Exact same hashing in java as PHP with salt? (SHA-256)

Question

I can simply hash in PHP with a salt:

$orig_pw = "abcd";
$salt = 5f8f041b75042e56;
$password = hash('sha256', $orig_pw . $salt);

(This is not how I implement it, this is just an example. Salt is different for everyone)

And with this, the stored password is:

bc20a09bc9b3d3e1fecf0ed5742769726c93573d4133dbd91e2d309155fa9929

But if I try to do the same in Java, I get a different result. I tried String password = "abcd";

byte[] salt = hexStringToByteArray("5f8f041b75042e56");

try {
    System.out.println(new String(getHash(password, salt)));
} catch (NoSuchAlgorithmException e1) {
    e1.printStackTrace();
}

And the two methods:

public byte[] getHash(String password, byte[] salt) throws NoSuchAlgorithmException {
        MessageDigest digest = MessageDigest.getInstance("SHA-256");
        digest.reset();
        digest.update(salt);
        try {
            return digest.digest(password.getBytes("UTF-8"));
        } catch (UnsupportedEncodingException e) {
            e.printStackTrace();
        }
        return null;
    }


public byte[] hexStringToByteArray(String s) {
        int len = s.length();
        byte[] data = new byte[len / 2];
        for (int i = 0; i < len; i += 2) {
            data[i / 2] = (byte) ((Character.digit(s.charAt(i), 16) << 4)
                                 + Character.digit(s.charAt(i+1), 16));
        }
        return data;
    }

The result is:

/¬1¶ĆĽëüFd?[$?¶»_9ËZ»ç¶S‘ĘĹ—×©

Which coded to hex is not even close to it:

2fac31b6434c14ebfc46643f5b243fb6bb5f39cb5abb10e7b65391454c97d7a90d0a

Can anyone help with this?

Robby Cornelissen · Accepted Answer · 2014-07-14 10:23:42Z

7

Apart from the order being swapped, it looks like in PHP you're treating the salt value as a literal string to be appended to the password, while in Java you do a hex conversion of the salt first and then use the resulting bytes to update the MessageDigest. This will obviously yield different results. Looking only at the salt:

PHP: Salt -> To bytes (literal) -> SHA-256
Java: Salt -> To bytes (unhex) -> SHA-256

I just tried your Java code, and it's absolutely fine. I also tried to hash the same value in PHP as in Java and it gave me identical results.

The Java equivalent to your PHP code would be:

String password = "abcd";
String salt = "5f8f041b75042e56";

try {
    MessageDigest digest = MessageDigest.getInstance("SHA-256");

    return digest.digest((password + salt).getBytes("UTF-8"));
} catch (UnsupportedEncodingException | NoSuchAlgorithmException e) {
    return null;
}

After hexing the bytes it returns the following result:

60359BC8A0B09898335AA5A037B1E1B9CE3A1FE0D4CEF13514901FB32F3BCEB0

And in PHP doing:

<?
echo hash('sha256', "abcd"."5f8f041b75042e56");
?>

Returns exactly the same.

edited Jul 14, 2014 at 10:23

answered Jul 14, 2014 at 9:00

Robby Cornelissen

98.6k23 gold badges154 silver badges180 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

RuntimeException Over a year ago

I don't understand every word (not english). So should I change the salt in java? (like: byte[] salt = "5f8f041b75042e56".getBytes();) Also, how can I swap them in java?

Robby Cornelissen Over a year ago

I don't know what your actual PHP code looks like (the code you posted won't run because of the bare hex string). It seems however that you're hashing "abcd"."5f8f041b75042e56". To do the equivalent in Java, you would have to do ("password" + "salt").getBytes("UTF-8") and then digest that.

RuntimeException Over a year ago

Yeah sorry for the code, that's not how it's implemented. The actual code gets a random number: $salt = dechex(mt_rand(0, 2147483647)) . dechex(mt_rand(0, 2147483647));

Halcyon · Accepted Answer · 2014-07-14 08:23:39Z

2

I think

digest.update(salt);
digest.digest(password.getBytes("UTF-8"));

is equivalent to:

hash('sha256', $salt . $orig_pw);

So the hash and salt are swapped. Can you confirm this?

answered Jul 14, 2014 at 8:23

Halcyon

57.7k10 gold badges93 silver badges131 bronze badges

3 Comments

RuntimeException Over a year ago

Yes, they are swapped i think. (And if is possible, keep it that way)

Halcyon Over a year ago

You can't just swap them, the input has to be the same in PHP and in Java.

RuntimeException Over a year ago

I meant keep it swapped in php and swap it in java too.

Collectives™ on Stack Overflow

Exact same hashing in java as PHP with salt? (SHA-256)

2 Answers 2

3 Comments

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related