[jboss-jira] [JBoss JIRA] (JBAS-8162) Failed to encode/decode password with name "pinaki" using SecureIdentityLoginModule

[ https://issues.jboss.org/browse/JBAS-8162?page=com.atlassian.jira.plugin.... ] Denis . commented on JBAS-8162: ------------------------------- We ran into this issue earlier this week. It's a bug in SecureIdentityLoginModule. The problem is that using BigInteger to convert to and from raw bytes causes the most significant zeros to be dropped. They are not important mathematically (e.g. 023 is same as 23) but they are important cryptographically. In the end it means that exactly 1 of every 256 passwords will not work with JBoss. I applied the patch below to our systems (the "encoding.length & 7" if statement is new). It doesn't fully address the problem as there's still a 1 in 2^32 chance that a password will not work, but the change is fully backward compatible with the original code. {noformat} private static char[] decode(String secret) throws NoSuchPaddingException, NoSuchAlgorithmException, InvalidKeyException, BadPaddingException, IllegalBlockSizeException { byte[] kbytes = "jaas is the way".getBytes(); SecretKeySpec key = new SecretKeySpec(kbytes, "Blowfish"); BigInteger n = new BigInteger(secret, 16); byte[] encoding = n.toByteArray(); // reinstate any dropped bytes if ((encoding.length & 7) != 0) { final int newLength = ((encoding.length >> 3) + 1) << 3; byte[] fixedEncoding = new byte[newLength]; for (int i = 1; i < newLength - encoding.length; i++) { fixedEncoding[i] = 0; } System.arraycopy(encoding, 0, fixedEncoding, (newLength - encoding.length), encoding.length); fixedEncoding[0] = (n.compareTo(BigInteger.ZERO) < 0) ? (byte) -1 : 0; encoding = fixedEncoding; } Cipher cipher = Cipher.getInstance("Blowfish"); cipher.init(Cipher.DECRYPT_MODE, key); byte[] decode = cipher.doFinal(encoding); return new String(decode).toCharArray(); } {noformat} -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators For more information on JIRA, see: http://www.atlassian.com/software/jira