3 ms·
Complete noob. Can you explain this more. if you bcrypt(12345) isn't the result always same ? If the hash varies then what does the inbuilt nonce depend on ?
by boundlessdreamz 17y ago
Complete noob. Can you explain this more. if you bcrypt(12345) isn't the result always same ? If the hash varies then what does the inbuilt nonce depend on ?
- tptacek 17y ago>> BCrypt::Password.create("hi,mom", :cost => 10) => "$2a$10$L/c.1uoZSh3oaU1fLrnYK.yyU4PiJXsIAzN22qnbU41liyLn5/of 2" >> BCrypt::Password.create("hi,mom", :cost => 10) => "$2a$10$3F0BVk5t8/aoS.3ddaB3l.fxg5qvafQ9NybxcpXLzMeAt.nVWn.NO" >> BCrypt::Password.create("hi,mom", :cost => 10) => "$2a$10$VEVmGHy4F4XQMJ3eOZJAUeb.MedU0W10pTPCuf53eHdKJPiSE8sMK" Despite the pages and pages and pages and pages of conversation about how to select and format "salts", adding random nonces to hashes is not one of the world's great CS problems.
- boundlessdreamz 17y agoI don't understand it still. The cost factor and the string remains the same but different hashes are produced. So if a user inputs "hi,mom" and the app generates a hash, how is it going to be the same as the one in DB ? Or did you make a mistake and the cost factors are supposed to different ?
- tptacek 17y agoJust do what the library tells you to do to check passwords and trust me that bcrypt hashes already have nonces built into them.
- kasterma 17y agoI had the same question; I don't know the answer yet, but I found a location for the answer http://www.openbsd.org/papers/bcrypt-paper.ps http://www.openbsd.org/papers/bcrypt-paper.ps The documentation for py-bcrypt ( http://www.mindrot.org/projects/py-bcrypt/ http://www.mindrot.org/projects/py-bcrypt/) doesn't explain what happens, but shows use is very very easy. EDIT: current guess is that searching for the salt that was used might be part of what makes it hard.