Let SCryptUtil accept char[] passwords in addition to Strings

src/main/java/com/lambdaworks/crypto/SCryptUtil.java

@@ -2,9 +2,12 @@
 
 package com.lambdaworks.crypto;
 
-import java.io.UnsupportedEncodingException;
+import java.nio.ByteBuffer;
+import java.nio.CharBuffer;
+import java.nio.charset.StandardCharsets;
 import java.security.GeneralSecurityException;
 import java.security.SecureRandom;
+import java.util.Arrays;
 
 import static com.lambdaworks.codec.Base64.*;
 
@@ -40,11 +43,39 @@ public class SCryptUtil {
      * @return The hashed password.
      */
     public static String scrypt(String passwd, int N, int r, int p) {
+        byte[] bytes = passwd.getBytes(StandardCharsets.UTF_8);
+        try {
+            return scryptInternal(bytes, N, r, p);
+        } finally {
+            wipeArray(bytes);
+        }
+    }
+
+    /**
+     * Hash the supplied plaintext password and generate output in the format described
+     * in {@link SCryptUtil}.
+     *
+     * @param passwd Password.
+     * @param N      CPU cost parameter.
+     * @param r      Memory cost parameter.
+     * @param p      Parallelization parameter.
+     * @return The hashed password.
+     */
+    public static String scrypt(char[] passwd, int N, int r, int p) {
+        byte[] bytes = toBytes(passwd);
+        try {
+            return scryptInternal(bytes, N, r, p);
+        } finally {
+            wipeArray(bytes);
+        }
+    }
+
+    private static String scryptInternal(byte[] passwordBytes, int N, int r, int p) {
         try {
             byte[] salt = new byte[16];
             SecureRandom.getInstance("SHA1PRNG").nextBytes(salt);
 
-            byte[] derived = SCrypt.scrypt(passwd.getBytes("UTF-8"), salt, N, r, p, 32);
+            byte[] derived = SCrypt.scrypt(passwordBytes, salt, N, r, p, 32);
 
             String params = Long.toString(log2(N) << 16L | r << 8 | p, 16);
 
@@ -54,22 +85,54 @@ public static String scrypt(String passwd, int N, int r, int p) {
             sb.append(encode(derived));
 
             return sb.toString();
-        } catch (UnsupportedEncodingException e) {
-            throw new IllegalStateException("JVM doesn't support UTF-8?");
         } catch (GeneralSecurityException e) {
             throw new IllegalStateException("JVM doesn't support SHA1PRNG or HMAC_SHA256?");
         }
     }
 
+    private static byte[] toBytes(char[] chars) {
+        CharBuffer charBuffer = CharBuffer.wrap(chars);
+        ByteBuffer byteBuffer = StandardCharsets.UTF_8.encode(charBuffer);
+        try {
+            return Arrays.copyOfRange(byteBuffer.array(), byteBuffer.position(), byteBuffer.limit());
+        } finally {
+            wipeArray(byteBuffer.array());
+        }
+    }
+
     /**
      * Compare the supplied plaintext password to a hashed password.
      *
      * @param   passwd  Plaintext password.
      * @param   hashed  scrypt hashed password.
-     *
      * @return true if passwd matches hashed value.
      */
     public static boolean check(String passwd, String hashed) {
+        byte[] bytes = passwd.getBytes(StandardCharsets.UTF_8);
+        try {
+            return checkInternal(bytes, hashed);
+        } finally {
+            wipeArray(bytes);
+        }
+    }
+
+    /**
+     * Compare the supplied plaintext password to a hashed password.
+     *
+     * @param   passwd  Plaintext password.
+     * @param   hashed  scrypt hashed password.
+     * @return true if passwd matches hashed value.
+     */
+    public static boolean check(char[] passwd, String hashed) {
+        byte[] bytes = toBytes(passwd);
+        try {
+            return checkInternal(bytes, hashed);
+        } finally {
+            wipeArray(bytes);
+        }
+    }
+
+    private static boolean checkInternal(byte[] passwordBytes, String hashed) {
         try {
             String[] parts = hashed.split("\\$");
 
@@ -85,7 +148,7 @@ public static boolean check(String passwd, String hashed) {
             int r = (int) params >> 8 & 0xff;
             int p = (int) params      & 0xff;
 
-            byte[] derived1 = SCrypt.scrypt(passwd.getBytes("UTF-8"), salt, N, r, p, 32);
+            byte[] derived1 = SCrypt.scrypt(passwordBytes, salt, N, r, p, 32);
 
             if (derived0.length != derived1.length) return false;
 
@@ -94,8 +157,6 @@ public static boolean check(String passwd, String hashed) {
                 result |= derived0[i] ^ derived1[i];
             }
             return result == 0;
-        } catch (UnsupportedEncodingException e) {
-            throw new IllegalStateException("JVM doesn't support UTF-8?");
         } catch (GeneralSecurityException e) {
             throw new IllegalStateException("JVM doesn't support SHA1PRNG or HMAC_SHA256?");
         }
@@ -109,4 +170,8 @@ private static int log2(int n) {
         if (n >= 4  ) { n >>>= 2; log += 2; }
         return log + (n >>> 1);
     }
+
+    private static void wipeArray(byte[] array) {
+        Arrays.fill(array, (byte) 0);
+    }
 }