Path: csiph.com!weretis.net!feeder4.news.weretis.net!news.albasani.net!.POSTED!not-for-mail
From: "Karl.Frank" <Karl.Frank@Freecx.co.uk>
Newsgroups: comp.lang.java.programmer
Subject: Why is Java 7 converting the Password toCharArray instead of Byte in it's PBKDF2 function?
Date: Tue, 15 May 2018 20:15:40 +0200
Organization: albasani.net
Lines: 123
Message-ID: <pdf84d$btn$1@news.albasani.net>
References: <pdf0kv$uom$1@news.albasani.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 8bit
X-Trace: news.albasani.net I4hcqx/661zZo3aerVvZfFugfE+rFmh3Y+03LQWzkkNXd/N1FFWQVHD8/AMq8i+npKDEfqV5pxXMXn0jcFxNdYTOPPBB8Xngr3MwjlSYD07jTyUptlnkWR+EQb9cpVQe
NNTP-Posting-Date: Tue, 15 May 2018 18:15:41 +0000 (UTC)
Injection-Info: news.albasani.net; logging-data="huwEKRwARlMhBnFirfDWtJieuumvVH5glEmc2RpB5F5rY7cya+BaNdJh/VgtqEQmFBqDc8FB6NxtplcihlyLZFwT4fDLJRoOWyag/bpWt0hjTvUl7ev6uUt0fPz1yd5c"; mail-complaints-to="abuse@albasani.net"
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.0
In-Reply-To: <pdf0kv$uom$1@news.albasani.net>
Cancel-Lock: sha1:dBcwjoxrhotWku2JjW1o0am7+N8=
Xref: csiph.com comp.lang.java.programmer:38255

I've stuck with getting potential wrong results from a Java 7
implementation.

If I call a test function like

echo -n "Lsda[¥~§#€]" | java -jar pbkdf2_stdin.jar "Salt" 4096 16 sha-1

I get

Password   : Lsda[¥~§#€]
Password   : 4c7364615bc2a57ec2a723e282ac5d
Salt       : 53616c74
PBKDF2     : aba223d6679ad1e8101c01bf860f788b
PBKDF2_java: 461f05924a7945a652bcabb30d87fad3

whereupon PBKDF2 is the result given be my own PBKDF2 implementation and
PBKDF2_java what I get using the javax library.

So I'm wondering if converting the Password into a char array instead of
a byte array might be the correct approach.

Verified the PBKDF2 result at
https://asecuritysite.com/encryption/PBKDF2z and I get:
aba223d6679ad1e8101c01bf860f788b

Can anyone give me a hint on this matter?




Below is the explaination on how I call the functions.

---------8<-----------------------------------------

   basicFunctions  bf = new basicFunctions();
   cryptoFunctions cf = new cryptoFunctions();

   if (System.in.available() > 0) {
     String hashType, PBKDF2_Result, Password, Salt;
     int dkLen, c;
     int BuffSize = System.in.available();

     byte[] pwByte = new byte[BuffSize];
     System.in.read(pwByte, 0, BuffSize);
     Password = bf.byteArrToString(pwByte);
     Salt     = argv[0];
     c        = Integer.parseInt(argv[1]);
     dkLen    = Integer.parseInt(argv[2]);
     hashType = argv[3];

     System.err.println("Password   : " + bf.byteArrToString(pwByte));
     System.err.println("Password   : " + 
bf.byteArrToHexString(Password.getBytes()));
     System.err.println("Salt       : " + 
bf.byteArrToHexString(Salt.getBytes()));

     PBKDF2_Result = bf.byteArrToHexString( cf.PBKDF2(hashType, 
Password.getBytes(), Salt.getBytes(), c, dkLen) );
     System.err.println("PBKDF2     : " + PBKDF2_Result);

     PBKDF2_Result = bf.byteArrToHexString( pbkdf2_javax(Password, Salt, 
c, dkLen) );
     System.err.println("PBKDF2_java: " + PBKDF2_Result);

     }
   else {
     System.err.printf("Pass data via stdin.\n");
   }

--------->8-----------------------------------------

Inhere the password is read from stdin into a byte array (pwByte), then
converted into a string (Password), because the javax PBKDF2 function
does not accept a byte array for the password parameter, whereas it does
for the salt.

My own PBKDF2 implementation however is only accepting byte arrays for
password and salt, because I prefer staying on the byte level in regards
of cryptography.

bf.byteArrToString(), bf.byteArrToHexString() and cf.PBKDF2 are some
functions of my own functions lib that simply do as they are named.


In addtion this is the PBKDF2 function of javax

---------8<-----------------------------------------

   public static byte[] pbkdf2_javax(String String password, String 
salt, int iterations, int dkLen) {
     byte[] derivedKey = new byte[dkLen];
     try {
       SecretKeyFactory f = 
SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1");
       KeySpec ks  = new PBEKeySpec(password.toCharArray(), 
salt.getBytes(), iterations, dkLen*8);
       SecretKey s = f.generateSecret(ks);
       derivedKey  = s.getEncoded();
       }
     catch (Exception e) {
       e.printStackTrace();
     }

     return derivedKey;
   }

--------->8-----------------------------------------

For example calling the test program like below does give the correct 
result for both functions output.

echo -n "The quick brown fox jumps over the lazy dog" | java -jar 
pbkdf2_stdin.jar "Salt" 4096 16 sha-1

PBKDF2     : cf93699a512044c1bc788699cc986f88
PBKDF2_java: cf93699a512044c1bc788699cc986f88



-- 
cHNiMUBACG0HAAAAAAAAAAAAAABIZVbDdKVM0w1kM9vxQHw+bkLxsY/Z0czY0uv8/Ks6WULxJVua
zjvpoYvtEwDVhP7RGTCBVlzZ+VBWPHg5rqmKWvtzsuVmMSDxAIS6Db6YhtzT+RStzoG9ForBcG8k
G97Q3Jml/aBun8Kyf+XOBHpl5gNW4YqhiM0=