Java's MessageDigest SHA1-algorithm returns different result than SHA1-function of php

Question

I have a SQL table with usernames and passwords. The passwords are encoded using MessageDigest's digest() method. If I encode a password - let's say "abcdef12" - with MessageDigest's digest() method and then convert it to hexadecimal values, the String is different than if I do the same using PHP's SHA1-method. I'd expect these values to be exactly the same though.

Code that is used to encode the passwords:

MessageDigest md = MessageDigest.getInstance("SHA-1");
byte[] passbyte;
passbyte = "abcdef12".getBytes("UTF-8");
passbyte = md.digest(passbyte);

The conversion of the String to hexadecimal is done using this method:

public static String convertStringToHex(String str) {

    char[] chars = str.toCharArray();

    StringBuffer hex = new StringBuffer();
    for (int i = 0; i < chars.length; i++) {
        hex.append(Integer.toHexString((int) chars[i]));
    }

    return hex.toString();
}

Password: abcdef12

Here's the password as returned by a lot of SHA1-hash online generators and PHP SHA1()-function: d253e3bd69ce1e7ce6074345fd5faa1a3c2e89ef

Here's the password as encoded by MessageDigest: d253e3bd69ce1e7ce674345fd5faa1a3c2e2030ef

Am I forgetting something?

Igor.

Edit: I've found someone with a similar problem: C# SHA-1 vs. PHP SHA-1...Different Results? . The solution was to change encodings.. but I can't change encodings on the server-side since the passwords in that SQL-table are not created by my application. I use client-side SHA1-encoding using a JavaScript SHA1-class (more precisely: a Google Web Toolkit-class). It works and encodes the string as expected, but apparently using ASCII characters?..

stivlo · Answer 1 · 2011-09-30T02:14:09.373

I have the same digest as PHP with my Java SHA-1 hashing function:

public static String computeSha1OfString(final String message) 
    throws UnsupportedOperationException, NullPointerException {
        try {
               return computeSha1OfByteArray(message.getBytes(("UTF-8")));
        } catch (UnsupportedEncodingException ex) {
                throw new UnsupportedOperationException(ex);
        }
}

private static String computeSha1OfByteArray(final byte[] message)
    throws UnsupportedOperationException {
        try {
            MessageDigest md = MessageDigest.getInstance("SHA-1");
            md.update(message);
            byte[] res = md.digest();
            return toHexString(res);
        } catch (NoSuchAlgorithmException ex) {
            throw new UnsupportedOperationException(ex);
        }
}

I've added to my unit tests:

String sha1Hash = StringHelper.computeSha1OfString("abcdef12");
assertEquals("d253e3bd69ce1e7ce6074345fd5faa1a3c2e89ef", sha1Hash);

Full source code for the class is on github.

Indeed - your code produces the correct SHA1 (or rather: the same as SHA1 of php). However, I am writing an application that has to login into an existing database. That database is not created by myself (and neither is the password encryption). But **it uses the MessageDigest as written in my example** and thus running Base64.decode on that String returns a different result (the one specified in my example) rather than your correct result, which I also get using that JavaScript SHA1-class. Is there any way to compare them? I don't know how MessageDigest was returning that other result. — Igor, Sep 30 '11 at 02:16

score 5 · Answer 2 · answered Dec 27 '13 at 09:22

Try this - it is working for me:

MessageDigest md = MessageDigest.getInstance(algorithm);
md.update(original.getBytes());
byte[] digest = md.digest();
StringBuffer sb = new StringBuffer();
for (byte b : digest) {
    sb.append(Integer.toString((b & 0xff) + 0x100, 16).substring(1));
}
return sb.toString();

Regards, Konki

score 4 · Accepted Answer · edited Mar 17 '14 at 21:30

4

It has nothing to do with the encodings. The output would be entirely different.

For starters, your function convertStringToHex() doesn't output leading zeros, that is, 07 becomes just 7.

The rest (changing 89 to 2030) is also likely to have something to do with that function. Try looking at the value of passbyte after passbyte = md.digest(passbyte);.

edited Mar 17 '14 at 21:30

NullUserException

83,810
28
209
234

answered Sep 30 '11 at 02:15

Dennis

14,264
2
48
57

Thank you! Your answer solved my problem. I was failing at converting the byte-array to a hexadecimal string properly! I used the method from @stivlo and it worked great! I am going to mark this response as correct, though in this case I wish I could mark both given responses as the correct one! Thank you both! – Igor Sep 30 '11 at 02:20

score 3 · Answer 4 · answered Aug 26 '15 at 14:27

3

Or try this:

MessageDigest md = MessageDigest.getInstance("SHA-1");
md.update(clearPassword.getBytes("UTF-8"));
return new BigInteger(1 ,md.digest()).toString(16));

Cheers Roy

answered Aug 26 '15 at 14:27

roy

31
1

For starters, with the BigInteger doesn't output leading zeros, that is, 07 becomes just 7. – tspentzas Jan 18 '21 at 09:01

Java's MessageDigest SHA1-algorithm returns different result than SHA1-function of php

4 Answers4

Linked

Related