4 ms·
A note about combining SHA512 with bcrypt: Don't feed the raw binary output of SHA512 into bcrypt. Use the hexadecimal or base64-encoded form instead. (Dropbox
by kijin 10y ago
A note about combining SHA512 with bcrypt: Don't feed the raw binary output of SHA512 into bcrypt. Use the hexadecimal or base64-encoded form instead. (Dropbox probably does this already, since they mention base64 in passing.)
bcrypt is known to choke on null bytes. Each SHA512 hash has a 25% chance of containing a null byte if you use the raw binary format.
Using hex or base64, of course, decreases the amount of entropy that you can fit into bcrypt's 72-byte limit. But you can still fit 288 to 432 bits of entropy in that space, which is more than enough for the foreseeable future.
- benmanns 10y agoThanks for the reminder. You could encode with a "base255" algorithm that just excludes the null byte to retain more entropy within 72 bytes.
- cmiller1 10y agohttp://stromberg.dnsalias.org/svn/base255/trunk/ http://stromberg.dnsalias.org/svn/base255/trunk/
- arielb1 10y agoEven hex-encoding for 288 bits of entropy is plenty good enough.
- KMag 10y agoMuch faster than all of those multiplications that invertibly maps 64 bytes to 65 bytes without nulls: replace first null with 255. Every later null, replace with the index of the previous null. Make the final byte the index of the last null (or 255 if no nulls were replaced). In this way, you've replaced the nulls with a linked list of the locations where nulls used to be. To invert the transformation, just start at the final byte and walk the linked list backward until you hit a 255. (You'd never do the inversion in practice, but the existence of the inversion algorithm proves that no entropy was discarded.) Use the time saved by not doing base 255 conversion to increase your iteration count.
- kijin 10y agoAny time you spend or save on these kinds of transformations is going to pale in comparison to the bcrypt step. It might not even amount to a single iteration.
- raverbashing 10y agoAnd that's what Django does in this case, though it uses SHA256 as the first step https://github.com/django/django/blob/master/django/contrib/auth/hashers.py#L426 https://github.com/django/django/blob/master/django/contrib/...
- MichaelGG 10y agoWhat a strange thing to do. Is this due to some C-style string handling? Why should any hashing function treat input as text?
- Lucretiel 10y agoIt sounds like they do: > For ease of elucidation, in the figure and below we omit any mention of binary encoding (base64).