How to generate sha1 hashed passwords?

[Karan-nayyar]

I am trying to generate sha1 hashed password. But the engine used is Rhino. Is there any way I can use any library for Rhino javascript engine to generate these encrypted passwords.

[tonygermano]

If your Rhino environment allows the use of Java libraries, the Google Guava Hashing methods are pretty easy to use. If not, you might want to try https://github.com/brix/crypto-js

[p-bakker]

And if you cannot use additional Java libraries, but you can script Java, google how calculate sha1 hashes in plain Java and adopt that code to JavaScript

[Karan-nayyar]

The library at https://github.com/brix/crypto-js needs require or an import. Both of these I think do not work with rhino javascript engine.

[tuchida]

If you use Babel or something similar and transpile it to ES5 equivalent, can you use it?

[p-bakker]

Note that Rhino supports require (CommonJS modules), but its up to the Rhino embedded to explicitly make this available (as it requires implementation-specific code for resolving the required paths to the actual code (for example loading it from a specific location on the filesystem, through a url from a server or maybe from a database))

[tuchida]

• Generating SHA-1 in benchmark.
• Are you asking for a Web Cryptography API to be implemented in Rhino standard library like Deno? Otherwise, I think this is a issue for a Java or JavaScript question site.
• In today's world, it is dangerous to encrypt passwords with SHA-1.

[Karan-nayyar]

Can I just use this js code at testsrc/benchmarks/sunspider-0.9.1/crypto-sha1.js in my js to just generate these hex hashed sha1 string password for my purpose. This is what I am trying to basically achieve. I cannot use any external library or place the external js file as the application is on cloud.

[tuchida]

crypto-sha1.js is from SunSpider. If you have no problem with the license, you can use it.
Why don't you copy the code or get it by HTTP request and eval it?

[Karan-nayyar]

That worked fine for me just including the code in my js script. I am still very new to this. Can you help me here, how we can get it by HTTP request and eval it?

[tuchida]

get it by HTTP request

This is a general Java question.

and eval it

This is a general JavaScript question.

I think it's better to ask each question on the appropriate question site.

[gbrail]

Wow it'd be great if someone had the time to implement that "Web Cryptography API" on top of Java so that people could plug it optionally into Rhino!

…

On Tue, Jan 25, 2022 at 1:32 PM tuchida ***@***.***> wrote: - Generating SHA-1 in benchmark <https://github.com/mozilla/rhino/blob/6c3a17faadf6adda6c37a9a48546fd245099b2d7/testsrc/benchmarks/sunspider-0.9.1/crypto-sha1.js> . - Are you asking for a Web Cryptography API <https://www.w3.org/TR/WebCryptoAPI/> to be implemented in Rhino standard library like Deno <https://deno.com/blog/v1.18#web-cryptography-api-is-now-complete>? Otherwise, I think this is a issue for a Java or JavaScript question site. - In today's world, it is dangerous to encrypt passwords with SHA-1. — Reply to this email directly, view it on GitHub <#1166 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAD7I236Y6WAE265QHCGQFLUX4JIXANCNFSM5MY5VJUA> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>. You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[Karan-nayyar]

I tried below code for a string "abc".

var rhino=JavaImporter(java.security.MessageDigest)

with(rhino) {
var md=MessageDigest.getInstance("SHA-1");
var sha1 = md.digest((new java.lang.String("abc")).getBytes());
print sha1
}

However, the result is not a correct sha1 encrypted password. Is there anything missing which is resulting in wrong output.I know that sh1 is not a recommended algorithm. But, we are just trying to validate some already existing encrypted sha1 hashed passwords.

[p-bakker]

Is there anything missing which is resulting in wrong output

No idea, but that then becomes a (plain) Java question as what you get as a result isn't specific to Rhino

Sidenote: using with is considered bad practise and will not work in strict mode (haven't tested if Rhino actually raises an exception when trying to use it in strict mode, but it should and if it doesn't, that will get fixed once we'll finish our strictmode implementation)

[tonygermano]

A with expressions is actually the way it has always been recommended to use Rhino's JavaImporter while limiting your import to a block scope. This can still be useful today since let and const are not correctly scoped in Rhino. Personally I would do this instead (also, I think your problem is that md.digest() returns a byte[], which you need to convert to a hex string yourself.)

const MessageDigest = java.security.MessageDigest

var md = MessageDigest.getInstance("SHA-1")
var sha1Bytes = md.digest(new java.lang.String("abc").getBytes())
var sha1Hash = sha1.map(b => ('0' + (b & 0xFF).toString(16)).slice(-2)).join('')
print(sha1Hash)