Android Question Getting wrong SHA-512 hash after processing salt+password stored in mysqldb

[eronquillo]

Hi everyone! I'm trying to get my B4A app to use the salt string (char(120) in mysql) in lower case letters, all hex, to concatenate the value stored in a EditText view called Password on an activity layout. I would then hash this combination by passing it to the byteconverter. The result would be the wrong password when compared to the stored hashed password in mysql, all in hex. The resulting letters have also ended up in upper case.

Here's the code

Dim dbsalt As String ' a value from the salt field in the User table record is assigned here
Dim hash() As Byte
Dim password As String
Dim saltpassword As String
Dim saltpasswordbyte() As Byte
Dim mdencrypt As MessageDigest
Dim bc As ByteConverter

saltpassword = txtPassword.Text & dbsalt 'This is the combination of txtPassword from the form and the salt value from the db

saltpasswordbyte = saltpassword.GetBytes("UTF8") ' convert to bytes for the byteconverter
hash = mdencrypt.GetMessageDigest(saltpasswordbyte, "SHA-512") ' hash the byte value with SHA-512
password = bc.HexFromBytes(hash) ' convert the hashed byte value to hex and store in password string

The same mysql database is being used on my website and the PHP hash() function works perfectly with the db stored hash and the password from the input field on the webform:

// PHP code from my website that is used for secure login
  // hash the password with the unique salt.
  $password = hash('sha512', $password . $salt);

Is there something I'm missing in my code that would solve this one?

 

[Erel]

Please use [ code ] [ /code ] tags (without spaces) when posting code.

The resulting letters have also ended up in upper case.

Call password.ToLowerCase to change the case.

How is dbsalt declared?

 

[eronquillo]

Please use [ code ] [ /code ] tags (without spaces) when posting code.

Hi Erel, sorry about that. I added the tags and now it looks better. Thanks!

Call password.ToLowerCase to change the case.

I'll give this a try.

How is dbsalt declared?

For the time being, the salt is generated by the website's php and javascript scripts, resulting in hex string with all letters in lower case, and then inserted into a field of the new registrant's record in a MySQL database. When a user logs into my Android app, the Remote Database Connector is used to retrieve the user's salt value and assign it to dbsalt as a string variable. This is just the first step though. The next step is to implement the B4A code for registering new app users so that logging in to the app or website would work the same either way.

I'll play around with the ToLowerCase member for a bit to see if I get any good results.

Thanks again Erel!