Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/elliotwutingfeng/balloon-hashing-kotlin
Balloon Hashing implemented in Kotlin.
https://github.com/elliotwutingfeng/balloon-hashing-kotlin
crypto cryptography gradle hash java kdf-algorithm key-derivation-function kotlin password
Last synced: 4 days ago
JSON representation
Balloon Hashing implemented in Kotlin.
- Host: GitHub
- URL: https://github.com/elliotwutingfeng/balloon-hashing-kotlin
- Owner: elliotwutingfeng
- License: bsd-3-clause
- Created: 2023-04-20T04:03:33.000Z (over 1 year ago)
- Default Branch: main
- Last Pushed: 2024-10-21T18:58:58.000Z (25 days ago)
- Last Synced: 2024-10-22T11:26:08.402Z (25 days ago)
- Topics: crypto, cryptography, gradle, hash, java, kdf-algorithm, key-derivation-function, kotlin, password
- Language: Kotlin
- Homepage: https://crypto.stanford.edu/balloon
- Size: 4.36 MB
- Stars: 1
- Watchers: 0
- Forks: 0
- Open Issues: 3
-
Metadata Files:
- Readme: README.md
- License: LICENSE
- Code of conduct: CODE_OF_CONDUCT.md
Awesome Lists containing this project
README
# Balloon Hashing
[](https://kotlinlang.org)
[](https://coveralls.io/github/elliotwutingfeng/balloon-hashing-kotlin?branch=main)
[](LICENSE)
Balloon Hashing implemented in Kotlin. All credit to Dan Boneh, Henry Corrigan-Gibbs, and Stuart Schechter. For more information see
the [research paper](https://eprint.iacr.org/2016/027.pdf) or their [website](https://crypto.stanford.edu/balloon/) for this project.
This is a direct port of the Python [implementation](https://github.com/nachonavarro/balloon-hashing) by [nachonavarro](https://github.com/nachonavarro).
**Warning:** Please DO NOT use this code in production! It has not been tested rigorously for security vulnerabilities.
## Background
Balloon Hashing is a new hashing function that, according to the paper, is:
* **Built from Standard Primitives:** Builds on top of other common hashing functions.
* **Has Proven Memory-Hardness Properties:** See paper.
* **Resistant to Cache Attacks:** The idea is that an adversary who can observe the memory access patterns of the buffer in the algorithm (for example through cached side-channels) still can't figure out the password being cached.
* **Practical:** Is as good as the best hashing functions used in production today.
## Algorithm
The algorithm consists of three main parts, as explained in the paper.
The first step is the expansion, in which the system fills up a buffer with pseudorandom bytes derived from the password and salt by computing repeatedly the hash function on a combination
of the password and the previous hash.
The second step is mixing, in which the system mixes timeCost number of times the pseudorandom
bytes in the buffer. At each step in the for loop, it updates the nth block to be the hash of the n-1th block, the nth block,
and delta other blocks chosen at random from the buffer.
In the last step, the extraction, the system outputs as the hash the last element in the buffer.
## Requirements
* OpenJDK 17
* Kotlin 1.8.21
* Gradle 8.1.1
## Usage
```kotlin
import balloon.hashing.kotlin
import java.util.HexFormat
val password = "buildmeupbuttercup"
val salt = "JqMcHqUcjinFhQKJ"
println(balloonHash(password, salt)) // OUTPUT: 2ec8d833db5f88e584ab793950ecfb21657a3816edea8d9e73ea23c13ba2b740
val delta = 5u
val timeCost = 18u
val spaceCost = 24u
println(HexFormat.of().formatHex(balloon(password, salt, spaceCost, timeCost, delta)))
// OUTPUT: 69f86890cef40a7ec5f70daff1ce8e2cde233a15bffa785e7efdb5143af51bfb
```
## Testing
```bash
./gradlew build
```
## References
* [Dart implementation](https://github.com/elliotwutingfeng/balloon_hashing)
* [Julia implementation](https://github.com/elliotwutingfeng/BalloonHashing.jl)
* [Python implementation](https://github.com/nachonavarro/balloon-hashing)
* [Ruby implementation](https://github.com/elliotwutingfeng/balloon-hashing)
* [Rust implementation](https://crates.io/crates/balloon-hash)
* [JaCoCo plugin](https://docs.gradle.org/current/userguide/jacoco_plugin.html)