GWT + JBoss + MessageDigest + “SHA-512 not supported”

0
votes

I just found some strange behavior, and i think it would be interresting to report it here, so it mays help other people (as i didnt find any clue on this problem while asking google).

So, my environnement is :

Java 7.25

GWT 2.5.1

Jboss 7.1.1

I made some login workflow working this way :

1) client enter login / password

2) password is SHA-512 hashed on client side

3) password just hashed on client side is salted and then SHA-512 hashed on server side.

FYI, this is the same function hashing SHA-512 both on client and server side. The code used to select the hash algorithm is this one :

MessageDigest digest = MessageDigest.getInstance("SHA-512");

When i run my project on GWT developpement mod (the one with embed jetty container), everything runs fine.

Then i generate a War of my project, and deploy it on JBoss, and there is the problem : The method MessageDigest.getInstance("SHA-512") triggers NoSuchAlgorithmException with e.getMessage() => "SHA-512 not supported". But only on client side. Server side hashing is OK (so basically, the RPC method send a empty password to the server instead of the SHA-512 one)

I dont think this is expected behavior, and i'm wondering if anyone have some clue about it. ATM i have no idea what is the origin of the problem, i'm gonna inspect it deeply :

  • trying with gwt 2.6.1 (even if changelog doesn't mention anything like this)
  • trying with other JBoss versions
  • trying with other hash algorithms
  • Inspecting the war build logs (maybe a maven problem ? i doubt it but who knows)

Any suggestions 'll be greatly appreciated :)

1
gwthashjboss

1 Answers

0
votes

I think it is expected behavior. If you look at the list of supported packages for GWT, java.security.* is not there. It works in dev mode because it runs within a real JVM, not with compiled javascript.

But why would you even need to do password hashing in the client? Imho this should be done server-side.