Questions tagged [bcrypt]

BCrypt is an adaptive cryptographic hash function for passwords. It incorporate a salt to protect against rainbow table attacks and is also an adaptive hash - over time it can be made slower and slower so it remains resistant to specific brute-force search attacks against the hash and the salt.

Filter by
Sorted by
Tagged with
0
votes
0answers
70 views

Why does linux cryptsetup use PBKDF2 instead of bcrypt?

I've noticed that linux's cryptsetup utility by default uses the PBKDF2 for a key derivative function (KDF) versus using bcrypt, when bcrypt has more resistance to brute forcing from gpus. Why would ...
0
votes
1answer
100 views

How to ensure same BCrypt hash on different platforms?

Do I get it right that BCrypt hash depends on implementation? I'm using jBCrypt on client side (android) and spring-security-core BCryptPasswordEncoder on server side (with the same strength=10) and ...
2
votes
2answers
62 views

Token-based group invitation link

I've searched this site and the web for an answer to this question, but haven't found what I'm looking for, so here goes. Pointers to existing relevant answers are much welcome as well. I'm building ...
0
votes
1answer
182 views

Alternative to bcrypt in .NET Core?

I'm porting an app from Node to ASP.NET Core, and discovered that the .NET Core framework doesn't have a bcrypt implementation. There are community supported bcrypt implementations but they are very ...
3
votes
2answers
527 views

Explain BCrypt like I'm 5

I know this is a little bit broad, but I'd like to understand the function of this algorithm by explaining like I'm 5. And I'd like to know the difference between BCrypt and blowfish, is it because ...
0
votes
0answers
265 views

bcrypt.checkpw() returning true for different salt+hash

new user here. I've tried searching for an answer but I don't think I know the correct terms to search for. I've tried things like "bcrypt same password different hash" but can't find an answer to my ...
1
vote
2answers
109 views

Deriving 2 keys from user password - one for login - one for encryption? [duplicate]

Context We have a browser-based client-server application. The client registers with email and password. The password is enforced to some guidelines. Problem The User needs an encrypted vault on ...
3
votes
2answers
179 views

BCrypt workfactor for salt?

From what I read here: How to securely hash passwords?, you're supposed to iterate the hashing. However in the implementation of BCrypt for .Net uses the workfactor (2^wf iterations) in the '...
1
vote
1answer
52 views

Shareable encrypted data in a web application

This is a follow up on my previous question about Storing sensitive, sharable data for a company where several of the employees have access to the server. This solution has worked well for our ...
1
vote
1answer
98 views

Is it safe to reuse a user's hashed password as his token in the email confirmation link?

The user password is hashed with bycrypt. According to this answer: bcrypt is not an encryption function, it's a password hashing function, relying on Blowfish's key scheduling, not its encryption. ...
2
votes
1answer
69 views

Hash password with bcrypt before encrypting document with openpgp

Hi all first time posting thanks for putting together this great community. I'm working on an extension to allow users to store encrypted documents on a server I host. I'd like to avoid having them ...
3
votes
3answers
416 views

How is a pepper used with salted passwords?

How is a pepper (a large constant number) used after a password has been salted with a salt by a hashing function such as bcrypt? From Sybex CISSP Official Study Guide, 8th Edition (2018): Adding ...
-3
votes
1answer
16k views

Is it possible to decrypt Bcrypt encryption? [duplicate]

I do have password that has been encrypted with Bcrypt and the salt . Is it possible if I want to decrypt the password into normal text ?
39
votes
1answer
14k views

In 2018, what is the recommended hash to store passwords: bcrypt, scrypt, Argon2?

There are many questions about picking a hash function, including How to securely hash passwords? or Are there more modern password hashing methods than bcrypt and scrypt?, with very detailed answers, ...
2
votes
0answers
803 views

Should I hash my refresh tokens before storing them in the server's database? [duplicate]

I have a service with a client app (Mac). To log in, users enter their username and password in the client app, which sends this information to the server. The server verifies this information using ...
3
votes
1answer
179 views

Change from bcrypt hashes to sha1 or even plaintext, for performance

I developed an application that is similar in concept to an FTP server. There are several hundred user accounts, and it uses bcrypt to store hashed passwords. All user passwords are randomly-...
3
votes
2answers
224 views

Is there a cryptographic disadvantage to applying bcrypt to an already hashed password

I originally asked this on stackoverflow, but due to lack of traction and a recommendation by a user there I have asked it here too. Imagine a scenario where a client application is sending a ...
38
votes
7answers
6k views

Does replacing a bcrypt hash with an invalid hash result in no possible working password?

I have a manager who likes to "deactivate" accounts by replacing the existing bcrypt hash in the database with a simple dash (-). This seems to work as the old password is no longer valid and there ...
6
votes
1answer
4k views

bcrypt no need to store salt?

I'm confused with bcrypt, I would think I would need to store my salt, and then compare my plain text password + salt to the hashed password, however from documentation it does not look like storing ...
19
votes
2answers
5k views

How secure is BCRYPT(SHA1(Password)) [duplicate]

This question is a fork from a previous question here: Is it safe/wise to store a salt in the same field as the hashed password? Assume you run a web portal, and store passwords in SHA1 hashes. How ...
1
vote
1answer
483 views

How to best hash patient names to generate a pseudonym?

I am working on a data acquisition and preprocessing tool for a brain tumor database. The tool preprocesses the data and harmonizes it so it can be united in a one big database. Due to privacy ...
3
votes
1answer
123 views

If a password is encrypted and then the encryption is stolen is it best practise to change plaintext passwords?

Backgound Reading this article on BBC News dated 29th March 2018, the company in question suffered a data breach and up to 150 million accounts usernames, email addresses and passwords were ...
6
votes
1answer
353 views

Ruby Devise salt exposed

The remember_user_token cookie token generated by the Ruby Devise authentication component reveals part of a bcrypt salted credential when decoded. For example: remember_user_token=...
10
votes
2answers
3k views

Mathematically, how long would it take to crack a bcrypt password hash?

So I'm currently using bcrypt to hash passwords with a randomly generated salt (as seen in the pip bcrypt module), with 12 rounds. I have been looking around, but I cannot find a detailed and clear ...
-1
votes
1answer
598 views

Is it ok to use 6 as a cost of bcrypt algortihm for 64 chars string? [duplicate]

What should the ideal $cost be in this case to prevent brute force attack even by ASIC or an FPGA $cost = '06'; $secret_key = bin2hex(random_bytes(64)); $store_data = crypt($secret_key, '$2a$.$cost.$'...
2
votes
3answers
661 views

Using BCrypt to transmit sensitive data in client/server configuration

I'm developing a software in which I need to transmit sensitive data (passwords) in a server/client configuration using TCP. All data is encrypted using AES (the symmetric key is unique to each ...
0
votes
2answers
1k views

Is it security if an alternative of the full credit card number is stored in database

Short Description I am wondering if there is a way to store an alternative of the full credit card number securely, which the card number is not required to be retrieved from the alternative. Long ...
0
votes
1answer
610 views

BCrypt Tables for 6 digit numbers 000000-999999

This is an example of a bcrypt project I am working on. 2a and 04 are always used and the password is a 6 digit number from 000000 to 999999 Using 2a and 4 rounds is there a hash table or calculator ...
0
votes
0answers
116 views

MD5 Bcrypt best practice [duplicate]

I'm currently storing bcrypt encrypted passwords in my database. At the moment my html forms submit a clear text password to my server, which then compares the bcrypt result (of the clear text) for a ...
3
votes
2answers
2k views

bcrypt cost 10/12/14 brute force time?

Earlier I added bcrypt with cost 12 (15 is a bit too long for login, 12 looks about right). I'm also planning to add the https://howsecureismypassword.net/ open source version but I'd rather not ...
0
votes
1answer
196 views

Will I jeopardize security if I store the first three characters (hashed) in a separate table?

In order for a customer service representative to identify a customer, they'd like to ask the customer for the three first characters of her password. The minimum length of the password is currently ...
-2
votes
3answers
1k views

Is it useful to hash the password before sending to server for authentication? [duplicate]

In the design of a backend database, the password field suppose to be hashed using bcrypt. There are two approaches backend only: password = bcrypt(plain_passsword) frontend + backend = password = ...
0
votes
1answer
855 views

Should I use SHA-512 with many rounds or bcrypt/scrypt

I am currently using SHA-512 with 100000 rounds because of the easier implementation. The algorithm generates passwords from a service (e.g amazon) and a master password. Would I benefit from ...
0
votes
1answer
307 views

Is my BCrypt variant ($2a$) fine, up to date and secure?

As far as I know, there are a couple of BCrypt variants and I also understood that some of those variants have security flaws so I was wondering whether it is fine or not that the library which I am ...
0
votes
1answer
334 views

BCrypt hash as database table ID

In my web application I have to store hashed values (using BCrypt) as ID for a database table. The input for each hash value is a unique string. I am concerned about possible collisions. 1) What is a ...
2
votes
1answer
469 views

What does ssh-keygen's -a option really mean?

I discovered the newer OpenSSH format for storing SSH private keys (ssh-keygen -o) uses bcrypt to generate the symmetric key to encrypt the private key. I understand that the -a option is used to ...
2
votes
1answer
263 views

Double hashing passwords between Java microservices to increase security?

We have a Java Zuul gateway microservice that runs infront of all of our services. This gateway provides security check for all inbound traffic. We also have an IAM service that provides login/logout/...
0
votes
2answers
620 views

How is bcrypt able to generate secure random hashes? If someone nabs the hash from my db wouldn't they just be able to run it through bcrypt?

Sorry for being such a noob, but I'm having a hard time wrapping my head around this. I am using bcrypt to encode plain text passwords into unique hashes before I store them in my database or ...
1
vote
1answer
19k views

Is BCRYPT easy do decrypt?

I know that bcrypt doesn't encrypt, but how easy would it be to get the password from a stored bcrypt hash? I wanna split my question about bcrypt into 2: I read over here that bcrypt generates ...
1
vote
2answers
2k views

BCrypt password hashing with user email as salt?

I'm using dcodeIO/bcrypt.js to hash user password on login before sending it to the server. On the server-side I then hash this again and compare with the doubly hashed stored password. The question: ...
7
votes
2answers
632 views

Can I trust a security hash implementation after testing it with random inputs against another implementation?

Let's say I want to use a security hashing algorithm, like bcrypt, and I want to use a young bcrypt implementation, e.g. called libfancybcrypt, instead of an well established implementation. Of ...
3
votes
4answers
351 views

Nesting bcrypt + PHPass for improving the security of password storage in legacy software?

I've been tasked with improving the security of the password storage of a site which currently uses Openwall's PHPass. All the hashes will be converted at once, i. e. we don't want to wait for the ...
0
votes
2answers
116 views

Anonymity of ballots when voting with BYCRYPT hashes

Hello Security Experts! I am implementing a small web application where users can cast votes. On the one hand, I want ballots to by anonymous. So the username is not stored with the ballot. But on ...
5
votes
1answer
344 views

Dictionary attack knowing the cipher

Let's suppose I know a website is using BCrypt with salts and the default round of 10. Can I do a dictionary attack by hashing all the words using BCrypt with the same parameters?
31
votes
2answers
7k views

What maximum password length to choose when using bcrypt?

When I generated password for GitHub with KeePass I got a message on GitHub site that said the limit for password length is 72 characters. It seemed weird it not being a power of 2 so I googled a bit ...
0
votes
3answers
241 views

What would stop me from cracking a certain bcrypt hash?

Assuming I have a bcrypt sha1 hash, which I know it's salt, wouldn't it be possible to get one of those 13GB password list, hash every password with the known salt creating a custom rainbow table, and ...
0
votes
0answers
123 views

How to tune a KDF algorithm to protect a private key?

I need to protect a private key RSA-4096 with a key derived by a KDF algorithm. Instead of hiding any aspect of the algorithm I would like to tune it such that the key derivation is a proof of work ...
2
votes
3answers
289 views

When brute-forcing a private-key stored as binary how do you know you found a solution?

Given the following scenario: the user has a password and a symmetric key is derived from it by PBKDF2 or bcrypt a private RSA key is protected by the above symmetric key the encrypted private key in ...
9
votes
3answers
2k views

Hashing Password on Client Side to avoid lag on single-core game server? [duplicate]

I am currently implementing a simple login system. I would like to securely store all the user passwords in my database. The passwords are the most important components. All the other user data is not ...
1
vote
2answers
179 views

Deriving an authentication password from an encryption password

I'm building an application with the following requirements: A client logs in with email and password. On the server, bcrypt(password) is computed and compared to what is stored in the database. If ...