Path: csiph.com!feeder.erje.net!1.eu.feeder.erje.net!news.albasani.net!.POSTED!not-for-mail From: "Karl.Frank" Newsgroups: sci.crypt,comp.lang.java.programmer Subject: Re: Why is Java 7 converting the Password toCharArray instead of Byte in it's PBKDF2 function? Date: Wed, 16 May 2018 15:58:16 +0200 Organization: albasani.net Lines: 42 Message-ID: References: Mime-Version: 1.0 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit X-Trace: news.albasani.net PgdXi2x3GbCY9KT2Mgb7zU+HNB0enYI2BGLcHCXiggJQaEe97nmL0Um9tx9yK/8pZ6SNFpudtnX63ZeQ7KT7+A== NNTP-Posting-Date: Wed, 16 May 2018 13:58:17 +0000 (UTC) Injection-Info: news.albasani.net; logging-data="MYQQZwV+FVteOqECQiBfbmpulySTQB3QV1fcegZuzN4vAtFgunWj2y3uP5NpMy5NJPh17KYfCMmOcSAIKddaa6gT0mZy8CC0I3Tx+kxnpODjMXMedwOD+c1M2h17pi4O"; mail-complaints-to="abuse@albasani.net" User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.0 In-Reply-To: Cancel-Lock: sha1:PKkqU3iOKghqJiESOSv4sv/gnLU= Xref: csiph.com sci.crypt:43458 comp.lang.java.programmer:38260 On 15.05.18 23:37, Karl.Frank wrote: > Holy moley! It's a buggy Java Library I'm currently using!! > > ### > > echo $LANG > en_US.UTF-8 > > echo -n '¥' | xxd -g1 > 0000000: c2 a5 > > ### > > java version "1.6.0_17" > Java(TM) SE Runtime Environment (build 1.6.0_17-b04-248-9M3125) > Java HotSpot(TM) 64-Bit Server VM (build 14.3-b01-101, mixed mode) > > echo -n "Lsda[¥~§#€]" | java -jar pbkdf2_stdin.jar "Salt" 4096 16 sha-1 > Password : Lsda[¥~§#€] > Password : 4c7364615bc2a57ec2a723e282ac5d > Salt : 53616c74 > PBKDF2 : aba223d6679ad1e8101c01bf860f788b > PBKDF2_java: 461f05924a7945a652bcabb30d87fad3 > For God sake, all files encrypted by the application based on the buggy Java version have a wrong encryption and MAC key now. So I can't simply update the old application as expected. I can't believe how such a Java version could ever being published at all! A conclusion might be implementing all crypto primitives needed by a certain program from scratch and run intense vector and other useful tests in order to avoid such a mess in the future by any potential buggy Java update. I'm really pissed. :-( -- cHNiMUBACG0HAAAAAAAAAAAAAABIZVbDdKVM0w1kM9vxQHw+bkLxsY/Z0czY0uv8/Ks6WULxJVua zjvpoYvtEwDVhP7RGTCBVlzZ+VBWPHg5rqmKWvtzsuVmMSDxAIS6Db6YhtzT+RStzoG9ForBcG8k G97Q3Jml/aBun8Kyf+XOBHpl5gNW4YqhiM0=