Home | Contact Us | FAQ | Search & Site Map | Link to Us
Sign In | Join | Other 45 Sites in Network
HomeAnnouncementsFree MagazinesWhite PapersSubmit Content
Discussion GroupsASP.NETWindows FormsLanguages.NET FrameworkVisual Studio.NET
Articles.NET FrameworkASP.NETToolsWindows Forms
.NET DirectoryOpen Source ProjectsUser GroupsWeb Resources
Related Topics
Visual Basic 6SQL ServerMS AccessOther DB ProductsMS Server ProductsMore Topics ...

.NET Forum / .NET Framework / New Users / January 2006

Tip: Looking for answers? Try searching our database.

SHA1Managed class has different results in 2.0 vs. 1.1??

Thread view: 
Enable EMail Alerts  Start New Thread
Thread rating: 
Bob - 18 Jan 2006 22:41 GMT
We currently have an application running on .NET 1.1.  It hashes certain
data using System.Security.Cryptography.SHA1Managed class.  It has worked
out fine until we upgraded the app to .NET 2.0.  SHA1Managed in 2.0 hashes
to a different stirng output when the input is exactly the same.  Why would
this be the case?  I thought the SHA1 algorithm is the same regardless of
the actual implementation.  Here's my source code, which compiles file in
both 1.1 and 2.0

       public static string HashThis(string salt, string password) {
           System.Text.ASCIIEncoding  encoding=new
System.Text.ASCIIEncoding();
           string saltedPassword = salt + password;
           byte [] saltByte = encoding.GetBytes(saltedPassword);
           SHA1CryptoServiceProvider sha = new
System.Security.Cryptography.SHA1CryptoServiceProvider();
           sha.ComputeHash(saltByte);
           return encoding.GetString(sha.Hash);
       }

Thanks a lot for any help.
Bob
Bob - 18 Jan 2006 22:50 GMT
ALl right, figured out the problem right after I sent the question.  It's an
ASCII encoding issue.  ASCII encoding behaves differently in 2.0 and 1.1,
not the hashing itself.

> We currently have an application running on .NET 1.1.  It hashes certain
> data using System.Security.Cryptography.SHA1Managed class.  It has worked
[quoted text clipped - 17 lines]
> Thanks a lot for any help.
> Bob
Jon Skeet [C# MVP] - 18 Jan 2006 22:52 GMT
> We currently have an application running on .NET 1.1.  It hashes certain
> data using System.Security.Cryptography.SHA1Managed class.  It has worked
[quoted text clipped - 14 lines]
>             return encoding.GetString(sha.Hash);
>         }

The problem is that your code is broken - it's converting from
arbitrary binary data to a string using an ASCII encoding. What do you
expect it to do when it comes across a byte outside the ASCII range
(i.e. anything over 127)?

Here's a program which demonstrates the problem:

using System;
using System.Text;

class Test
{
   static void Main()
   {
       byte[] data = new byte[]{140};
       string text = Encoding.ASCII.GetString(data);
       Console.WriteLine ((int)text[0]);
   }
}

Basically, you were relying on unspecified behaviour, and it's changed.
Now as to what you can do about that - the easiest thing would probably
be to emulate the previous behaviour. The simplest way of doing that is
something like:

   static string OldBytesToAscii (byte[] data)
   {
       char[] c = new char[data.Length];
       for (int i=0; i < data.Length; i++)
       {
           c[i] = (char)(data[i]&0x7f);
       }        
       return new string (c);
   }

A better solution for moving forward in the future is to base64 binary
data when you need it in a reliable text form.

Signature

Jon Skeet - <skeet@pobox.com>
http://www.pobox.com/~skeet   Blog: http://www.msmvps.com/jon.skeet
If replying to the group, please do not mail me too


Free Magazines

Get these publications absolutely FREE for up to 12 months. There are no hidden fees and no obligation. Simply choose a title, complete the application form and submit it. Read more ...

Oracle MagazineNetwork ComputingComputer WorldBio-IT WorldeWeekInformation WeekInfosecurity
 
Sign In
Join
My Latest Posts
My Monitored Threads
My Blog
My Photo Gallery
My Profile
My Homepage

Start New Thread
Enable EMail Alerts
Rate this Thread



©2008 Advenet LLC   Privacy Policy - Terms of Use
This website includes both content owned or controlled by Advenet as well as content owned or controlled by third parties.