ChrisMcKee/cryptsharp

SCrypt salt issue

rushfrisby opened this issue · 1 comments

I found an issue with SCrypt that will cause it to generate the same hash every time with different salts.

First I generated a random string of characters from the full character set (char)0 - (char)65535.

private static string NewSalt()
{
    var salt = string.Empty;
    var random = new Random();
    for (var i = 0; i < 16; i++)
    {
        salt += (char)random.Next(Char.MinValue, Char.MaxValue);
    }
    return salt;
}

In almost all cases my salts contain characters with high character values. When I use this to hash passwords the hashes end up being the same with different salts.

private static string SaltAndHashPassword(string password, string salt)
{
    const int len = 64;
    const int parallel = 16;
    const int blockSize = 8;
    const int cost = 1024;

    var derivedBytes = new byte[len];
    SCrypt.ComputeKey(Encoding.ASCII.GetBytes(password), Encoding.ASCII.GetBytes(salt), cost, blockSize, parallel, null, derivedBytes);

    return new string(HexBase16.Encode(derivedBytes));
}

Is there something I am doing wrong or does the SCrypt algorithm not allow for characters over a certain range? When I limit the salt to (char)0 - (char)255 it works every time.

Never mind... I see the problem. Using Encoding.ASCII limits it to 0-255. I changed it to Encoding.Unicode to get the full character set and it works. Great little library you have here. Thanks.