3 ms·

Why? Also; if you don't feel like writing a useful response feel free not to respond at all.

by mtrimpe 12y ago

redler 12y ago
Because bcrypt automatically generates and adds a salt every time it's invoked. Every bcrypt hash has a different salt. Hashing the same plaintext ten times will produce ten different hashes.
- mtrimpe 12y ago
  Ah OK; so the default bcrypt implementation essentially just includes the salt in it's output by definition. Got it. I thought hashes were deterministic by definition so I was wondering where the required randomness came from.
teraflop 12y ago
Because bcrypt uses a salt, so a "rainbow table for non-salted passwords" would be utterly useless.
tedunangst 12y ago
One of the things that make these password hashing threads astonishingly tedious is that somebody who has never so much as googled "bcrypt" always chimes in with "but what about the rainbow tables???".
- mtrimpe 12y ago
  There's an XKCD for that: https://xkcd.com/1053/ https://xkcd.com/1053/ As far as I'm concerned bcrypt took the term for a concept that is generally understood to be deterministic (hashing) and redefined it by adding the randomness in by default. That was probably a better call than trying to introduce a new term and a new hashing algorithm at the same time; but it's also asking for the exact long-term confusion you're complaining about here.
  - magicalist 12y ago
    That XKCD doesn't really apply here since you could have easily asked for an explanation without the snark in the first place. There's also a difference between making fun of someone for not knowing something and choosing not to engage with them. > That was probably a better call than trying to introduce a new term and a new hashing algorithm at the same time; but it's also asking for the exact long-term confusion you're complaining about here To be fair, besides a basic search for information on the subject, this was also covered in the linked article...
    - tptacek 12y ago
      He didn't ask snarkily, but we sure are beating this subthread to death. Let's all stop here.
    - mtrimpe 12y ago
      Really? I just reread the article and I couldn't find anything about bcrypt containing the salt as part of its output. P.S. The XKCD wasn't directed tptacek but at tedunangst who apparently felt my comment made this thread 'astonishingly tedious.'
  - tedunangst 12y ago
    What term? The paper that introduced bcrypt was titled "A Future-Adaptable Password Scheme". The first result, Wikipedia, calls it "a key derivation function for passwords".

Why? Also; if you don't feel like writing a useful response feel free not to respond at all.

by mtrimpe 12y ago

Why? Also; if you don't feel like writing a useful response feel free not to respond at all.

Because bcrypt automatically generates and adds a salt every time it's invoked. Every bcrypt hash has a different salt. Hashing the same plaintext ten times will produce ten different hashes.

mtrimpe 12y ago
Ah OK; so the default bcrypt implementation essentially just includes the salt in it's output by definition. Got it. I thought hashes were deterministic by definition so I was wondering where the required randomness came from.

teraflop 12y ago

Because bcrypt uses a salt, so a "rainbow table for non-salted passwords" would be utterly useless.

tedunangst 12y ago

One of the things that make these password hashing threads astonishingly tedious is that somebody who has never so much as googled "bcrypt" always chimes in with "but what about the rainbow tables???".

mtrimpe 12y ago
There's an XKCD for that: https://xkcd.com/1053/ https://xkcd.com/1053/ As far as I'm concerned bcrypt took the term for a concept that is generally understood to be deterministic (hashing) and redefined it by adding the randomness in by default. That was probably a better call than trying to introduce a new term and a new hashing algorithm at the same time; but it's also asking for the exact long-term confusion you're complaining about here.
- magicalist 12y ago
  That XKCD doesn't really apply here since you could have easily asked for an explanation without the snark in the first place. There's also a difference between making fun of someone for not knowing something and choosing not to engage with them. > That was probably a better call than trying to introduce a new term and a new hashing algorithm at the same time; but it's also asking for the exact long-term confusion you're complaining about here To be fair, besides a basic search for information on the subject, this was also covered in the linked article...
  - tptacek 12y ago
    He didn't ask snarkily, but we sure are beating this subthread to death. Let's all stop here.
  - mtrimpe 12y ago
    Really? I just reread the article and I couldn't find anything about bcrypt containing the salt as part of its output. P.S. The XKCD wasn't directed tptacek but at tedunangst who apparently felt my comment made this thread 'astonishingly tedious.'
- tedunangst 12y ago
  What term? The paper that introduced bcrypt was titled "A Future-Adaptable Password Scheme". The first result, Wikipedia, calls it "a key derivation function for passwords".