BCrypt is an adaptive cryptographic hash function for passwords. It incorporate a salt to protect against rainbow table attacks and is also an adaptive hash - over time it can be made slower and slower so it remains resistant to specific brute-force search attacks against the hash and the salt.

learn more… | top users | synonyms

280
votes
4answers
83k views

Do any security experts recommend bcrypt for password storage?

On the surface bcrypt, an 11 year old security algorithm designed for hashing passwords by Niels Provos and David Mazieres, which is based on the initialization function used in the NIST approved ...
266
votes
10answers
31k views

Is my developer's home-brew password security right or wrong, and why?

A developer, let's call him 'Dave', insists on using home-brew scripts for password security. See Dave's proposal below. His team spent months adopting an industry standard protocol using Bcrypt. ...
30
votes
1answer
4k views

Are there more modern password hashing methods than bcrypt and scrypt?

This question made me start thinking about password hashing again. I currently use bcrypt (specifically py-bcrypt). I've heard a lot about PBKDF2, and scrypt. What I'm wondering is if there are any ...
17
votes
1answer
3k views

How to apply a pepper correctly to bcrypt?

Update: There is a better way to add a server side key, than using it as a pepper. With a pepper an attacker must gain additional privileges on the server to get the key. The same advantage we get ...
12
votes
6answers
3k views

Client side password hashing

Edit: Updated to put more emphasis on the goal - peace of mind for the user, and not beefing up the security. After reading through a few discussions here about client side hashing of passwords, I'm ...
7
votes
1answer
887 views

Would it make sense to use Bcrypt and PBKDF2 together?

I've read various opinions about whether Bcrypt or PDBKF2 is a better key derivation hashing method. The answer seems to depend on a lot of complicated factors that are not easy to analyze. Would ...
21
votes
5answers
2k views

Is it possible to increase the cost of BCrypt or PBKDF2 when its already calculated and without the original password?

I just wanted to know if you can increase the cost (iterations) of those two algorithms off-line. I want to increase the cost every year of my users passwords. One solution is to recalculate them ...
5
votes
2answers
889 views

Does bcrypt compare the hashes in “length-constant” time?

I saw this function slowEquals() while reading Salted Password Hashing - Doing it Right, which uses a byte-level xor comparison to avoid timing attacks. I was wondering whether this is what Bcrypt ...
5
votes
1answer
2k views

Security of bcrypt/sha256 key used with AES to encrypt a file

I'm looking to encrypt files using secure hashing and encryption algorithms in Python. Having used bcrypt in the past, I decided to use it for my passphrase calculator, then pass the output through ...
11
votes
4answers
3k views

Challenging challenge: client-side password hashing and server-side password verification

We have a website where users need to log in to access privileged information. Obviously we are using SSL, but I also want to avoid plaintext passwords from accidently ending up in server logs, or ...
15
votes
2answers
581 views

Can client-side hashing reduce the denial-of-service risk with slow hashes?

When storing user's passwords that you need to verify against (but not use as plaintext) the current state of the art is: Hash the password Use a salt Use a slow hash function - bcrypt, scrypt, etc. ...
12
votes
2answers
6k views

Recommended # of rounds for bcrypt

What is nowadays (July 2012) the recommended number of bcrypt rounds for hashing a password for an average website (storing only name, emailaddress and home address, but no creditcard or medical ...
6
votes
1answer
3k views

Does NIST really recommend PBKDF2 for password hashing?

We hesitated between BCrypt and PBKDF2 for password hashing. In many forums and blogs people say something like "In their Special Publication SP 800-132 NIST basically recommends using PBKDF2 for ...
32
votes
8answers
3k views

Why improvising your own Hash function out of existing hash functions is so bad

I'm afraid I'll have tomatoes thrown at me for asking this old question, but here goes. After reading that cooking up your own password hash out of existing hashing functions is dangerous over and ...
16
votes
3answers
794 views

Should you care about DoS attacks if your server is using bcrypt?

(I just asked this question on "cryptography SE" and was suggested to ask it here instead) EDIT I just realized my question is mostly a dupe of: Prevent denial of service attacks against slow hashing ...
0
votes
3answers
160 views

Safety of Password Hashing Using bcrypt Done on Client Side

I am currently using a technique where I send the username/password in cleartext (using https) to the server, which then does bcrypt and compares to the db. Standard practice. It is considered safe. ...
7
votes
3answers
684 views

How should I choose a difficulty factor for my password hashing function?

Assuming that I'm doing password hashing properly and using bcrypt, scrypt or PBKDF2, how should I go about choosing an appropriate difficulty factor? i.e rounds for bcrypt, iterations for PBKDF2 and ...
2
votes
3answers
200 views

Is it safe (or a good idea) to advertise the use of bcrypt?

So, our database is using bcrypt with a high iteration/cost to store our users passwords. We're using https like intelligent people and we continue to work on finding ways to sidestep our own security ...