3

I'm porting a portion of a .NET application to Qt on Linux. I am trying to replicate the results of a .NET function to create the SHA-256 hash of a password + salt. The .NET code is 

return new SHA256Managed().ComputeHash(buffer);

Where buffer is the salt concatenated to the password.

I considered several crytopgraphic libraries including QCA and Botan and after reading several comments, I decided to try Botan. However, I'm not finding the right place in the documentation to perform the equivalent of the code listed above.

Can someone point me to the place in the fine manual or a tutorial that discusses the use of Botan to create a simple hash? I've been google searching for a couple hours without finding a solution. There are many example of SHA-256 hashing for pipes and streams but I have yet to find the example of a simple hash calculation.

DarwinIcesurfer
  • 1,073
  • 4
  • 25
  • 42
  • 1
    This really isn't a secure way to hash a password. Why aren't you using bcrypt or PBKDF2? [Botan even has a page on this](http://botan.randombit.net/passhash.html). – Brendan Long Oct 11 '12 at 03:22

1 Answers1

9

I'm guessing you just need the documentation.

The code to do what you want is something like:

#include <vector>
#include <sha2_32.h>

using namespace Botan;

secure_vector<byte> somefunction(std::vector<byte> input) {
    SHA_256 sha;
    return sha.process(input);
}

As I mentioned in my comment, this is an incredibly insecure way to store passwords, so I'd recommend using bcrypt or PBKDF2 (both of which are implemented in Botan). PBKDF2 is part of the .NET standard library too, so there's really no excuse to use a general-purpose hash function instead of a secure password hashing function.

All you need for bcrypt is:

generate_bcrypt(password, random_number_generator, work_factor)
Brendan Long
  • 53,280
  • 21
  • 146
  • 188
  • 1
    +1 for the warnings. Unless the OP lives in a world where "rainbow table" is strictly limited to CareBear dining habits, he really needs to use a PBKDF2 for this. Hand rolling one is bad news. – WhozCraig Oct 11 '12 at 03:53
  • Thanks for the code. I did see the documentation, but I'm a noob to c++ and I've been spoiled by the extensive example code for the Qt libraries. After readying your answer, I can now understand the documentation. Perhaps my request should have been for a tutorial on reading doxygen docs. I agree that this is a poor way to store passwords. However, it is the way the web service API that I need to connect to verifys a user's password without sending the actual password. – DarwinIcesurfer Oct 11 '12 at 04:10
  • Thanks, has helped me, too! FWIW, the documentation isn't that great for someone who doesn't know bot the botan architecture and crypto very well. – peterchen Aug 25 '16 at 08:40