SAK-28125

Change the previous key lengthening algorithm to be a combined key 
lengthening and key shortening algorithm and move from hex-only 
keys to true raw keys to avoid implicitly shortening key length 
by insisting on only printing characters in keys transported 
over the net.   Here is the new shortening/lengthening/decryption 
algorithm in PHP using raw sha1:

    $sha1Secret = hash('sha1',$actual_secret, true);
    if ( strlen($sha1Secret) > 16 ) $sha1Secret = substr($sha1Secret,0,16);
    $session = mcrypt_decrypt(MCRYPT_BLOWFISH, $sha1Secret, 
        $encrypted_session, MCRYPT_MODE_ECB);

We are still limiting the BlowFish key length to 128 (16 bytes) 
since Java only ships with 128 by default.



git-svn-id: https://source.sakaiproject.org/svn/basiclti/trunk@315744 66ffb92e-73f9-0310-93c1-f5514f145a0a
SAK-28125

Change the previous key lengthening algorithm to be a combined key 
lengthening and key shortening algorithm and move from hex-only 
keys to true raw keys to avoid implicitly shortening key length 
by insisting on only printing characters in keys transported 
over the net.   Here is the new shortening/lengthening/decryption 
algorithm in PHP using raw sha1:

    $sha1Secret = hash('sha1',$actual_secret, true);
    if ( strlen($sha1Secret) > 16 ) $sha1Secret = substr($sha1Secret,0,16);
    $session = mcrypt_decrypt(MCRYPT_BLOWFISH, $sha1Secret,
        $encrypted_session, MCRYPT_MODE_ECB);

We are still limiting the BlowFish key length to 128 (16 bytes) 
since Java only ships with 128 by default.

Also cleanup / remove some redundant code between PortableShaUtil and
BlowFish classes as well as add a bit of error checking on the hex conversions
in PortableShaUtil.  Unit tests updated as well.



git-svn-id: https://source.sakaiproject.org/svn/basiclti/trunk@315745 66ffb92e-73f9-0310-93c1-f5514f145a0a