SimpleCrypto.net icon indicating copy to clipboard operation
SimpleCrypto.net copied to clipboard

buggy salt to byte array conversion

Open gpomykala opened this issue 8 years ago • 1 comments

hi, i attempted to use SimpleCrypto.NET to generate hashes that are used on another platform (node) and found number of discrepancies (known password and salt should produce same results across platforms assuming that same digest algorithm and key size is used).

  1. salt is prefixed with number of iterations which makes sense however the [xxxx.] prefix should not be used - explanation below....
  2. salt string to byte conversion is performed using Encoding.UTF8.GetBytes(Salt) which is not the correct way of decoding base64 string (compare with new Buffer(salt, 'base64') in JS). Convert.FromBase64String should be used instead, but you'd need to split the number of iterations from actual base64 salt to do so.

I'd also add support for hex string input / output as well. would you consider a pull request?

gpomykala avatar Jul 15 '16 11:07 gpomykala

hi, i attempted to use SimpleCrypto.NET to generate hashes that are used on another platform (node) and found number of discrepancies (known password and salt should produce same results across platforms assuming that same digest algorithm and key size is used).

  1. salt is prefixed with number of iterations which makes sense however the [xxxx.] prefix should not be used - explanation below....
  2. salt string to byte conversion is performed using Encoding.UTF8.GetBytes(Salt) which is not the correct way of decoding base64 string (compare with new Buffer(salt, 'base64') in JS). Convert.FromBase64String should be used instead, but you'd need to split the number of iterations from actual base64 salt to do so.

I'd also add support for hex string input / output as well. would you consider a pull request?

Would you by any chance have a fork with the needed fixes?

KoenBoone avatar Feb 27 '23 11:02 KoenBoone