I have created a GitHub repo where all code referenced here can be found.

Swift

First language up was Swift. Since iOS is my main playground these days this was where I started out. PBKDF2 is more or less supported out of the box using CommonCrypto. We need to add a bridging header to the project and import CommonCrypto in the header.

#import <CommonCrypto/CommonCrypto.h>

Now CommonCrypto is available in the project and we can reference it as any other framework. The code for creating the PBKDF2 hash looks like this

func pbkdf2(hash: CCPBKDFAlgorithm, password: String, salt: String, keyByteCount: Int, rounds: Int) -> String? {
    let passwordData = password.data(using: .utf8)!
    let saltData = salt.data(using: .utf8)!
    var derivedKeyData = Data(repeating: 0, count: keyByteCount)
    
    var localDerivedKeyData = derivedKeyData
    
    let derivationStatus = derivedKeyData.withUnsafeMutableBytes { derivedKeyBytes in
        saltData.withUnsafeBytes { saltBytes in
            
            CCKeyDerivationPBKDF(
                CCPBKDFAlgorithm(kCCPBKDF2),
                password, passwordData.count,
                saltBytes, saltData.count,
                hash,
                UInt32(rounds),
                derivedKeyBytes, localDerivedKeyData.count)
        }
    }
    if (derivationStatus != kCCSuccess) {
        print("Error: \(derivationStatus)")
        return nil;
    }
    
    return toHex(derivedKeyData)
}

// Converts data to a hexadecimal string
private func toHex(_ data: Data) -> String {
    return data.map { String(format: "%02x", $0) }.joined()
}

I also added some helper functions for easily creating hashes based on which SHA algorithm I wanted to use.

func pbkdf2sha1(password: String, salt: String, keyByteCount: Int, rounds: Int) -> String? {
    return pbkdf2(hash: CCPBKDFAlgorithm(kCCPRFHmacAlgSHA1), password: password, salt: salt, keyByteCount: keyByteCount, rounds: rounds)
}

func pbkdf2sha256(password: String, salt: String, keyByteCount: Int, rounds: Int) -> String? {
    return pbkdf2(hash: CCPBKDFAlgorithm(kCCPRFHmacAlgSHA256), password: password, salt: salt, keyByteCount: keyByteCount, rounds: rounds)
}

func pbkdf2sha512(password: String, salt: String, keyByteCount: Int, rounds: Int) -> String? {
    return pbkdf2(hash: CCPBKDFAlgorithm(kCCPRFHmacAlgSHA512), password: password, salt: salt, keyByteCount: keyByteCount, rounds: rounds)
}

Theoretically using SHA256 or SHA512 should be preferred but in reality it should not make a big difference since the security of PBKDF2 also lies in stretching of the key and not only the SHA algorithm used.

The result of testing the function looks like this

pbkdf2sha1(password: "password", salt: "salt", keyByteCount: 20, rounds: 5000)
// => edf738254821c55da61e6afa20efd0c657cb941c

Node

Now lets see if we can produce similar results using Node.

Hashing using PBKDF2 is part of Node so no need to use other modules. I have seen modules on NPM offering PBKDF2 hashing but unless there are very specific reasons for using these modules just use the methods provided by Node.

PBKDF2 hashing resides in the crypto module so start by requiring (or importing) it.

const crypto = require('crypto');

After that it is just a matter of calling the pbkdf2 function (or its synchronous cousin pbkdf2Sync).

crypto.pbkdf2Sync("password", "salt", 5000, 20, 'sha1').toString('hex');
// => edf738254821c55da61e6afa20efd0c657cb941c

As you can see the hash matches the one produced by Swift so it looks like we are heading in the right direction!

Java

Finally we need to be able to produce the same hash using Java.

Java also supports PBKDF2 out of the box using the javax.crypto package. The examples used here were meant to run on the server so I honestly do not know if it will run on an Android device since the Dalvik VM is a scaled down version of what runs in a standard JVM. It might work, it might not.

Start out by importing the SecretKeyFactory and the PBEKeySpec.

import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.PBEKeySpec;

After that it is just a matter of using the snippet below.

public static String pbkdf2(String password, String salt, int iterations, int keyLength) throws NoSuchAlgorithmException, InvalidKeySpecException {
    char[] chars = password.toCharArray();

    PBEKeySpec spec = new PBEKeySpec(chars, salt.getBytes(), iterations, keyLength);
    SecretKeyFactory skf = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1");
    byte[] hash = skf.generateSecret(spec).getEncoded();
    return toHex(hash);
}

// Converts byte array to a hexadecimal string
private static String toHex(byte[] array) {
    StringBuffer sb = new StringBuffer();
    for (int i = 0; i < array.length; i++) {
        sb.append(Integer.toString((array[i] & 0xff) + 0x100, 16).substring(1));
    }
    return sb.toString();
}

Testing it reveals this surprising result

pbkdf2("password", "salt", 5000, 20);
// => edf7

Hmmm. Not quite what we expected. After some fiddling with the method it turns out we have to multiply the keyLength with 8 to provide the same results as with Swift and Node.

public static String pbkdf2(String password, String salt, int iterations, int keyLength) throws NoSuchAlgorithmException, InvalidKeySpecException {
    char[] chars = password.toCharArray();

    PBEKeySpec spec = new PBEKeySpec(chars, salt.getBytes(), iterations, keyLength*8);
    SecretKeyFactory skf = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1");
    byte[] hash = skf.generateSecret(spec).getEncoded();
    return toHex(hash);
}

This produces the following result which aligns nicely with the results from Swift and Node.

pbkdf2("password", "salt", 5000, 20);
// => edf738254821c55da61e6afa20efd0c657cb941c

That’s it. Again, everything is available at GitHub, enjoy!

So now I’m taking a dive with Jekyll and GitHub Pages. Why? Posting is just a whole lot easier when all you need to do is write something directly on GitHub. No deployment steps or anything, just plain markdown. And having support for tables (through kramdown) was a nice bonus as well. So time to start blogging on my latest endevaours into iOS and Swift!

When the app starts it will automatically show you the transmitters of the country with the best signal. You can change country by clicking the menu icon at the top left and simply select the country you are interested in. It’s as easy as that!

The app can be downloaded from the Apple App Store.

Update 22.04.2014

After repeated searches for answers on the web about my internal memory issues with my Huawei came up fruitless I went ahead and rooted the device. Turns out there is no hidden /data/log folder (or any other folder containing garbage for that matter). I did find out that cleaning the /data/tombstones folder would give me (tiny) space improvements but overall the findings were very disapointing.

My next suspicion was looking a little bit closer at the storage required by the mandatory Google apps. It did seem like they were taking up a lot of space and since they cannot be moved to your SD card they are just hogging up internal memory. I figured a factory reset of my phone would reveal more. After the factory reset (but before updating all the mandatory apps) my phone had more than 600MB of internal memory (the phone is shipped with 1GB internal memory so I assume the rest is used for the OS). I updated all the mandatory Google apps and internal memory went down to 350MB! Experience has shown me that when the phone comes close to 100MB of free internal memory it starts getting cranky and really slow so this leaves me with 250MB of free space. Not really encouraging since all the mandatory apps like Facebook, Twitter, Google+, Gmail, Chrome, Hangouts and Maps caches data in internal memory so it is only a matter of (short) time before I am back to square one. Did I mention that the apps are mandatory despite I am not using apps like Google+ or Hangouts and possibly others as well?

I understand that older phones over time are considered inferior to newer models but I do not expect older phones to become useless all of a sudden as is the case right now. I believe there is a huge market for budget, low-spec smartphones (especially in 3rd World countries) but if the OS keeps requiring us to install bigger and bigger mandatory apps from Google I think they are making a mistake.

CC photo by Natesh Ramasamy

Users of Find Antenna for iPhone must wait a little longer to enjoy this, but do not worry, it is coming to the iPhone as well in the near future!

The switch also gave me a chance of redesigning the blog entirely. I was previously using a very old version of Blogger since I did not want to convert the templates to the new Blogger format as I would much rather use a new platform and spend my time on migrating to that. I used Bootstrap for the styling but strongly considered trying something more OOCSS-like just for the experience. The blog is now responsive and looks great on all the devices I tested so far.

I also introduced Disqus as my comments framework. Previously I just used the built-in Blogger comments framework which worked but was not that exciting. So far I like Disqus although it has some quirks and some limits in regard to formatting.

The conclusion? I am pretty happy about the end result from more than one perspective. I have more control with my blog and the frameworks it uses. It is definitely a huge plus that my posts are now written as markdown documents removing (most) formatting and styling from the document itself leaving all styling to my templates and stylesheets. Overall a huge win, I would definitely consider DocPad for my future projects.

The first version of the app only contains Danish transmitters but more countries are expected to be supported shortly. I will add Sweden, Germany, United Kingdom and Australia in the near future. If you want your country added or have information on transmitters not on the list do not hesitate to contact me.

The app is available at the App Store so go get it while it’s hot!

The app is currently only available for Android. You can find at Google Play by clicking the icon above.

mysql> show variables like 'char%';
+--------------------------+----------------------------+
| Variable_name            | Value                      |
+--------------------------+----------------------------+
| character_set_client     | utf8                       |
| character_set_connection | utf8                       |
| character_set_database   | latin1                     |
| character_set_filesystem | binary                     |
| character_set_results    | utf8                       |
| character_set_server     | latin1                     |
| character_set_system     | utf8                       |
| character_sets_dir       | /usr/share/mysql/charsets/ |
+--------------------------+----------------------------+

mysql> show variables like 'collation%';
+----------------------+-------------------+
| Variable_name        | Value             |
+----------------------+-------------------+
| collation_connection | utf8_general_ci   |
| collation_database   | latin1_swedish_ci |
| collation_server     | latin1_swedish_ci |
+----------------------+-------------------+

As we can see latin1 is used in several places. This should be changed to UTF-8. You can do this by either editing your existing my.cnf configuration file or creating a new configuration file in the conf.d folder of your MySQL configuration (recommended). I create a new configuration file at conf.d/utf8.cnf which looks like this.

[mysqld]
character-set-server = utf8
character-set-client = utf8

Restart the server.

> sudo service mysql restart

Log in to MySQL and check that everything is ok.

mysql> show variables like 'char%';
+--------------------------+----------------------------+
| Variable_name            | Value                      |
+--------------------------+----------------------------+
| character_set_client     | utf8                       |
| character_set_connection | utf8                       |
| character_set_database   | utf8                       |
| character_set_filesystem | binary                     |
| character_set_results    | utf8                       |
| character_set_server     | utf8                       |
| character_set_system     | utf8                       |
| character_sets_dir       | /usr/share/mysql/charsets/ |
+--------------------------+----------------------------+

mysql> show variables like 'collation%';
+----------------------+-----------------+
| Variable_name        | Value           |
+----------------------+-----------------+
| collation_connection | utf8_general_ci |
| collation_database   | utf8_general_ci |
| collation_server     | utf8_general_ci |
+----------------------+-----------------+

Everything is now using UTF-8.

Update 21.11.2012

If you want to use utf8_unicode_ci instead of utf8_general_ci (you probably want that, see this) then add the following to the my.cnf file in the mysqld section and restart the server.

collation-server = utf8_unicode_ci

Update 21.11.2012 (a little later)

The collation settings should be something like this.

mysql> show variables like 'collation%';
+----------------------+-----------------+
| Variable_name        | Value           |
+----------------------+-----------------+
| collation_connection | utf8_general_ci |
| collation_database   | utf8_unicode_ci |
| collation_server     | utf8_unicode_ci |
+----------------------+-----------------+

I previously had the impression that it should be utf8_unicode_ci for all collation variables (obtained by setting the skip-character-set-client-handshake option in my.cnf) but this generated weird behavior when comparing dates in the database.

I want to create a script inserting all entries where name starts with P. The first step is to create a table containing these entries.

CREATE TABLE b (SELECT FROM a WHERE name LIKE 'P%');

Now the data can be exported using mysqldump.

> mysqldump -p -u <username> <database> b > insert-script.sql

The created script contains statements which will drop and create the table (among other things). Normally I am only interested in the part where the insert statements are so open the created script file and remove everything except the INSERT INTO statement. Also remember to rename the name of the table where the data is to be inserted to the correct table name (table A in my case). The final script file should look something like this.

INSERT INTO a VALUES (1, 'Peter'),('3', 'Paul');

Finally you should drop the temporary table you created.