3 ms·
That's a lot of code in the PHP example! To use bcrypt you can just do this: password_hash($password, PASSWORD_BCRYPT) From version 5.5 that is, but you can
by stephen_g 13y ago
That's a lot of code in the PHP example! To use bcrypt you can just do this:
password_hash($password, PASSWORD_BCRYPT)
From version 5.5 that is, but you can get a compatibility library for older versions.
- jamesmoss 13y agoThis is bang on. PHP devs need to stop rolling their own hashing methods. The compatibility library to use for PHP <5.5 is Antony Ferrara's password_compat: https://github.com/ircmaxell/password_compat https://github.com/ircmaxell/password_compat.
- RyanZAG 13y agoAgree - same applies for the other languages at the bottom of the page. He should remove those code samples and just link to the bcrypt function/library for each language.
- junto 13y agoDisagree. Windows .net devs shouldn't use Bcrypt. The .net bcrypt port hasn't been verified for .net, so they should be using pbkdf2 instead, as per the article. The most recent version of the ASP.net Membership provider offers this hashing algorithm as a built in option. http://stackoverflow.com/questions/481160/is-bcrypt-a-good-hashing-algorithm-to-use-in-c-where-can-i-find-it/4435888#4435888 http://stackoverflow.com/questions/481160/is-bcrypt-a-good-h...
- selimthegrim 13y agoI assume this is that .NET library function Rfc2898DeriveBytes?
- cmircea 13y agoHas the BCrypt code for all other languages been formally verified?
- roryokane 13y agoI was wondering how bcrypt can be secure while not requiring a salt to be passed in, since the article devotes so much time to salts. I found the answer here: http://stackoverflow.com/questions/6832445/how-can-bcrypt-have-built-in-salts http://stackoverflow.com/questions/6832445/how-can-bcrypt-ha.... Basically, bcrypt randomly generates a long, probably-unique salt for every hashed password, and the salt is stored along with the hash by simply concatenating it to the string (e.g. “randomsaltZdR3/passwordhashMP2tA”). To check an incoming password against the stored hash, bcrypt splits the stored string on ‘/’ to extract the salt, hashes `password+salt`, and compares that hash against the one to the right of ‘/’ in the stored string.
- yeukhon 13y agoI don't think it's bcrypt that does it. It's the underlying implementation of bcrypt chooses to do it for the users. Or does the actual bcrypt standard says implementation has to generate one for user?
- roryokane 13y agoIt seems that bcrypt does not specify that salts are randomly generated, but it does specify that the salt is stored with the hash. The “Bcrypt Algorithm” section of the paper at https://www.usenix.org/legacy/publications/library/proceedings/usenix99/provos/provos_html/index.html https://www.usenix.org/legacy/publications/library/proceedin... shows salts to be an input to the algorithm, and also describes them being concatenated with the hash. Random generation of the salt must be just a de-facto standard for bcrypt APIs. It’s true that that feature is orthogonal to the hashing function, and so libraries for other hashing algorithms could easily copy it.
- yeukhon 13y agoI think the part concat with salt is required. But generating it FOR the user is orthogonal to the hashing function. But I will be surprise if the paper actually says it is required to generate one - because that shows the cleverness of the inventors, but also a potential weakness (implementation may be using weak random source, though counter-argument is that user supplied salt can be weak too).