0

When hashing a string, sometimes I see the format like so:

{SHA512}1G2zjh2Bso/LzS06JDLXcELCJX4TQm7oXL5Et3Yg4Veyji7iQW26VnBdEHiURM5evO6duJjzY5387mkWV0oiyYA=

Specifically the section indicating the hash function SHA512.

Is this a standard? Is there some documentation somewhere on what the possible values between {} can be?

For example, if I wanted to use bcrypt, what would I put there?

closed as off-topic by schroeder Jan 12 '16 at 17:56

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – schroeder
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    Where do you see this? There's no context at all to this question. Hash storage is generally application specific. – RoraΖ Jan 12 '16 at 17:48
  • That's basically what I'm asking, if is this a standard. – prajo Jan 12 '16 at 17:49
  • I have never seen this format. Please indicate where you saw this so that the community could possibly help you out. – schroeder Jan 12 '16 at 17:57
  • That pretty much answers my question, it's not a standard, so it doesn't really matter where it came from. – prajo Jan 12 '16 at 17:58
  • Welcome to Stack Exchange for Security. You can take a tour by clicking here security.stackexchange.com/tour It will explain how Stack Exchange works. Thanks for your contribution and again, welcome. Cheers! – Citizen Jan 12 '16 at 19:16
1

This is not a standard, it is implementation-specific. It's used by the library which hashes the password to identify which hash function have been used.

For example, PHP use this format in its password hashing library:

$2y$10$.vGA1O9wmRjrwAVXD98HNOgsNpDczlqm3Jq7KnEd1rVAGv3Fykk1a
  • 2y means that PHP used the bcrypt algorithm.
  • 10 is the cost used to hash the string.
  • The rest of the string stores the salt (if used), and the hash itself.

Having these metadata allows PHP to automatically select the correct algorithm / cost when the script calls password_verify with the user-supplied string.

Not the answer you're looking for? Browse other questions tagged or ask your own question.