MessageDigest.update

Question

Hello,
I'm currently writing an iPhone app which connects and authenticates with a server written in Java. Due to security, I want to send the user data encrypted.
On the server I use:
byte[] bSalt = base64ToByte(salt);
MessageDigest digest = MessageDigest.getInstance("SHA-256");
digest.reset();
digest.update(bSalt);
byte[] bToHash = digest.digest(toHash.getBytes("UTF-8"));
for (int i = 0; i < 3; i++) {
System.out.println(byteToBase64(bToHash));
digest.reset();
digest.update(bSalt); // More secure?
bToHash = digest.digest(bToHash);
By now, I managed to hash in Objective C, too, but the salt is the problem. For getting the same hashing results in ObjC, I need to know what MessageDigest.update does. Does it simply compute an OR with the current digest and the salt or what does it do? Thanks for your help.
Greetings
Naznaz

Answer 1

MessageDigest digest = MessageDigest.getInstance("SHA-256");
digest.reset();The reset() is unnecessary here. You've just created the MessageDigest object. Resetting it won't change anything - there is nothing to change yet.
digest.update(bSalt);
byte[] bToHash = digest.digest(toHash.getBytes("UTF-8"));
for (int i = 0; i < 3; i++) {There is little to gain from repeating the digesting algorithm three times.
System.out.println(byteToBase64(bToHash));
digest.reset();Almost certainly wrong. You are throwing away all prior state here, including the salt.
digest.update(bSalt); // More secure?More secure than what? I suspect you can omit this too.
bToHash = digest.digest(bToHash);That should almost certainly be update(), not digest(). digest() is the last thing you call, when you get to the last piece of input.
I need to know what MessageDigest.update does.It's algorithm-dependent, obviously. In this case you are using SHA-256 so you would need to look up that algorithm. It's lengthy!
Does it simply compute an OR with the current digest and the saltDefinitely not. It applies the specified digest algorithm to its current state and the next piece of input you provide. This code should mirror the code you say you already have working in Objective-C.
But none of this is encryption. It is message-digesting. The result cannot be decrypted.