BCrypt is an adaptive cryptographic hash function for passwords. It incorporate a salt to protect against rainbow table attacks and is also an adaptive hash - over time it can be made slower and slower so it remains resistant to specific brute-force search attacks against the hash and the salt.

learn more… | top users | synonyms

259
votes
4answers
75k views

Do any security experts recommend bcrypt for password storage?

On the surface bcrypt, an 11 year old security algorithm designed for hashing passwords by Niels Provos and David Mazieres, which is based on the initialization function used in the NIST approved ...
250
votes
10answers
29k views

Is my developer's home-brew password security right or wrong, and why?

A developer, let's call him 'Dave', insists on using home-brew scripts for password security. See Dave's proposal below. His team spent months adopting an industry standard protocol using Bcrypt. ...
31
votes
8answers
3k views

Why improvising your own Hash function out of existing hash functions is so bad

I'm afraid I'll have tomatoes thrown at me for asking this old question, but here goes. After reading that cooking up your own password hash out of existing hashing functions is dangerous over and ...
30
votes
1answer
4k views

Are there more modern password hashing methods than bcrypt and scrypt?

This question made me start thinking about password hashing again. I currently use bcrypt (specifically py-bcrypt). I've heard a lot about PBKDF2, and scrypt. What I'm wondering is if there are any ...
21
votes
5answers
1k views

Is it possible to increase the cost of BCrypt or PBKDF2 when its already calculated and without the original password?

I just wanted to know if you can increase the cost (iterations) of those two algorithms off-line. I want to increase the cost every year of my users passwords. One solution is to recalculate them ...
18
votes
2answers
3k views

Does bcrypt have a maximum password length?

I was messing around with bcrypt today and noticed something: hashpw('testtdsdddddddddddddddddddddddddddddddddddddddddddddddsddddddddddddddddd', salt) Output: ...
16
votes
3answers
7k views

Is bcrypt better than scrypt [duplicate]

Possible Duplicate: Do any security experts recommend bcrypt for password storage? I'm no security expert and do not pretend to be that's why I'm asking here. I write many PHP based ...
16
votes
3answers
745 views

Should you care about DoS attacks if your server is using bcrypt?

(I just asked this question on "cryptography SE" and was suggested to ask it here instead) EDIT I just realized my question is mostly a dupe of: Prevent denial of service attacks against slow hashing ...
16
votes
1answer
3k views

How to apply a pepper correctly to bcrypt?

Update: There is a better way to add a server side key, than using it as a pepper. With a pepper an attacker must gain additional privileges on the server to get the key. The same advantage we get ...
15
votes
2answers
531 views

Can client-side hashing reduce the denial-of-service risk with slow hashes?

When storing user's passwords that you need to verify against (but not use as plaintext) the current state of the art is: Hash the password Use a salt Use a slow hash function - bcrypt, scrypt, etc. ...
11
votes
4answers
3k views

Challenging challenge: client-side password hashing and server-side password verification

We have a website where users need to log in to access privileged information. Obviously we are using SSL, but I also want to avoid plaintext passwords from accidently ending up in server logs, or ...
10
votes
4answers
983 views

Does the strength of password matter in bcrypt?

Even if I choose 1 character for my password or 32 characters with numbers, letters, uppercase symbols etc. the bcrypted password will still be 60 characters length password. So does the password ...
10
votes
1answer
1k views

Insecure versions of crypt hashes

I read at crackstation not to use these variants of bcrypt* ($1$, $2$, $2a$, $2x$, $3$),but I've used bcrypt ($2a$) in various sensitive implementations recently. Can any security expert clarify why ...
10
votes
4answers
1k views

How can I make sure password hashing is secure on computers while not being prohibitively slow on mobile devices?

I'm new to cryptography and its implementations. I'm designing an Android app where an user enters a password to retrieve some encrypted data. After some research on possible solutions I ended up with ...
10
votes
2answers
5k views

Recommended # of rounds for bcrypt

What is nowadays (July 2012) the recommended number of bcrypt rounds for hashing a password for an average website (storing only name, emailaddress and home address, but no creditcard or medical ...
9
votes
6answers
2k views

Should I hash a password if it is randomly generated

The best practice is we should hash a user password using algorithms such as bcrpyt to protect the user, however, given the following conditions, is hashing in the backend still matters? the ...
9
votes
6answers
2k views

Client side password hashing

Edit: Updated to put more emphasis on the goal - peace of mind for the user, and not beefing up the security. After reading through a few discussions here about client side hashing of passwords, I'm ...
9
votes
2answers
453 views

How were weak passwords brute forced in github?

Github faced a brute force password-guessing attack recently that involved "nearly 40K unique IP addresses". Passwords were also "stored properly" using bcrypt, (salt + hashed). Given that bcrypt ...
9
votes
2answers
791 views

BCrypt's 72-character limit and using it as a general digest algorithm

Goal: have token/cookie-based authentication that doesn't require keeping sessions on the server TL;DR: What, if any, is the accepted mechanism to work around the 72-character limitation of BCrypt? ...
9
votes
1answer
1k views

“Official statement” on php.net : CRYPT_BLOWFISH is strongest hash algorithm. Why?

First: I asked this question on stackoverflow and was kindly asked to post this here again. See the original question here. According to the [early] doc pages of the new PHP 5.5 password ...
8
votes
3answers
4k views

Is a HMAC-ed password is more secure than a bcrypt-ed or scrypt-ed password?

Given an option , which one should I choose , a HMAC for storing a password securely or a bcrypt or scrypt library?
7
votes
3answers
721 views

Is it secure to use bcrypt-generated salt in cookie to serve as token in place of a password?

I have a (hobby) web site that runs only on SSL. The site does not deal with finances, social security numbers, or anything of that level of importance. However, I'd like to secure it as much as ...
7
votes
1answer
865 views

Would it make sense to use Bcrypt and PBKDF2 together?

I've read various opinions about whether Bcrypt or PDBKF2 is a better key derivation hashing method. The answer seems to depend on a lot of complicated factors that are not easy to analyze. Would ...
6
votes
1answer
3k views

Does NIST really recommend PBKDF2 for password hashing?

We hesitated between BCrypt and PBKDF2 for password hashing. In many forums and blogs people say something like "In their Special Publication SP 800-132 NIST basically recommends using PBKDF2 for ...
6
votes
3answers
610 views

How should I choose a difficulty factor for my password hashing function?

Assuming that I'm doing password hashing properly and using bcrypt, scrypt or PBKDF2, how should I go about choosing an appropriate difficulty factor? i.e rounds for bcrypt, iterations for PBKDF2 and ...
6
votes
2answers
958 views

Production ready bcrypt implementation for .NET

Which, if any, .NET / C# bcrypt implementations are considered suitable for production environments? I have seen CryptSharp and BCrypt.Net mentioned in answers to other questions but without any ...
5
votes
3answers
559 views

Trying to understand password hashing

I am trying to get a grasp of password hashing. Back in the days it seemed so simple, just MD5(password + salt) and you are done. Then md5 was proven to have collisions so people started moving to ...
5
votes
3answers
2k views

bcrypt: random salt vs computed salt

I'm pretty new to the whole password hashing business, so I might be missing something obvious. I was looking at the bcrypt algorithm, in particular BCrypt.Net, and I was wondering if it wouldn't be ...
5
votes
1answer
213 views

Is the execution time for bcrypt independent of the length of the input string?

Is the execution time for bcrypt independent of the length of the input string? i.e. Should the execution time of bcrypt.hashpw('input_string', bcrypt.gensalt(12)) and ...
5
votes
1answer
1k views

Security of bcrypt/sha256 key used with AES to encrypt a file

I'm looking to encrypt files using secure hashing and encryption algorithms in Python. Having used bcrypt in the past, I decided to use it for my passphrase calculator, then pass the output through ...
5
votes
1answer
166 views

Password strengthening for PGP

I'm wondering about some of the semantics and security implications of using something like scrypt or bcrypt to "enhance" a password protecting a PGP private key. Essentially, I'm asking about the ...
4
votes
2answers
624 views

Does bcrypt compare the hashes in “length-constant” time?

I saw this function slowEquals() while reading Salted Password Hashing - Doing it Right, which uses a byte-level xor comparison to avoid timing attacks. I was wondering whether this is what Bcrypt ...
4
votes
3answers
148 views

Is it good practice to SHA512 passwords prior to passing them to bcrypt?

I want to allow any-sized passwords to be allowed to be submitted. I currently use bcrypt as a key derivation function for passwords, however I have realized that it has a maximum input length of 72. ...
4
votes
2answers
2k views

How is storing an API secret key in plaintext (in a database) secure?

The answers to this question Is it okay for API secret to be stored in plain text or decrypt-able? are somewhat unsettling to me. I'm trying to wrap my mind around how storing a secret key in ...
4
votes
1answer
3k views

Is BCrypt enough when saving a password into a database?

In order to allow users to connect to my website, I encrypt their password using BCrypt since it is one of the slowest algorithms to decrypt (making a compromised database longer to be decrypted). ...
4
votes
1answer
259 views

How to get other people's bcrypt hashes to add to htpasswd file

I need to restrict some webpages to certain users and I do this using a .htpasswd file through nginx. The problem is I need to add other people's bcrypt password hashes to my .htpasswd file. Would it ...
3
votes
6answers
705 views

Is there a table that compares hashing algorithms by speed, relatively (machine independent)

As far as I understood*, one of the major criteria when choosing a password / salt hashing algorithm is it's speed. To prevent brute force attacks, a slower algorithm is better (and also makes it more ...
3
votes
3answers
385 views

Client-Side Hashing to decrease value of password guessing heuristics

Yes, this is 'yet another client-side hashing' question. But, don't leave yet, I think there is some value here. I'd like to do something to mitigate the affect on the community as a whole when my ...
3
votes
5answers
372 views

PCI-DSS and salt storage

PCI-DSS states the following: 3.5 Protect any keys used to secure cardholder data against disclosure and misuse I have a service which stores a salted bcrypt hash of the user's PAN. Assuming the ...
3
votes
2answers
2k views

safe to use jBCrypt and recommend it to my organization?

I'd like to recommend to my fellow developers that we all use bcrypt to hash stored passwords. We all use java and I hesitate to recommend jBCrypt only because its latest version number (0.3) ...
3
votes
1answer
283 views

Is there a better way to take advantage of current 'approved', 'proven', and memory/cpu-expensive algorithms while using salts and peppers?

I've read about the concepts presented in these two questions: Pre-hash password before applying bcrypt to avoid restricting password length Would it make sense to use Bcrypt and PBKDF2 together? I ...
3
votes
1answer
358 views

Base64 encode diffences in BCrypt implemenations

I was reading the source code of several BCrypt implementations and found that two common c implementations have a difference in their base64 encoding of for the salt. What is the effect, if any, of ...
3
votes
1answer
2k views

BCrypt+SHA256 vs PBKDF2-SHA256

From this question, the OP posited taking a user's entered password, running it through BCrypt, then running that through SHA256 to produce a 256-bit password-derived key. (EDIT: To clarify, these two ...
3
votes
2answers
146 views

Search on encrypted data of multiple users

I want to implement a search over encrypted data. I found a blogpost, which explains 3 methods. One method is to use deterministic encryption, which I'm trying to implement. But my use case is a ...
2
votes
3answers
155 views

Is it safe (or a good idea) to advertise the use of bcrypt?

So, our database is using bcrypt with a high iteration/cost to store our users passwords. We're using https like intelligent people and we continue to work on finding ways to sidestep our own security ...
2
votes
2answers
380 views

Scrypt + Bcrypt = cascade hashing

I've read here that hashing with differents algorithms would be a good idea. Can you confirm that? In your experience, is it useful and safe? Does it entail any security holes?
2
votes
1answer
45 views

Usefulness of bcrypt(UUIDv4())

One of my colleagues is working on securing OAuth 2 client IDs and secrets for our OAuth server and he has come up with this scheme where he would not only use UUID v4 to generate random values, but ...
2
votes
4answers
349 views

Login form authentication logic

I am building my login form action, and I want to make sure my logic is solid and as secure as possible. 1.) First I check if the provided e-mail address exists in database, if not, I show a generic ...
2
votes
1answer
100 views

What is the meaning of 'adaptative' and 'over time it can be made slower' in the context of the bcrypt algorithm?

I'm reading the wikipedia definition about bcrypt but I don't understand the meaning of 'adaptative' and 'over time it can be made slower'. Can someone explain what they mean in this situation?
2
votes
1answer
897 views

How to save the random salt to the database

As I understand it, salting and hashing passwords is the way to go. I also understand that to authenticate a salted and hashed password, the random salt needs to be saved. Does this mean that if I use ...