Questions tagged [bcrypt]

BCrypt is an adaptive cryptographic hash function for passwords. It incorporate a salt to protect against rainbow table attacks and is also an adaptive hash - over time it can be made slower and slower so it remains resistant to specific brute-force search attacks against the hash and the salt.

Filter by
Sorted by
Tagged with
1 vote
1 answer
86 views

Is it secure to expose a salted bcrypt hash IF it is maximum length random secure password?

Is it secure to expose a salted bcrypt hash (minimum 14 cost) if the used password is 72 characters (maximum) byte long, randomly generated letters, numbers, and special characters using secure ...
  • 13
15 votes
1 answer
4k views

Is it a good practice to add hard-coded salt to BCrypt passwords?

I am currently learning about cybersecurity and trying to implement it in my next web application. I have been reading some articles about hashing, specifically SHA2 and Blowfish. In this article, it ...
0 votes
0 answers
510 views

Best practices for storing passwords for PHP and MySQL applications [duplicate]

I am creating a simplified lead and call management system for a friend's small business. I would like to know the best practices for hardening password storage and verification using PHP 7.4 and ...
0 votes
1 answer
117 views

Hash collisions in password history

When a user changes password, I'd like to implement a simple check that prevents them from reusing the same password. If the new password matches the old password, reject with an error. Sounds easy, ...
  • 1,300
0 votes
0 answers
146 views

Is client-side bcrypt sent over tls + server-side sha hmac secure for password storage?

I want to hash passwords for security, but strong bcrypt by nature eat up a bit of resources of the server. So I was thinking to do the encryption on the client side. This would prevent the password ...
0 votes
1 answer
545 views

How do I properly secure my login using bcrypt in react and a python-flask backend?

I want to store the passwords of accounts hashed into a database that can be accessed through a python-flask application. When you would login, this python application is supposed to provide you with ...
1 vote
2 answers
1k views

How many rounds of Bcrypt to use for security equivalent to SHA256?

We regularly use 10000 iterations of SHA256 for hashing passwords. If we want to have similar security, how many rounds/work factor should we use when hashing passwords with bcrypt?
  • 141
0 votes
2 answers
838 views

Is it possible to reverse a hashed password? [duplicate]

Is it possible to reverse a password hashed with bcrypt?
  • 17
0 votes
0 answers
277 views

Best secure approach with Basic Auth

Due to several customer reasons our product needs to support Basic Auth as primary authentication mechanism with client's service account. We are using Bcrypt to store customer's password in our DB, ...
2 votes
1 answer
332 views

How can I use a unique salt for each user

I know there are various questions that seem similar, for instance, this one. However, it does not answer my question. I'm creating a signup/login system (with node.js to be particular), and I'm ...
  • 23
3 votes
1 answer
314 views

How can salted passwords work if you don't "keep the salts in the system"?

In this report on the recent ParkMobile breach, the article has this comment from the company: “You are correct that bcrypt hashed and salted passwords were obtained,” Perkins said when asked about ...
5 votes
4 answers
3k views

Having a list of hashes for the same password compromise the security of the password?

An attacker want's access to a specific account, he doesn't know the password. It's a high entropy password. +128bits The attacker has the hash for the password (Assuming OWASP suggested bcrypt with ...
2 votes
1 answer
2k views

Are bcrypt hashes safe enough if exposed?

Considering: A VERY motivated attacker, A large entropy password, as in 256bits¹ hashed in bcrypt (with recommended cost factor of 12), and Attacker knowledge of everything he might need (except the ...
0 votes
1 answer
579 views

Is using SHA256 to create 256bit secret key from bcrypt good ok?

I am trying to Use AES to store passwords for a password manager. For authentication I am already using bcrypt. As AES uses 256 bit Key can I use SHA256 to generate 256 bit key from hashed value of ...
0 votes
1 answer
615 views

How is the bcrypt algorithm decrypted? [duplicate]

I have a ton of hashed texts and their decrypted or de-hashed forms (I don't know which term is suitable in this case) via bcrypt. The thing I want to learn is how they are decrypted. For example, the ...
  • 1
0 votes
1 answer
178 views

Search by hashed value [closed]

I would like to design a REST API endpoint (POST) that takes in some sensitive identifier information in the request body: { "someDataToSearch": "abcdefgh" } I then want to ...
2 votes
0 answers
245 views

Is it possible to use Argon2id hashes with PAM?

I was wondering if it's possible to implement more secure KDF like bcrypt, scrypt, pbkdf2 and argon2id in PAM authentication. Ideally I would like to have their hashes instead of SHA-512 ones directly ...
  • 63
45 votes
3 answers
9k views

Is bcrypt(strtolower(hex(md5(pass)))) ok for storing passwords? [duplicate]

I have a large database where passwords are stored as strtolower(hex(md5(pass))) (which is a bad way to store passwords, prone to rainbow tables, cheap to dictionary attack, no salt, etc.), and I'm ...
5 votes
2 answers
1k views

Is single iteration SHA-256 safe enough for hashing 128bit random number API keys?

I implemented this kind of authentication for my REST API, is this secure and is my logic sound? I am primarily curious about the SHA-256 hash & iterations = 1 aspect. I have omitted some details ...
-1 votes
1 answer
101 views

How authenticate a login with javascript

I want to authenticate a user using a username and password in a web app running javascript interfacing to a non node js or php server. In a normal desktop app I could use bcrypt or an hmac or ??. ...
28 votes
4 answers
7k views

How secure is this hash-based personal password scheme? [duplicate]

I use a password scheme where I keep a small number of easy to remember personal passwords. Instead of using the passwords directly for each service, I run them through a hashing algorithm first, as a ...
0 votes
2 answers
225 views

Is chain hashing algorithms the ultimate solution for hashing passwords?

Let's say I my password is a simple password, 123456 Then if the database was exposed, if the password was: -- stored in plain text -> cracked -- stored it hashed with no salt -> prone to rainbow ...
2 votes
2 answers
621 views

Can you help me with some misconceptions about bcrypt and salting?

I researched password hashing and cracking and I have some misconceptions: First rule of thumb to create a strong password is to use 10+ combination of digits/upper/lower/symbols to prevent brute ...
2 votes
1 answer
2k views

Encryption and decryption in the browser on the client's side – is it safe?

There is a possibility to download the file with one’s PII from the dedicated web server. The file might be decrypted by filling the two factors. These two factors are delivered via email and SMS. The ...
1 vote
1 answer
4k views

BCrypt vs PBKDF2-SHA256

I read that LastPass uses PBKDF2-SHA256 for storing the Master Password hash, I wonder how this compares to BCrypt and why did they chose this, as SHA256 is a quick hash (probably compensated by PKDF2?...
1 vote
0 answers
458 views

Is it safe to encrypt a user's third party API key with their own password?

I'm running a node application which needs to make calls to a third party API, on behalf of my user, using their own API keys. API calls only need to be made on behalf of the user while they are ...
  • 311
9 votes
2 answers
1k views

Why is the BCrypt text "OrpheanBeholderScryDoubt"

I'm looking for a reference about the weird initial BCrypt text "OrpheanBeholderScryDoubt" Why was this string used? Would using 192 zeros or ones not have worked well in practice for some reason? ...
  • 643
0 votes
2 answers
217 views

How can I give out a secret to the public that only I can decipher?

I wish to add an extra layer of security to my product (web app that people download and install on their server) that have a module that allows me, the developer, to access their sites instantly with ...
1 vote
1 answer
432 views

Hashing sensitive data and checking for duplicates

I have some sensitive client data that needs to be hashed, but I also need to check that that data isn’t duplicated by another client. So the hash function needs to produce the same value for the same ...
0 votes
1 answer
365 views

How to compare hashes with bcrypt when the salt is different?

There are different ways to perform a MAC, but without doubt the most used and efficient in many cases is HMAC, this serves to verify that the message has not been altered. A hash such as sha-256, sha-...
62 votes
4 answers
11k views

Is Bcrypt a hashing algorithm or is my study material wrong?

I'm currently studying for my Comptia Security+ exam and on a practice test online I got this question: Or, represented as text: ▶ Which of the following are hashing algorithms? (Select all that ...
  • 503
2 votes
3 answers
2k views

What can someone do with a Google auth token?

I just received an email from "Have I been pwned" to say my credentials have been made public via a breach. The quoted text is: "The exposed data included names, email addresses, genders, spoken ...
3 votes
1 answer
415 views

Has scrypt gone through enough testing to be considered secure?

Five years ago, an extremely similar question was asked: has scrypt withstood the test of time. Since this was asked five years ago and some of the responses were mixed, such as: "Scrypt has mostly ...
0 votes
0 answers
79 views

Is this implementation of a bcrypt EtM flawed?

I know that you should never roll your own crypto, but I'm just implementing/combining(?) two highly trusted algorithms into Javascript First, I am using a bcrypt implementation that I did not code. ...
53 votes
3 answers
16k views

Which is the best password hashing algorithm in .NET Core?

What are the considerations when picking the best password hashing algorithm in .NET Core? I read that not all hashing algorithms are compliant / unverified, so I am a hesitant on just getting ...
  • 653
2 votes
0 answers
294 views

Why does linux cryptsetup use PBKDF2 instead of bcrypt?

I've noticed that linux's cryptsetup utility by default uses the PBKDF2 for a key derivative function (KDF) versus using bcrypt, when bcrypt has more resistance to brute forcing from gpus. Why would ...
  • 668
0 votes
1 answer
884 views

How to ensure same BCrypt hash on different platforms?

Do I get it right that BCrypt hash depends on implementation? I'm using jBCrypt on client side (android) and spring-security-core BCryptPasswordEncoder on server side (with the same strength=10) and ...
1 vote
2 answers
453 views

Token-based group invitation link

I've searched this site and the web for an answer to this question, but haven't found what I'm looking for, so here goes. Pointers to existing relevant answers are much welcome as well. I'm building ...
  • 131
2 votes
2 answers
5k views

Alternative to bcrypt in .NET Core?

I'm porting an app from Node to ASP.NET Core, and discovered that the .NET Core framework doesn't have a bcrypt implementation. There are community supported bcrypt implementations but they are very ...
  • 403
6 votes
2 answers
5k views

Explain BCrypt like I'm 5

I know this is a little bit broad, but I'd like to understand the function of this algorithm by explaining like I'm 5. And I'd like to know the difference between BCrypt and blowfish, is it because ...
0 votes
0 answers
1k views

bcrypt.checkpw() returning true for different salt+hash

new user here. I've tried searching for an answer but I don't think I know the correct terms to search for. I've tried things like "bcrypt same password different hash" but can't find an answer to my ...
1 vote
2 answers
222 views

Deriving 2 keys from user password - one for login - one for encryption? [duplicate]

Context We have a browser-based client-server application. The client registers with email and password. The password is enforced to some guidelines. Problem The User needs an encrypted vault on ...
  • 111
3 votes
2 answers
816 views

BCrypt workfactor for salt?

From what I read here: How to securely hash passwords?, you're supposed to iterate the hashing. However in the implementation of BCrypt for .Net uses the workfactor (2^wf iterations) in the '...
  • 402
2 votes
1 answer
395 views

Shareable encrypted data in a web application

This is a follow up on my previous question about Storing sensitive, sharable data for a company where several of the employees have access to the server. This solution has worked well for our ...
  • 123
1 vote
1 answer
364 views

Is it safe to reuse a user's hashed password as his token in the email confirmation link?

The user password is hashed with bycrypt. According to this answer: bcrypt is not an encryption function, it's a password hashing function, relying on Blowfish's key scheduling, not its encryption. ...
user avatar
2 votes
1 answer
156 views

Hash password with bcrypt before encrypting document with openpgp

Hi all first time posting thanks for putting together this great community. I'm working on an extension to allow users to store encrypted documents on a server I host. I'd like to avoid having them ...
4 votes
3 answers
2k views

How is a pepper used with salted passwords?

How is a pepper (a large constant number) used after a password has been salted with a salt by a hashing function such as bcrypt? From Sybex CISSP Official Study Guide, 8th Edition (2018): Adding ...
7 votes
1 answer
82k views

Is it possible to decrypt Bcrypt encryption? [duplicate]

I do have password that has been encrypted with Bcrypt and the salt . Is it possible if I want to decrypt the password into normal text ?
  • 111
105 votes
1 answer
52k views

In 2018, what is the recommended hash to store passwords: bcrypt, scrypt, Argon2?

There are many questions about picking a hash function, including How to securely hash passwords? or Are there more modern password hashing methods than bcrypt and scrypt?, with very detailed answers, ...
  • 3,555
4 votes
0 answers
2k views

Should I hash my refresh tokens before storing them in the server's database? [duplicate]

I have a service with a client app (Mac). To log in, users enter their username and password in the client app, which sends this information to the server. The server verifies this information using ...
  • 151

1
2 3 4 5