Linux 中的散列命令之间的区别

Question

I am trying to get passwords hashes encoded in base64 for a login database. I am using the picketbox security library to get the base64 encoded hashes of the passwords, but I would like to get a different tool.

1. If I use:

    java -cp $JBOSS_HOME/modules/system/layers/base/org/picketbox/main/picketbox-4.9.6.Final.jar org.jboss.security.Base64Encoder master SHA-256

   I get:

    [/GE7Tf1nNqe9JoyKDnTtDRwEqVn1nddO8odJg/1EP8k=];

   [ ] must be removed in database to log in properly.

2. When I use:

    echo -n master | openssl dgst -sha256 -binary | base64

   I get:

    /GE7Tf1nNqe9JoyKDnTtDRwEqVn1nddO8odJg/1EP8k=

The same result.

3. However when I use:

    echo -n master |sha256sum -b | base64

   I get:

    ZmM2MTNiNGRmZDY3MzZhN2JkMjY4YzhhMGU3NGVkMGQxYzA0YTk1OWY1OWRkNzRlZjI4NzQ5ODNmZDQ0M2ZjOSAqLQo=

What is the difference between openssl dgst -sha256 -binary and sha256sum -b ? I thought they would provide the same hash.

Answer 1

Take a look at the difference between openssl and sha256sum :

• openssl prints the hash in raw binary. It's not text, it's not human readable, it's pure bytes:

   $ echo -n master | openssl dgst -sha256 -binary �Y��N�I��D?�

  If you count the bytes with wc ---bytes you'll see it's printing exactly 32 bytes:

   $ echo -n master | openssl dgst -sha256 -binary | wc --bytes 32

  We can also convert it to hex with hexdump :

   $ echo -n master | openssl dgst -sha256 -binary | hexdump 0000000 61fc 4d3b 67fd a736 26bd 8a8c 740e 0ded 0000010 041c 59a9 9df5 4ed7 87f2 8349 44fd c93f 0000020

• By contrast, sha256sum prints the hash in human readable form in hexadecimal using the digits 0-9 and the letters af .

   $ echo -n master | sha256sum -b fc613b4dfd6736a7bd268c8a0e74ed0d1c04a959f59dd74ef2874983fd443fc9 *-

  It's the same information as the garbled binary above but it's presented differently. You'll notice that the hex value takes up a lot more space than the binary data. It also includes the file name at the end, which here is the cryptic *- . * means you used the -b flag, while - denotes that the input was read from stdin.

You can get the same hex value from openssl if you change -binary to -hex :

$ echo -n master | openssl dgst -sha256 -hex
(stdin)= fc613b4dfd6736a7bd268c8a0e74ed0d1c04a959f59dd74ef2874983fd443fc9

There's no way to do the reverse, though. sha256sum doesn't have a flag to print a binary hash. It can only do hex.