Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.java.programmer > #38255 > unrolled thread

Why is Java 7 converting the Password toCharArray instead of Byte in it's PBKDF2 function?

Back to article view | Back to comp.lang.java.programmer

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Why is Java 7 converting the Password toCharArray instead of Byte in it's PBKDF2 function? "Karl.Frank" <Karl.Frank@Freecx.co.uk> - 2018-05-15 20:15 +0200
    Re: Why is Java 7 converting the Password toCharArray instead of Byte in it's PBKDF2 function? "Karl.Frank" <Karl.Frank@Freecx.co.uk> - 2018-05-15 20:19 +0200
    Re: Why is Java 7 converting the Password toCharArray instead of Byte in it's PBKDF2 function? "Karl.Frank" <Karl.Frank@Freecx.co.uk> - 2018-05-15 20:51 +0200
    Re: Why is Java 7 converting the Password toCharArray instead of Byte in it's PBKDF2 function? "Karl.Frank" <Karl.Frank@Freecx.co.uk> - 2018-05-15 21:45 +0200

#38255 — Why is Java 7 converting the Password toCharArray instead of Byte in it's PBKDF2 function?

I've stuck with getting potential wrong results from a Java 7
implementation.

If I call a test function like

echo -n "Lsda[¥~§#€]" | java -jar pbkdf2_stdin.jar "Salt" 4096 16 sha-1

I get

Password   : Lsda[¥~§#€]
Password   : 4c7364615bc2a57ec2a723e282ac5d
Salt       : 53616c74
PBKDF2     : aba223d6679ad1e8101c01bf860f788b
PBKDF2_java: 461f05924a7945a652bcabb30d87fad3

whereupon PBKDF2 is the result given be my own PBKDF2 implementation and
PBKDF2_java what I get using the javax library.

So I'm wondering if converting the Password into a char array instead of
a byte array might be the correct approach.

Verified the PBKDF2 result at
https://asecuritysite.com/encryption/PBKDF2z and I get:
aba223d6679ad1e8101c01bf860f788b

Can anyone give me a hint on this matter?




Below is the explaination on how I call the functions.

---------8<-----------------------------------------

   basicFunctions  bf = new basicFunctions();
   cryptoFunctions cf = new cryptoFunctions();

   if (System.in.available() > 0) {
     String hashType, PBKDF2_Result, Password, Salt;
     int dkLen, c;
     int BuffSize = System.in.available();

     byte[] pwByte = new byte[BuffSize];
     System.in.read(pwByte, 0, BuffSize);
     Password = bf.byteArrToString(pwByte);
     Salt     = argv[0];
     c        = Integer.parseInt(argv[1]);
     dkLen    = Integer.parseInt(argv[2]);
     hashType = argv[3];

     System.err.println("Password   : " + bf.byteArrToString(pwByte));
     System.err.println("Password   : " + 
bf.byteArrToHexString(Password.getBytes()));
     System.err.println("Salt       : " + 
bf.byteArrToHexString(Salt.getBytes()));

     PBKDF2_Result = bf.byteArrToHexString( cf.PBKDF2(hashType, 
Password.getBytes(), Salt.getBytes(), c, dkLen) );
     System.err.println("PBKDF2     : " + PBKDF2_Result);

     PBKDF2_Result = bf.byteArrToHexString( pbkdf2_javax(Password, Salt, 
c, dkLen) );
     System.err.println("PBKDF2_java: " + PBKDF2_Result);

     }
   else {
     System.err.printf("Pass data via stdin.\n");
   }

--------->8-----------------------------------------

Inhere the password is read from stdin into a byte array (pwByte), then
converted into a string (Password), because the javax PBKDF2 function
does not accept a byte array for the password parameter, whereas it does
for the salt.

My own PBKDF2 implementation however is only accepting byte arrays for
password and salt, because I prefer staying on the byte level in regards
of cryptography.

bf.byteArrToString(), bf.byteArrToHexString() and cf.PBKDF2 are some
functions of my own functions lib that simply do as they are named.


In addtion this is the PBKDF2 function of javax

---------8<-----------------------------------------

   public static byte[] pbkdf2_javax(String String password, String 
salt, int iterations, int dkLen) {
     byte[] derivedKey = new byte[dkLen];
     try {
       SecretKeyFactory f = 
SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1");
       KeySpec ks  = new PBEKeySpec(password.toCharArray(), 
salt.getBytes(), iterations, dkLen*8);
       SecretKey s = f.generateSecret(ks);
       derivedKey  = s.getEncoded();
       }
     catch (Exception e) {
       e.printStackTrace();
     }

     return derivedKey;
   }

--------->8-----------------------------------------

For example calling the test program like below does give the correct 
result for both functions output.

echo -n "The quick brown fox jumps over the lazy dog" | java -jar 
pbkdf2_stdin.jar "Salt" 4096 16 sha-1

PBKDF2     : cf93699a512044c1bc788699cc986f88
PBKDF2_java: cf93699a512044c1bc788699cc986f88



-- 
cHNiMUBACG0HAAAAAAAAAAAAAABIZVbDdKVM0w1kM9vxQHw+bkLxsY/Z0czY0uv8/Ks6WULxJVua
zjvpoYvtEwDVhP7RGTCBVlzZ+VBWPHg5rqmKWvtzsuVmMSDxAIS6Db6YhtzT+RStzoG9ForBcG8k
G97Q3Jml/aBun8Kyf+XOBHpl5gNW4YqhiM0=

[toc] | [next] | [standalone]

#38256

On 15.05.18 20:15, Karl.Frank wrote:
>    public static byte[] pbkdf2_javax(String String password, String
> salt, int iterations, int dkLen) {

Copy & Paste error - it read

   public static byte[] pbkdf2_javax(String password, String salt, int 
iterations, int dkLen) {

of course ;-)


-- 
cHNiMUBACG0HAAAAAAAAAAAAAABIZVbDdKVM0w1kM9vxQHw+bkLxsY/Z0czY0uv8/Ks6WULxJVua
zjvpoYvtEwDVhP7RGTCBVlzZ+VBWPHg5rqmKWvtzsuVmMSDxAIS6Db6YhtzT+RStzoG9ForBcG8k
G97Q3Jml/aBun8Kyf+XOBHpl5gNW4YqhiM0=

[toc] | [prev] | [next] | [standalone]

#38257

All functions used in my test program are available here as a
none-bloated source code

/* Java Basic Functions Source Code */
http://paste.debian.net/1024821

/* Java Crypto Functions Source Code */
http://paste.debian.net/1024828

[toc] | [prev] | [next] | [standalone]

#38258

Here's the source code of test program in question

http://paste.debian.net/1024838

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.java.programmer

csiph-web