Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.java.programmer > #38390

Re: Why is Java 7 converting the Password toCharArray instead of Byte in it's PBKDF2 function?

Cross-posted to 2 groups.

Show key headers only | View raw

On 18.06.18 18:41, Robert Klemme wrote:
> On 15.05.2018 23:37, Karl.Frank wrote:
>> Holy moley! It's a buggy Java Library I'm currently using!!
>
> You are converting a byte array to a String without explicit mention of
> the encoding. Maybe the way Java picks up the default encoding has
> changed between versions. Anyway, this is an unsafe practice.
>
Robert, probably that might be the case.

In regards of cryptography I always tend to stay on the byte level. This
way my own implementation of HMAC and PBKDF2 has no need to bother with
string encoding when reading in from stdin or files. Curiously Java's
PBKDF2 expect a string or char array rather than a byte array and
therefore I need the extra conversion. Actually from now on my own
functions will be used instead.

It might be a different matter if the user type in password and/or salt
in some GUI. In this case however I would define the kind of strings
accepted and later convert them into byte arrays before processing them
further.


> Also, you are reading only once, there is the chance that there is still
> data in the pipe which you will miss. Even worse, depending on how data
> is written to stdin you might even get different results. This might not
> be an issue for your test program, but could be if you use this code in
> production.
>
Well, yes I read only once from stdin and store the result in a byte
array. How do you suppose to read twice?

The amount of byte to read is exactly defined by

   int BuffSize = System.in.available();
   byte[] pwByte = new byte[BuffSize];
   System.in.read(pwByte, 0, BuffSize);

How would the program read more byte than necessary?

As data on stdin is always byte and all my programs read in byte and
never ever strings in my opinion it doesn't matter how these byte are
written and piped by any previous instance or program.


> Btw. I find your habit of using names beginning with an uppercase letter
> for variables confusing. Conventionally these are reserved for classes
> and interfaces.
>
Yeah, it's old habit. Manly because I do not program much in Java
actually. What I do is translating my important crypto functions for
example into Java or Python in order to check that they will produce the
exact same results and comply with given test vectors.


>> So my own implementation works correctly - what a relieve!
>
> There are cases where wrong code emits correct results - and this
> surfaces only later, when the input or some other environmental factor
> changes.
>
That's one reason why I tend to run large and extensive tests before my
program go into a production environment. Until today I've never
experienced any real problem. Even in this case I'd implement my own
HMAC and PBKDF2 and therefore found the "buggy" Java lib. Sadly the
developer of the original program some years ago didn't check that and
now everyone is baffled that we can't decrypt old files with the
correctly working PBKDF2 implementation.


> Regards
>
> robert
>
>
Cheers,
Karl



-- 
cHNiMUBACG0HAAAAAAAAAAAAAABIZVbDdKVM0w1kM9vxQHw+bkLxsY/Z0czY0uv8/Ks6WULxJVua
zjvpoYvtEwDVhP7RGTCBVlzZ+VBWPHg5rqmKWvtzsuVmMSDxAIS6Db6YhtzT+RStzoG9ForBcG8k
G97Q3Jml/aBun8Kyf+XOBHpl5gNW4YqhiM0=

Back to comp.lang.java.programmer | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Re: Why is Java 7 converting the Password toCharArray instead of Byte in it's PBKDF2 function? "Karl.Frank" <Karl.Frank@Freecx.co.uk> - 2018-05-15 23:37 +0200
  Re: Why is Java 7 converting the Password toCharArray instead of Byte in it's PBKDF2 function? "Karl.Frank" <Karl.Frank@Freecx.co.uk> - 2018-05-16 15:58 +0200
  Re: Why is Java 7 converting the Password toCharArray instead of Byte in it's PBKDF2 function? Robert Klemme <shortcutter@googlemail.com> - 2018-06-18 18:41 +0200
    Re: Why is Java 7 converting the Password toCharArray instead of Byte in it's PBKDF2 function? "Chris M. Thomasson" <invalid_chris_thomasson@invalid.invalid> - 2018-06-18 13:33 -0700
    Re: Why is Java 7 converting the Password toCharArray instead of Byte in it's PBKDF2 function? "Karl.Frank" <Karl.Frank@Freecx.co.uk> - 2018-06-19 12:54 +0200
      Re: Why is Java 7 converting the Password toCharArray instead of Byte in it's PBKDF2 function? Lothar Kimmeringer <news201705@kimmeringer.de> - 2018-06-19 22:18 +0200
        Re: Why is Java 7 converting the Password toCharArray instead of Byte in it's PBKDF2 function? Robert Klemme <shortcutter@googlemail.com> - 2018-06-19 23:20 +0200
        Re: Why is Java 7 converting the Password toCharArray instead of Byte in it's PBKDF2 function? "Karl.Frank" <Karl.Frank@Freecx.co.uk> - 2018-06-19 23:23 +0200
      Re: Why is Java 7 converting the Password toCharArray instead of Byte in it's PBKDF2 function? Robert Klemme <shortcutter@googlemail.com> - 2018-06-19 23:15 +0200
        Re: Why is Java 7 converting the Password toCharArray instead of Byte in it's PBKDF2 function? "Karl.Frank" <Karl.Frank@Freecx.co.uk> - 2018-06-20 00:03 +0200

csiph-web