Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Please provide byte array based hashing #99

Closed
scubajorgen opened this issue Feb 5, 2023 · 4 comments
Closed

Please provide byte array based hashing #99

scubajorgen opened this issue Feb 5, 2023 · 4 comments

Comments

@scubajorgen
Copy link

Thanks for this great project
A problem is that it is not possible to use the hashing based on raw byte arrays.
I tried to use Argon2 hashing with a raw byte array as salt and a password consisting of raw bytes.
(This is the way argon2d and argon2id are used to decrypt Keepass databases)

However it is impossible to insert these arrays. It can only be done by creating a String out of the bytes and then pass the strings. However, under the hood the Strings/CharSequences are converted to bytes again. However some UTF8 decoding takes place, not resulting in the original byte arrays!

It would be great to have a version also including hash functions that take byte arrays as input

@firaja
Copy link
Member

firaja commented Feb 9, 2023

Hi @scubajorgen,

this is a good feature to implement.
Do you have any example to test where password4j transforms things not as expected?

@JorgenVanDerVelde
Copy link

Hi @scubajorgen,

this is a good feature to implement. Do you have any example to test where password4j transforms things not as expected?

I used password4j Argon2d in my project to decrypt KeePass databases. Did conversion from raw byte[] to String for the seed and password (using various charactersets). However I could not get this working. I suspected the byte[]->String->byte[] conversion based on your source code. Therefore I did a comparison of the result of password4j and BouncyCastle/Spring and they differed.

I made a quick and dirty copy of your password4j argon function (I hope I did not violate licences) and removed the String stuff. It worked.

You can use my unit test, testHashTimed() as a working example.

@firaja
Copy link
Member

firaja commented Feb 18, 2023

Hi @scubajorgen , @JorgenVanDerVelde

version 1.7.0 is now public with public APIs accepting byte[] arguments.
I used your unit test as example here: https://github.com/Password4j/password4j/blob/master/src/test/com/password4j/PasswordTest.java#L1169

See the changelog for further information.

@firaja firaja closed this as completed Feb 18, 2023
@scubajorgen
Copy link
Author

Thanx! I tested your software in my code to decrypt Keepass databases and it worked out fine!! Thanks for your great work.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants