[jboss-jira] [JBoss JIRA] (SECURITY-851) Base64Utils class cuts leading zeroes from encoded bytes

[Josef Cacek (JIRA)]

     [ https://issues.jboss.org/browse/SECURITY-851?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Josef Cacek updated SECURITY-851:
---------------------------------

    Summary: Base64Utils class cuts leading zeroes from encoded bytes  (was: Base64Utils class is stripping leading zeroes from encoded bytes)


> Base64Utils class cuts leading zeroes from encoded bytes
> --------------------------------------------------------
>
>                 Key: SECURITY-851
>                 URL: https://issues.jboss.org/browse/SECURITY-851
>             Project: PicketBox 
>          Issue Type: Bug
>      Security Level: Public(Everyone can see) 
>    Affects Versions: PicketBox_4_0_21.Beta2
>            Reporter: Josef Cacek
>            Assignee: Josef Cacek
>            Priority: Blocker
>
> Vault util is failing for some password/salt/iteration combinations because Base64Utils class strips zeroes from provided byte array.
> So if a user encodes a key with length 8 and the leading byte of the key is zero, then after decoding he only gets 7 (or less) bytes.
> For instance:
> {code}
> encode ( { 0, 81, 121, -37, 46, -64, 20, 114 } ) -> "1HUTikm1Ho"
> decode ("1HUTikm1Ho") -> {  81, 121, -37, 46, -64, 20, 114  }
> {code}
> As a result the PBEUtil will fail with javax.crypto.IllegalBlockSizeException.
> IMHO the same problem can occur on other places where the Base64Utils class is used (not only the Vault).



--
This message was sent by Atlassian JIRA
(v6.2.6#6264)