Crypto Warning

General
1

A quick warning to anyone that’s relying on Crypto.SHA3_256. It does not return the same value on macOS and Linux 64 Intel Console Apps!

Xojo 2024r4.2

I’m getting the same result on:

  • macOS ARM
  • macOS Intel
  • Windows Intel 64(running on Windows ARM)
  • Windows ARM 64

Code:

Dim salt As String = DecodeHex(Lowercase("8C98ED38BDF507CAE76B2D17B467CA5E"))
Dim password As String = "asdfgh"

Dim pw_salt As String = password + salt

Dim hash_sha3_256 As String = EncodeBase64(crypto.SHA3_256(pw_salt), 0)
Dim hash_sha2_256 As String = EncodeBase64(crypto.SHA2_256(pw_salt), 0)
Dim hash_sha1 As String = EncodeBase64(Crypto.SHA1(pw_salt), 0)

stderr.WriteLine "SHA1: " + hash_sha1
stderr.WriteLine "SHA2_256: " + hash_sha2_256
stderr.WriteLine "SHA3_256: " + hash_sha3_256

macOS & Windows return

SHA1: U2DC2mH9M5uRWQSNFRDahGE+hvA=
SHA2_256: 0dMwfTDSK+TLpIfBixe+2UErMkYfQDzPsg8uknoopBw=
SHA3_256: wnMGMFE18DVRxtLfGTJdF1244jWDa1ezafYKYEJG/bI= <==========

Linux returns:

SHA1: U2DC2mH9M5uRWQSNFRDahGE+hvA=
SHA2_256: 0dMwfTDSK+TLpIfBixe+2UErMkYfQDzPsg8uknoopBw=
SHA3_256: 4BMgpukwXes0DTanVwIsxLZMOMbg5+wJiz0Rd+6wLFc=  <==========
2

See issue:
Crypto.SHA3_256 Returns Wrong Hash On Linux

So it should be fixed already.

3

Yeah, I see that, but it’s certainly very broken before 2025r1 and I don’t personally have a license for the 2025 releases.

4

Get a copy of a current libRBCrypto64.so and replace the 2024r4.2 in your built app, I guess it is completely compatible, it’s just the next one after your release. I don’t believe that Xojo would oppose this workaround.

1 Like