terl / lazysodium-java

A Java implementation of the Libsodium crypto library. For the lazy dev.
https://github.com/terl/lazysodium-java/wiki
Mozilla Public License 2.0
136 stars 49 forks source link

Generic hashing is prone to errors #23

Closed gurpreet- closed 6 years ago

gurpreet- commented 6 years ago

For some reason, when using functions such as cryptoGenericHashUpdate and cryptoGenericHashFinal the tests irregularly fail. I say irregularly because they fail 1/10 times on my local Mac environment and all the time on Linux (through SemaphoreCI).

Oddly, generic hashing works if I use key sizes KEYBYTES (which is equivalent to 32) upwards but fails for KEYBYTES_MIN.

Things I've tried:

gurpreet- commented 6 years ago

A solution to this problem is avoiding the use of the minimum key byte value, i.e. GenericHash.KEYBYTES_MIN.

Though, this is not an optimal solution at all as people will read the docs and then receive an error when trying to use KEYBYTES_MIN in their programs.

gurpreet- commented 6 years ago

GenericHash.KEYBYTES_MIN has now been commented out.

You can still use it, but it's not recommended for the issues outlined above. Thorough testing is recommended if you really want to use KEYBYTES_MIN in generic hash functions.