even get different results. This might not be an issue for your test program, but could be if you use this code in production. Btw. I find your habit of using names beginning with an uppercase letter for variables confusing. Conventionally these are reserved for classes and interfaces. > So my own implementation works correctly - what a relieve! There are cases where wrong code emits correct results - and this surfaces only later, when the input or some other environmental factor changes. Regards robert -- remember.guy do |as, often| as.you_can - without end http://blog.rubybestpractices.com/