Question

After looking into a bug in the original jBCrypt v0.1 C# port: BCrypt.net (Related Question). I decided to compare the new jBCrypt code against the old C# port to look for discrepancies and potential issues like the related question’s bug.

Here is what I’ve found:

// original java (jBCrypt v0.3):
private static int streamtoword(byte data[], int offp[]) {
        int i;
        int word = 0;
        int off = offp[0];

        for (i = 0; i < 4; i++) {
            word = (word << 8) | (data[off] & 0xff);
            off = (off + 1) % data.length;
        }

        offp[0] = off;
        return word;
}


// port to C# :
private static uint StreamToWord(byte[] data, ref int offset)
{

    uint word = 0;

    for (int i = 0; i < 4; i++)
    {
        // note the difference with the omission of "& 0xff"
        word = (word << 8) | data[offset];
        offset = (offset + 1) % data.Length;
    }

    return word;
}

if the prior is incorrect would the following fix it?

private static uint StreamToWord(byte[] data, ref int[] offsetp)
{

    uint word = 0;
    int offset = offsetp[0];
    for (int i = 0; i < 4; i++)
    {
        word = (word << 8) | (uint)(data[offset] & 0xff);
        offset = (offset + 1) % data.Length;
    }

    offsetp[0] = offset;

    return word;
}

Answer 1

The & 0xff is required in the Java version because in Java, bytes are signed. (Some argue that this is a bug.)

In C#, bytes are unsigned, so the & 0xff is unnecessary.