security and crypto

import java.security.MessageDigest;
import java.util.HexFormat;
 
void main() throws Exception {
    var sha = MessageDigest.getInstance("SHA-256");
    byte[] a = sha.digest("transfer 100 to bob".getBytes());
    byte[] b = sha.digest("transfer 900 to bob".getBytes());
    IO.println(HexFormat.of().formatHex(a));
    IO.println(HexFormat.of().formatHex(b));
    int diff = 0;
    for (int i = 0; i < a.length; i++) diff += Integer.bitCount((a[i] ^ b[i]) & 0xff);
    IO.println(diff + " of 256 bits differ");
}

75b79cfda6fb32768bca896cfc3fcff96e6dd92c04cbbe894a28774d7902bfab
7654b974bec8906ba6edcfa6aab07bdf8ac47e1b5a4101f06b25dab834bafb41
126 of 256 bits differ

this one needs a real JVM (a library class the browser runtime doesn't have), so it doesn't run in the browser. copy it into java Main.java to try it.

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.security.MessageDigest;
 
void main() throws Exception {
    byte[] key = "a key only the server knows".getBytes();
    Mac mac = Mac.getInstance("HmacSHA256");
    mac.init(new SecretKeySpec(key, "HmacSHA256"));
    byte[] tag = mac.doFinal("user=ada;role=reader".getBytes());
 
    byte[] forged = mac.doFinal("user=ada;role=admin".getBytes());
    IO.println("tag still valid after edit: " + MessageDigest.isEqual(tag, forged));
}

tag still valid after edit: false

byte[] salt = new byte[16];
new SecureRandom().nextBytes(salt);                           // a new salt per user, stored next to the hash
 
var spec = new PBEKeySpec(password, salt, 600_000, 256);      // password is a char[], so it can be wiped
byte[] hash = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256")
    .generateSecret(spec).getEncoded();
spec.clearPassword();

import javax.crypto.*;
import javax.crypto.spec.GCMParameterSpec;
import java.security.SecureRandom;
 
void main() throws Exception {
    SecretKey key = KeyGenerator.getInstance("AES").generateKey();      // 256-bit
    byte[] iv = new byte[12];
    new SecureRandom().nextBytes(iv);                                    // never reuse with the same key
 
    Cipher c = Cipher.getInstance("AES/GCM/NoPadding");
    c.init(Cipher.ENCRYPT_MODE, key, new GCMParameterSpec(128, iv));
    byte[] sealed = c.doFinal("meet at 6".getBytes());
    IO.println("key " + key.getEncoded().length * 8 + " bits, 9 bytes in, " + sealed.length + " bytes out");
 
    c.init(Cipher.DECRYPT_MODE, key, new GCMParameterSpec(128, iv));
    IO.println(new String(c.doFinal(sealed)));
 
    sealed[0] ^= 1;                                                      // flip one bit in transit
    c.init(Cipher.DECRYPT_MODE, key, new GCMParameterSpec(128, iv));
    try {
        c.doFinal(sealed);
    } catch (AEADBadTagException e) {
        IO.println("tampered: " + e.getMessage());
    }
}

key 256 bits, 9 bytes in, 25 bytes out
meet at 6
tampered: Tag mismatch

import java.security.*;
 
void main() throws Exception {
    for (String alg : new String[] { "Ed25519", "ML-DSA-65" }) {
        KeyPair pair = KeyPairGenerator.getInstance(alg).generateKeyPair();
        byte[] msg = "release 25.0.4 is mine".getBytes();
 
        Signature s = Signature.getInstance(alg);
        s.initSign(pair.getPrivate());
        s.update(msg);
        byte[] sig = s.sign();
 
        s.initVerify(pair.getPublic());
        s.update(msg);
        boolean ok = s.verify(sig);
 
        msg[0] ^= 1;
        s.initVerify(pair.getPublic());
        s.update(msg);
        boolean tampered = s.verify(sig);
 
        IO.println(alg + ": signature " + sig.length + " bytes, public key " + pair.getPublic().getEncoded().length
            + " bytes, valid " + ok + ", after edit " + tampered);
    }
}

Ed25519: signature 64 bytes, public key 44 bytes, valid true, after edit false
ML-DSA-65: signature 3309 bytes, public key 1974 bytes, valid true, after edit false

import javax.crypto.KEM;
import java.security.*;
import java.util.Arrays;
 
void main() throws Exception {
    // bob makes a key pair and publishes the public half
    KeyPair bob = KeyPairGenerator.getInstance("ML-KEM-768").generateKeyPair();
 
    // alice: encapsulate a fresh secret to bob's public key
    KEM.Encapsulated enc = KEM.getInstance("ML-KEM").newEncapsulator(bob.getPublic()).encapsulate();
    byte[] sent = enc.encapsulation();                      // what goes over the wire
 
    // bob: open it with his private key
    var bobSecret = KEM.getInstance("ML-KEM").newDecapsulator(bob.getPrivate()).decapsulate(sent);
 
    IO.println("encapsulation: " + sent.length + " bytes on the wire");
    IO.println("shared secret: " + enc.key().getEncoded().length + " bytes");
    IO.println("same secret on both sides: " + Arrays.equals(enc.key().getEncoded(), bobSecret.getEncoded()));
}

encapsulation: 1088 bytes on the wire
shared secret: 32 bytes
same secret on both sides: true

import javax.crypto.KDF;
import javax.crypto.spec.HKDFParameterSpec;
import java.util.HexFormat;
 
void main() throws Exception {
    var hex = HexFormat.of();
    // RFC 5869, test case 1
    byte[] ikm = hex.parseHex("0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b");
    byte[] salt = hex.parseHex("000102030405060708090a0b0c");
    byte[] info = hex.parseHex("f0f1f2f3f4f5f6f7f8f9");
 
    KDF hkdf = KDF.getInstance("HKDF-SHA256");
    byte[] okm = hkdf.deriveData(HKDFParameterSpec.ofExtract()
        .addIKM(ikm).addSalt(salt)
        .thenExpand(info, 42));
    IO.println(hex.formatHex(okm));
}

3cb25f25faacd57a90434f64d0362f2a2d2d0a90cf1a5a4c5db02d56ecc4c5bf34007208d5b887185865

this one needs a real JVM (a library class the browser runtime doesn't have), so it doesn't run in the browser. copy it into java Main.java to try it.