PBKDF2 HMACSHA512在C#与Java中的哈希差异排查

搭档使用PWDTK.NET库对用户密码进行编码，现在计划将用户迁移至我的Spring Boot应用，需要保证密码编码逻辑一致，但我无法生成与C#端相同的哈希值。

测试数据 #

• 明文密码："123456"
• 存储的Salt（Base64编码）："F2ZEAo/UMjzIJwNvCC6cRwObd4CX462BTv4Tn/ntaTad6P8Xej1VNqlwNdueYo/XklYPH2RDfLUjsa/dkqnQzg=="
• 存储的哈希值（Base64编码）："hwuR4Ol/tVi9DxRsjAstLt+wfJsTMr+ZzOBh3X90pAmhZU2gyeOngE7OMbQuVB/VYjj+47IqtIYffJ9CHfV7TQ=="

C#端实现代码 #

public static HashedPassword GetNewPassword(string plainPassword)
{
    byte[] randomSalt = PWDTK.GetRandomSalt();
    byte[] hash = PWDTK.PasswordToHash(randomSalt, plainPassword);
    return new HashedPassword { PasswordHash = Convert.ToBase64String(hash), Salt = Convert.ToBase64String(randomSalt) };
}

Java（Spring Boot）端实现代码 #

public static boolean matches(String rawPassword, String storedHash, String storedSalt) throws NoSuchProviderException, UnsupportedEncodingException {

    byte[] decodedHash = Base64.getDecoder().decode(storedHash.getBytes());
    System.out.println("hash " + Hex.encodeHexString(decodedHash));

    byte[] decodedSalt = Base64.getDecoder().decode(storedSalt.getBytes());
    System.out.println("salt " + Hex.encodeHexString(decodedSalt));

    try {
        PBEKeySpec spec = new PBEKeySpec(rawPassword.toCharArray(), decodedSalt, 5000, 512);
        SecretKeyFactory factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA512");
        SecretKey generatedKey = factory.generateSecret(spec);
        byte[] generatedHash = generatedKey.getEncoded();
        System.out.println(Base64.getEncoder().encodeToString(generatedHash));
        return MessageDigest.isEqual(decodedHash, generatedHash);
    } catch (NoSuchAlgorithmException | InvalidKeySpecException e) {
        // Handle exceptions
        e.printStackTrace();
        return false;
    }
}

当前测试结果 #

我尝试多款在线PBKDF2工具，结果均与Java端一致。使用上述盐值、明文密码及5000次迭代，得到的哈希结果（十六进制）为：5281e548c33c0fece48967900b6af8dcfc66d7266fbede24be918192d3feb1437827e7c1c0b93c289abb805fbbfb76d66b512082f74b76061f5bd21d9d41d0ad，但与C#端存储的哈希值不匹配。

请问导致C#与Java端PBKDF2 HMACSHA512哈希不一致的原因可能是什么？

内容的提问来源于stack exchange，提问作者skrgahr