3 ms·
Again, the point isn't about whether 12 is enough. It could have been 64 and the point would still stand. The OP's point is that limiting password length (to
by peeters 14y ago
Again, the point isn't about whether 12 is enough. It could have been 64 and the point would still stand. The OP's point is that limiting password length (to anything less than 1000 or so) is usually done to be able to set a maximum length on the password column of a database. Password hashes, on the other hand (including bcrypt), produce fixed-length hashes, regardless of the input size.
- adrr 14y agobcrypt has a 50 char limit. You could always prehash(sha256) the password before passing it to bcrypt.
- krallja 14y agoThat is not something I would have guessed about bcrypt. I learned something new today.
- jcase 14y agoIt's 72 actually. I thought it was 56 as mentioned on the original [?] BCrypt website[1]. A thread[2] on security/stackexchange discusses a workaround for the 72 char limit. See https://gist.github.com/4690368 https://gist.github.com/4690368 for a simple test case that shows the >72 char truncation. The source provides a hint: /* Schneier specifies a maximum key length of 56 bytes. * This ensures that every key bit affects every cipher * bit. However, the subkeys can hold up to 72 bytes. * Warning: For normal blowfish encryption only 56 bytes * of the key affect all cipherbits. */ [1] http://bcrypt.sourceforge.net/ http://bcrypt.sourceforge.net/ [2] http://security.stackexchange.com/questions/21524/bcrypts-72-character-limit-and-using-it-as-a-general-digest-algorithm http://security.stackexchange.com/questions/21524/bcrypts-72...