4 ms·

This is written in C, right?

• tedunangst 2y ago
  Your rewrite of bcrypt in not C is unlikely to support longer passwords.
  • _hyn3 2y ago
    NotC, the language that entire operating systems haven't been written in.
• lanstin 2y ago
  Probably Java. This is not a memory vulnerability but a protocol vulnerability.
• lelanthran 2y ago
  > This is written in C, right? What's your point? That rewriting `bcrypt` in something else magically fixes this? AIUI, the issue is that `bcrypt` only uses the first 72 bytes of the input to create a hash.
  • drbig 2y ago
    The issue is with the user mistaking bcrypt for a general-purpose digest hashing tool. It's like using a flat-head screwdriver as a hardwood chisel and then the handle breaks off after the third strike.