Coldfusion and java encryption functions

1
votes

while trying to translate token generator for uservoice from java to coldfusion, I noticed the the hash function in java does the one in coldfusion :

String salted = "63bfb29835aedc55aae944e7cc9a202dmbdevsite";
byte[] hash = DigestUtils.sha(salted);

gives = [-19, -18, 7, 92, -121, 13, 88, 68, -84, 61, -77, -20, -85, -102, -102, -62, -70, 45, -16, 18]

<cfset Salted="63bfb29835aedc55aae944e7cc9a202dmbdevsite" />
<cfset hash=Hash(Salted,"SHA") />
<cfset arrBytes = hash.GetBytes() />

gives = 69686969485553675655486853565252656751686651696765665765576567506665506870484950

Can anyone explain this ?

Thanks

2
javaencryptioncoldfusion

2 Answers

5
votes

You are actually getting the same result, however the outputs are encoded differently. For Java it's a byte array, and it's important to note that byte is signed. For ColdFusion you're getting hex that for some reason is outputted in decimal format for each hex character. If you look at http://asciitable.com/ and map the decimal numbers to their characters (e.g. 69 to E, 68 to D, 48 to 0), you get:

EDEE075C870D5844AC3DB3ECAB9A9AC2BA2DF012

Hashed results are often stored as hex. If you encode the Java version into hex, you'll get the same:

byte[] bytes = { -19, -18, 7, 92, -121, 13, 88, 68, -84, 61, -77, -20,
        -85, -102, -102, -62, -70, 45, -16, 18 };

StringBuilder sb = new StringBuilder(2 * hash.length);
for (byte b : hash) {
    sb.append("0123456789ABCDEF".charAt((b & 0xF0) >> 4));
    sb.append("0123456789ABCDEF".charAt((b & 0x0F)));
}
String hex = sb.toString();
System.out.println(hex);
3
votes

You can use BinaryDecode to get the same byte array as the Java Hash.

<cfset Salted="63bfb29835aedc55aae944e7cc9a202dmbdevsite" />
<cfset hash = Hash(Salted,"SHA") />
<cfset arrBytes = BinaryDecode(hash, "hex") />