0

What's the command line to generate a blowfish password hash? I can't seem to figure this out at all. Apache's htpasswd only supports bcrypt, and openssl passwd doesn't even do blowfish hahes (but it does do blowfish encryptions with openssl enc).

Most sites point me to using $2a$ which is bcrypt, not blowfish ($2y$). Also a lot of places seem to confuse blowfish password hashing with blowfish file encryption. There are a lot of online sites which will generate blowfish hash for you, but I don't want to use an untrusted third party.

What other secure linux tools can I use to generate a blowfish password hash? I want to be able to define the two digit cost parameter as well as the salt.

Improve this question
1
  • You want bcrypt (sometimes called CRYPT_BLOWFISH) which is a password hash not blowfish which is a block cipher. – CodesInChaos Jul 12 '13 at 14:40
3

bcrypt is based on blowfish. The difference between $2a$ and $2y$ is something else:

There are multiple implementations of bcrypt. And one of them, called crypt_blowfish, had a security related bug, drastically reducing the actual password space. Fixing this bug, however, caused existing bcrypt hashes to not match the passwords anymore. So this implementation started to use $2y$ to identify the fixed implementation, while still being able to maintain compatibility.

$2a$ of the original unix implementation and $2y$ of crypt_blowfish are identical.

Improve this answer
1
  • 1
    What about the basic intention of this thread? How to generate ... in Ubuntu? (though any other Linux flavour might be fine as well) As a best match on search engines this thread is pretty unsolved regarding to that point of the issue. – Thomas Urban Apr 17 '17 at 7:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.