5 ms·
My understanding is bcrypt truncates at 72 bytes by default, which could be 18 emojis I guess? It should still be consistent with registration/login with thing
by charrondev 6y ago
My understanding is bcrypt truncates at 72 bytes by default, which could be 18 emojis I guess?
It should still be consistent with registration/login with things getting truncated, but I think this is also the default in PHP if you are using password_hash() today. Is that a security issue?
- couchand 6y ago> Although implementing a maximum password length does reduce the possible keyspace for passwords, a limit of 64 characters still leaves a key space of at least 2^420, which is completely infeasible for an attacker to break. As such, it does not represent a meaningful reduction in security. https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#maximum-password-lengths https://cheatsheetseries.owasp.org/cheatsheets/Password_Stor...
- masklinn 6y ago> My understanding is bcrypt truncates at 72 bytes by default I don’t think it’s “a default”, it’s a fundamental limitation of the algorithm. Specific bcrypt libraries could implement length-reduction by default though.