哪个SHA-256是正确的？ Java SHA-256摘要或Linux命令行工具

Question

When I calculate in Java an SHA-256 of a string with the following method

public static void main(String[] args) throws NoSuchAlgorithmException {

    MessageDigest md = MessageDigest.getInstance("SHA-256");

    byte[] hash = md.digest("password".getBytes());

    StringBuffer sb = new StringBuffer();
    for(byte b : hash) {
        sb.append(Integer.toHexString(b & 0xff));
    }

    System.out.println(sb.toString());
}

I get :

5e884898da2847151d0e56f8dc6292773603dd6aabbdd62a11ef721d1542d8

on the commandline I do the following (I need the -n to not add a newline) :

echo -n "password" | sha256sum

and get

5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8

if we compare these more closely I find 2 subtle differences

5e884898da2847151d0e56f8dc6292773603dd6aabbdd62a11ef721d1542d8
5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8

or :

5e884898da28   47151d0e56f8dc6292773603d   d6aabbdd62a11ef721d1542d8
5e884898da28 0 47151d0e56f8dc6292773603d 0 d6aabbdd62a11ef721d1542d8

Which of the 2 is correct here?

Result: Both are but I was wrong...

fixed it by using :

    StringBuffer sb = new StringBuffer();
    for(byte b : hash) {
        sb.append(String.format("%02x", b));
    }

Thanks!

Answer 1

我将采取一个合理的猜测：两者都输出相同的摘要，但在您的Java代码中输出byte[]结果作为十六进制字符串，您输出小字节值（小于16）而没有前导0.所以一个字节值“0x0d”被写为“d”而不是“0d”。

Answer 2

The culprit is the toHexString . It appears to be outputting 6 for the value 6 whereas the sha256sum one is outputting 06 . The Java docs for Integer.toHexString() state:

This value is converted to a string of ASCII digits in hexadecimal (base 16) with no extra leading 0s.

The other zeros in the string aren't being affected since they're the second half of the bytes (eg, 30 ).

One way to fix it would be to change:

for(byte b : hash) {
    sb.append(Integer.toHexString(b & 0xff));
}

to:

for(byte b : hash) {
    if (b < 16) sb.append("0");
    sb.append(Integer.toHexString(b & 0xff));
}

Answer 3

它们都是正确的 - 这是你的Java代码有问题，因为它不会为小于0x10的十六进制值打印出前导0。

Answer 4

你仍然需要“echo -n”来防止尾随\\ n

Answer 5

The one generated by sha256sum seems correct. Your implementation seems to drop those two zeroes.

Answer 6

Using @paxdiablo idea had problem with big number as it appear as negative, so

Instead of:

for(byte b : hash) {
    sb.append(Integer.toHexString(b & 0xff));
}

you could do:

for(byte b : hash) {
    if (b > 0 && b < 16) {
        sb.append("0");
    }
    sb.append(Integer.toHexString(b & 0xff));
}

And read @Sean Owen answer.

Answer 7

You can also get the right result using this:

MessageDigest md = MessageDigest.getInstance("SHA-256");

byte[] hash = md.digest("password".getBytes());

BigInteger bI = new BigInteger(1, hash);

System.out.println(bI.toString(16));