Questions tagged [bcrypt]

BCrypt is an adaptive cryptographic hash function for passwords. It incorporate a salt to protect against rainbow table attacks and is also an adaptive hash - over time it can be made slower and slower so it remains resistant to specific brute-force search attacks against the hash and the salt.

Filter by
Sorted by
Tagged with
0
votes
2answers
130 views

Is it possible to reverse a hashed password? [duplicate]

Is it possible to reverse a password hashed with bcrypt?
0
votes
0answers
44 views

Best secure approach with Basic Auth

Due to several customer reasons our product needs to support Basic Auth as primary authentication mechanism with client's service account. We are using Bcrypt to store customer's password in our DB, ...
2
votes
1answer
82 views

How can I use a unique salt for each user

I know there are various questions that seem similar, for instance, this one. However, it does not answer my question. I'm creating a signup/login system (with node.js to be particular), and I'm ...
3
votes
1answer
248 views

How can salted passwords work if you don't “keep the salts in the system”?

In this report on the recent ParkMobile breach, the article has this comment from the company: “You are correct that bcrypt hashed and salted passwords were obtained,” Perkins said when asked about ...
5
votes
4answers
2k views

Having a list of hashes for the same password compromise the security of the password?

An attacker want's access to a specific account, he doesn't know the password. It's a high entropy password. +128bits The attacker has the hash for the password (Assuming OWASP suggested bcrypt with ...
1
vote
1answer
292 views

Are bcrypt hashes safe enough if exposed?

Considering: A VERY motivated attacker, A large entropy password, as in 256bits¹ hashed in bcrypt (with recommended cost factor of 12), and Attacker knowledge of everything he might need (except the ...
0
votes
1answer
181 views

Is using SHA256 to create 256bit secret key from bcrypt good ok?

I am trying to Use AES to store passwords for a password manager. For authentication I am already using bcrypt. As AES uses 256 bit Key can I use SHA256 to generate 256 bit key from hashed value of ...
0
votes
1answer
159 views

How is the bcrypt algorithm decrypted? [duplicate]

I have a ton of hashed texts and their decrypted or de-hashed forms (I don't know which term is suitable in this case) via bcrypt. The thing I want to learn is how they are decrypted. For example, the ...
0
votes
1answer
35 views

Search by hashed value [closed]

I would like to design a REST API endpoint (POST) that takes in some sensitive identifier information in the request body: { "someDataToSearch": "abcdefgh" } I then want to ...
2
votes
0answers
93 views

Is it possible to use Argon2id hashes with PAM?

I was wondering if it's possible to implement more secure KDF like bcrypt, scrypt, pbkdf2 and argon2id in PAM authentication. Ideally I would like to have their hashes instead of SHA-512 ones directly ...
46
votes
3answers
7k views

Is bcrypt(strtolower(hex(md5(pass)))) ok for storing passwords? [duplicate]

I have a large database where passwords are stored as strtolower(hex(md5(pass))) (which is a bad way to store passwords, prone to rainbow tables, cheap to dictionary attack, no salt, etc.), and I'm ...
5
votes
2answers
339 views

Is single iteration SHA-256 safe enough for hashing 128bit random number API keys?

I implemented this kind of authentication for my REST API, is this secure and is my logic sound? I am primarily curious about the SHA-256 hash & iterations = 1 aspect. I have omitted some details ...
-1
votes
1answer
52 views

How authenticate a login with javascript

I want to authenticate a user using a username and password in a web app running javascript interfacing to a non node js or php server. In a normal desktop app I could use bcrypt or an hmac or ??. ...
28
votes
4answers
6k views

How secure is this hash-based personal password scheme? [duplicate]

I use a password scheme where I keep a small number of easy to remember personal passwords. Instead of using the passwords directly for each service, I run them through a hashing algorithm first, as a ...
0
votes
2answers
114 views

Is chain hashing algorithms the ultimate solution for hashing passwords?

Let's say I my password is a simple password, 123456 Then if the database was exposed, if the password was: -- stored in plain text -> cracked -- stored it hashed with no salt -> prone to rainbow ...
2
votes
2answers
350 views

Can you help me with some misconceptions about bcrypt and salting?

I researched password hashing and cracking and I have some misconceptions: First rule of thumb to create a strong password is to use 10+ combination of digits/upper/lower/symbols to prevent brute ...
2
votes
1answer
933 views

Encryption and decryption in the browser on the client's side – is it safe?

There is a possibility to download the file with one’s PII from the dedicated web server. The file might be decrypted by filling the two factors. These two factors are delivered via email and SMS. The ...
0
votes
1answer
2k views

BCrypt vs PBKDF2-SHA256

I read that LastPass uses PBKDF2-SHA256 for storing the Master Password hash, I wonder how this compares to BCrypt and why did they chose this, as SHA256 is a quick hash (probably compensated by PKDF2?...
1
vote
0answers
217 views

Is it safe to encrypt a user's third party API key with their own password?

I'm running a node application which needs to make calls to a third party API, on behalf of my user, using their own API keys. API calls only need to be made on behalf of the user while they are ...
5
votes
1answer
569 views

Why is the BCrypt text “OrpheanBeholderScryDoubt”

I'm looking for a reference about the weird initial BCrypt text "OrpheanBeholderScryDoubt" Why was this string used? Would using 192 zeros or ones not have worked well in practice for some reason? ...
0
votes
2answers
182 views

How can I give out a secret to the public that only I can decipher?

I wish to add an extra layer of security to my product (web app that people download and install on their server) that have a module that allows me, the developer, to access their sites instantly with ...
1
vote
1answer
230 views

Hashing sensitive data and checking for duplicates

I have some sensitive client data that needs to be hashed, but I also need to check that that data isn’t duplicated by another client. So the hash function needs to produce the same value for the same ...
0
votes
1answer
130 views

How to compare hashes with bcrypt when the salt is different?

There are different ways to perform a MAC, but without doubt the most used and efficient in many cases is HMAC, this serves to verify that the message has not been altered. A hash such as sha-256, sha-...
62
votes
4answers
11k views

Is Bcrypt a hashing algorithm or is my study material wrong?

I'm currently studying for my Comptia Security+ exam and on a practice test online I got this question: Or, represented as text: ▶ Which of the following are hashing algorithms? (Select all that ...
2
votes
3answers
905 views

What can someone do with a Google auth token?

I just received an email from "Have I been pwned" to say my credentials have been made public via a breach. The quoted text is: "The exposed data included names, email addresses, genders, spoken ...
2
votes
1answer
280 views

Has scrypt gone through enough testing to be considered secure?

Five years ago, an extremely similar question was asked: has scrypt withstood the test of time. Since this was asked five years ago and some of the responses were mixed, such as: "Scrypt has mostly ...
0
votes
0answers
39 views

Is this implementation of a bcrypt EtM flawed?

I know that you should never roll your own crypto, but I'm just implementing/combining(?) two highly trusted algorithms into Javascript First, I am using a bcrypt implementation that I did not code. ...
42
votes
3answers
10k views

Which is the best password hashing algorithm in .NET Core?

What are the considerations when picking the best password hashing algorithm in .NET Core? I read that not all hashing algorithms are compliant / unverified, so I am a hesitant on just getting ...
2
votes
0answers
191 views

Why does linux cryptsetup use PBKDF2 instead of bcrypt?

I've noticed that linux's cryptsetup utility by default uses the PBKDF2 for a key derivative function (KDF) versus using bcrypt, when bcrypt has more resistance to brute forcing from gpus. Why would ...
0
votes
1answer
730 views

How to ensure same BCrypt hash on different platforms?

Do I get it right that BCrypt hash depends on implementation? I'm using jBCrypt on client side (android) and spring-security-core BCryptPasswordEncoder on server side (with the same strength=10) and ...
2
votes
2answers
221 views

Token-based group invitation link

I've searched this site and the web for an answer to this question, but haven't found what I'm looking for, so here goes. Pointers to existing relevant answers are much welcome as well. I'm building ...
2
votes
2answers
4k views

Alternative to bcrypt in .NET Core?

I'm porting an app from Node to ASP.NET Core, and discovered that the .NET Core framework doesn't have a bcrypt implementation. There are community supported bcrypt implementations but they are very ...
6
votes
2answers
3k views

Explain BCrypt like I'm 5

I know this is a little bit broad, but I'd like to understand the function of this algorithm by explaining like I'm 5. And I'd like to know the difference between BCrypt and blowfish, is it because ...
0
votes
0answers
827 views

bcrypt.checkpw() returning true for different salt+hash

new user here. I've tried searching for an answer but I don't think I know the correct terms to search for. I've tried things like "bcrypt same password different hash" but can't find an answer to my ...
1
vote
2answers
147 views

Deriving 2 keys from user password - one for login - one for encryption? [duplicate]

Context We have a browser-based client-server application. The client registers with email and password. The password is enforced to some guidelines. Problem The User needs an encrypted vault on ...
3
votes
2answers
518 views

BCrypt workfactor for salt?

From what I read here: How to securely hash passwords?, you're supposed to iterate the hashing. However in the implementation of BCrypt for .Net uses the workfactor (2^wf iterations) in the '...
2
votes
1answer
248 views

Shareable encrypted data in a web application

This is a follow up on my previous question about Storing sensitive, sharable data for a company where several of the employees have access to the server. This solution has worked well for our ...
1
vote
1answer
266 views

Is it safe to reuse a user's hashed password as his token in the email confirmation link?

The user password is hashed with bycrypt. According to this answer: bcrypt is not an encryption function, it's a password hashing function, relying on Blowfish's key scheduling, not its encryption. ...
2
votes
1answer
95 views

Hash password with bcrypt before encrypting document with openpgp

Hi all first time posting thanks for putting together this great community. I'm working on an extension to allow users to store encrypted documents on a server I host. I'd like to avoid having them ...
4
votes
3answers
2k views

How is a pepper used with salted passwords?

How is a pepper (a large constant number) used after a password has been salted with a salt by a hashing function such as bcrypt? From Sybex CISSP Official Study Guide, 8th Edition (2018): Adding ...
6
votes
1answer
71k views

Is it possible to decrypt Bcrypt encryption? [duplicate]

I do have password that has been encrypted with Bcrypt and the salt . Is it possible if I want to decrypt the password into normal text ?
82
votes
1answer
42k views

In 2018, what is the recommended hash to store passwords: bcrypt, scrypt, Argon2?

There are many questions about picking a hash function, including How to securely hash passwords? or Are there more modern password hashing methods than bcrypt and scrypt?, with very detailed answers, ...
3
votes
0answers
2k views

Should I hash my refresh tokens before storing them in the server's database? [duplicate]

I have a service with a client app (Mac). To log in, users enter their username and password in the client app, which sends this information to the server. The server verifies this information using ...
3
votes
1answer
287 views

Change from bcrypt hashes to sha1 or even plaintext, for performance

I developed an application that is similar in concept to an FTP server. There are several hundred user accounts, and it uses bcrypt to store hashed passwords. All user passwords are randomly-...
3
votes
2answers
415 views

Is there a cryptographic disadvantage to applying bcrypt to an already hashed password

I originally asked this on stackoverflow, but due to lack of traction and a recommendation by a user there I have asked it here too. Imagine a scenario where a client application is sending a ...
38
votes
7answers
7k views

Does replacing a bcrypt hash with an invalid hash result in no possible working password?

I have a manager who likes to "deactivate" accounts by replacing the existing bcrypt hash in the database with a simple dash (-). This seems to work as the old password is no longer valid and there ...
20
votes
1answer
12k views

bcrypt no need to store salt?

I'm confused with bcrypt, I would think I would need to store my salt, and then compare my plain text password + salt to the hashed password, however from documentation it does not look like storing ...
20
votes
2answers
7k views

How secure is BCRYPT(SHA1(Password)) [duplicate]

This question is a fork from a previous question here: Is it safe/wise to store a salt in the same field as the hashed password? Assume you run a web portal, and store passwords in SHA1 hashes. How ...
1
vote
1answer
1k views

How to best hash patient names to generate a pseudonym?

I am working on a data acquisition and preprocessing tool for a brain tumor database. The tool preprocesses the data and harmonizes it so it can be united in a one big database. Due to privacy ...
3
votes
1answer
129 views

If a password is encrypted and then the encryption is stolen is it best practise to change plaintext passwords?

Backgound Reading this article on BBC News dated 29th March 2018, the company in question suffered a data breach and up to 150 million accounts usernames, email addresses and passwords were ...

1
2 3 4 5