2

I am implementing bcrypt for java as found here. Before the actual hash takes place, line 455 of this implementation takes the raw String password, and transforms it into a byte array like so:

passwordb = (password + (minor >= 'a' ? "\000" : "")).getBytes("UTF-8");

So when minor >= 'a', as is always true for this implementation (I assume this is a version identifier?), then \000 is concatenated onto the end of the password before its transformation into bytes.

What purpose does adding \000 to the password provide?

2

You are correct @Numeron, the purpose of the \000 is to add a null to the end of the password stream (NULL value or END-OF-FILE value) since the null is an illegal character for a password (or any user input for that matter) it is used here to signify the end of the 'password' string (this is part of normal string behavior).

the minor you see is comes from char minor = (char)0; a few lines up. this line casts the value 0 to a char. if the java implementation you are using interprets the 0 char as 'a' than the '\000' (NULL value) is added to the end of the password String since it most likely will be missing in that implementation of java. (like on some Java Mobile devices I have heard.)

2

I continued my own investigation...

\ is an escape character in java, but one thing I didn't realise is that it can escape more than one character. In this case, it escapes all three zeroes, thus adding a NUL character onto the string.

This turns into an extra byte on the end of the UTF8 array, with value 0. This is presumably used by the algorithm to identify the end of the password as it gets chopped into pieces and re-organized.

(This is enough to make me satisfied, but I won't accept my own answer for a while in case anyone can provide any more/better information than this in their own answer)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.