Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.java.programmer > #38389

Re: Why is Java 7 converting the Password toCharArray instead of Byte in it's PBKDF2 function?

Cross-posted to 2 groups.

Show all headers | View raw

On 6/18/2018 9:41 AM, Robert Klemme wrote:
> On 15.05.2018 23:37, Karl.Frank wrote:
>> Holy moley! It's a buggy Java Library I'm currently using!!
> 
> You are converting a byte array to a String without explicit mention of 
> the encoding.  Maybe the way Java picks up the default encoding has 
> changed between versions.  Anyway, this is an unsafe practice.
[...]

Yup. For instance, I had to alter my Python test vector to use 
bytearrays without default encoding in order for it go get in perfect 
sync with a C analog.

https://groups.google.com/forum/#!original/sci.crypt/2K33_4GjkVs/Ws6bWE-aAQAJ
(read all for context...)

The C code:

https://pastebin.com/raw/feUnA3kP

The Python Test vector:

https://pastebin.com/raw/NAnsBJAZ

Notice the following code in the Python version:
___________________________________
if (M == False):
     U = bytearray([P_byte, C_I_P]);
     H.update(U);
else:
     U = bytearray([C_I_P, P_byte]);
     H.update(U);
___________________________________

Here is the equivalent C code in the ct_crypt_round function:
___________________________________
if (M == 0)
{
     unsigned char update[2] = {
         P_byte, C_byte
     };

     hmac_sha256_update(&H, update, 2);
}

else
{
     unsigned char update[2] = {
         C_byte, P_byte
     };

     hmac_sha256_update(&H, update, 2);
}
___________________________________


Now, there is a way to get a different result in the Python test 
vector... Use the default encoding! Afaict, it can change on different 
impls. Example:
___________________________________
if (M == False):
     H.update(P.bytes[I_P].encode());
     H.update(chr(C_I_P).encode());
else:
     H.update(chr(C_I_P).encode());
     H.update(P.bytes[I_P].encode());
___________________________________

NO! This is unsafe. I need to correct my code in my paper:

http://funwithfractals.atspace.cc/ct_cipher/

that uses the .encode() function to the one that uses bytearrays. Damn 
it.. Sorry!

I had a weary feeling about using default encoding, but finally verified 
it when I worked on getting the C version and Python test vector in 
perfect sync. Please keep in mind that one needs to define 
PYTHON_TEST_VECTOR in my C code to sync it up with the Python test vector.

Back to comp.lang.java.programmer | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Re: Why is Java 7 converting the Password toCharArray instead of Byte in it's PBKDF2 function? "Karl.Frank" <Karl.Frank@Freecx.co.uk> - 2018-05-15 23:37 +0200
  Re: Why is Java 7 converting the Password toCharArray instead of Byte in it's PBKDF2 function? "Karl.Frank" <Karl.Frank@Freecx.co.uk> - 2018-05-16 15:58 +0200
  Re: Why is Java 7 converting the Password toCharArray instead of Byte in it's PBKDF2 function? Robert Klemme <shortcutter@googlemail.com> - 2018-06-18 18:41 +0200
    Re: Why is Java 7 converting the Password toCharArray instead of Byte in it's PBKDF2 function? "Chris M. Thomasson" <invalid_chris_thomasson@invalid.invalid> - 2018-06-18 13:33 -0700
    Re: Why is Java 7 converting the Password toCharArray instead of Byte in it's PBKDF2 function? "Karl.Frank" <Karl.Frank@Freecx.co.uk> - 2018-06-19 12:54 +0200
      Re: Why is Java 7 converting the Password toCharArray instead of Byte in it's PBKDF2 function? Lothar Kimmeringer <news201705@kimmeringer.de> - 2018-06-19 22:18 +0200
        Re: Why is Java 7 converting the Password toCharArray instead of Byte in it's PBKDF2 function? Robert Klemme <shortcutter@googlemail.com> - 2018-06-19 23:20 +0200
        Re: Why is Java 7 converting the Password toCharArray instead of Byte in it's PBKDF2 function? "Karl.Frank" <Karl.Frank@Freecx.co.uk> - 2018-06-19 23:23 +0200
      Re: Why is Java 7 converting the Password toCharArray instead of Byte in it's PBKDF2 function? Robert Klemme <shortcutter@googlemail.com> - 2018-06-19 23:15 +0200
        Re: Why is Java 7 converting the Password toCharArray instead of Byte in it's PBKDF2 function? "Karl.Frank" <Karl.Frank@Freecx.co.uk> - 2018-06-20 00:03 +0200

csiph-web