Questions tagged [bcrypt]
BCrypt is an adaptive cryptographic hash function for passwords. It incorporate a salt to protect against rainbow table attacks and is also an adaptive hash - over time it can be made slower and slower so it remains resistant to specific brute-force search attacks against the hash and the salt.
219
questions
1
vote
0
answers
27
views
Argon2 is worse than bcrypt at runtimes < 1000 ms? [duplicate]
While Argon2 seems to be recommended for password hashing, based on this twit Argon2 is worse than bcrypt at runtimes < 1000 ms.
Based on this answer:
You should tweak the parameters to your own ...
- 111
1
vote
1
answer
139
views
Is it secure to expose a salted bcrypt hash IF it is maximum length random secure password?
Is it secure to expose a salted bcrypt hash (minimum 14 cost) if the used password is 72 characters (maximum) byte long, randomly generated letters, numbers, and special characters using secure ...
- 13
15
votes
1
answer
5k
views
Is it a good practice to add hard-coded salt to BCrypt passwords?
I am currently learning about cybersecurity and trying to implement it in my next web application.
I have been reading some articles about hashing, specifically SHA2 and Blowfish.
In this article, it ...
0
votes
0
answers
815
views
Best practices for storing passwords for PHP and MySQL applications [duplicate]
I am creating a simplified lead and call management system for a friend's small business.
I would like to know the best practices for hardening password storage and verification using PHP 7.4 and ...
0
votes
1
answer
128
views
Hash collisions in password history
When a user changes password, I'd like to implement a simple check that prevents them from reusing the same password. If the new password matches the old password, reject with an error.
Sounds easy, ...
- 1,310
0
votes
0
answers
165
views
Is client-side bcrypt sent over tls + server-side sha hmac secure for password storage?
I want to hash passwords for security, but strong bcrypt by nature eat up a bit of resources of the server. So I was thinking to do the encryption on the client side. This would prevent the password ...
0
votes
1
answer
686
views
How do I properly secure my login using bcrypt in react and a python-flask backend?
I want to store the passwords of accounts hashed into a database that can be accessed through a python-flask application. When you would login, this python application is supposed to provide you with ...
- 3
1
vote
2
answers
1k
views
How many rounds of Bcrypt to use for security equivalent to SHA256?
We regularly use 10000 iterations of SHA256 for hashing passwords.
If we want to have similar security, how many rounds/work factor should we use when hashing passwords with bcrypt?
- 141
0
votes
2
answers
1k
views
Is it possible to reverse a hashed password? [duplicate]
Is it possible to reverse a password hashed with bcrypt?
- 17
0
votes
0
answers
358
views
Best secure approach with Basic Auth
Due to several customer reasons our product needs to support Basic Auth as primary authentication mechanism with client's service account.
We are using Bcrypt to store customer's password in our DB, ...
- 101
2
votes
1
answer
393
views
How can I use a unique salt for each user
I know there are various questions that seem similar, for instance, this one. However, it does not answer my question.
I'm creating a signup/login system (with node.js to be particular), and I'm ...
- 23
3
votes
1
answer
317
views
How can salted passwords work if you don't "keep the salts in the system"?
In this report on the recent ParkMobile breach, the article has this comment from the company:
“You are correct that bcrypt hashed and salted passwords were obtained,” Perkins said when asked about ...
- 207
5
votes
4
answers
3k
views
Having a list of hashes for the same password compromise the security of the password?
An attacker want's access to a specific account, he doesn't know the password.
It's a high entropy password. +128bits
The attacker has the hash for the password (Assuming OWASP suggested bcrypt with ...
- 175
2
votes
1
answer
3k
views
Are bcrypt hashes safe enough if exposed?
Considering:
A VERY motivated attacker,
A large entropy password, as in 256bits¹ hashed in bcrypt (with recommended cost factor of 12), and
Attacker knowledge of everything he might need (except the ...
- 175
0
votes
1
answer
681
views
Is using SHA256 to create 256bit secret key from bcrypt good ok?
I am trying to Use AES to store passwords for a password manager. For authentication I am already using bcrypt. As AES uses 256 bit Key can I use SHA256 to generate 256 bit key from hashed value of ...
0
votes
1
answer
988
views
How is the bcrypt algorithm decrypted? [duplicate]
I have a ton of hashed texts and their decrypted or de-hashed forms (I don't know which term is suitable in this case) via bcrypt. The thing I want to learn is how they are decrypted.
For example, the ...
- 1
0
votes
1
answer
218
views
Search by hashed value [closed]
I would like to design a REST API endpoint (POST) that takes in some sensitive identifier information in the request body:
{
"someDataToSearch": "abcdefgh"
}
I then want to ...
- 1
2
votes
0
answers
278
views
Is it possible to use Argon2id hashes with PAM?
I was wondering if it's possible to implement more secure KDF like bcrypt, scrypt, pbkdf2 and argon2id in PAM authentication.
Ideally I would like to have their hashes instead of SHA-512 ones directly ...
- 63
45
votes
3
answers
9k
views
Is bcrypt(strtolower(hex(md5(pass)))) ok for storing passwords? [duplicate]
I have a large database where passwords are stored as strtolower(hex(md5(pass))) (which is a bad way to store passwords, prone to rainbow tables, cheap to dictionary attack, no salt, etc.),
and I'm ...
- 564
5
votes
2
answers
1k
views
Is single iteration SHA-256 safe enough for hashing 128bit random number API keys?
I implemented this kind of authentication for my REST API, is this secure and is my logic sound?
I am primarily curious about the SHA-256 hash & iterations = 1 aspect. I have omitted some details ...
- 185
-1
votes
1
answer
105
views
How authenticate a login with javascript
I want to authenticate a user using a username and password in a web app running javascript interfacing to a non node js or php server. In a normal desktop app I could use bcrypt or an hmac or ??. ...
- 1
28
votes
4
answers
7k
views
How secure is this hash-based personal password scheme? [duplicate]
I use a password scheme where I keep a small number of easy to remember personal passwords. Instead of using the passwords directly for each service, I run them through a hashing algorithm first, as a ...
- 407
0
votes
2
answers
244
views
Is chain hashing algorithms the ultimate solution for hashing passwords?
Let's say I my password is a simple password, 123456
Then if the database was exposed, if the password was:
-- stored in plain text -> cracked
-- stored it hashed with no salt -> prone to rainbow ...
2
votes
2
answers
692
views
Can you help me with some misconceptions about bcrypt and salting?
I researched password hashing and cracking and I have some misconceptions:
First rule of thumb to create a strong password is to use 10+ combination of digits/upper/lower/symbols to prevent brute ...
2
votes
1
answer
3k
views
Encryption and decryption in the browser on the client's side – is it safe?
There is a possibility to download the file with one’s PII from the dedicated web server. The file might be decrypted by filling the two factors. These two factors are delivered via email and SMS. The ...
- 23
1
vote
1
answer
4k
views
BCrypt vs PBKDF2-SHA256
I read that LastPass uses PBKDF2-SHA256 for storing the Master Password hash, I wonder how this compares to BCrypt and why did they chose this, as SHA256 is a quick hash (probably compensated by PKDF2?...
- 271
1
vote
0
answers
515
views
Is it safe to encrypt a user's third party API key with their own password?
I'm running a node application which needs to make calls to a third party API, on behalf of my user, using their own API keys.
API calls only need to be made on behalf of the user while they are ...
- 311
11
votes
2
answers
2k
views
Why is the BCrypt text "OrpheanBeholderScryDoubt"
I'm looking for a reference about the weird initial BCrypt text "OrpheanBeholderScryDoubt"
Why was this string used?
Would using 192 zeros or ones not have worked well in practice for some reason?
...
- 663
0
votes
2
answers
217
views
How can I give out a secret to the public that only I can decipher?
I wish to add an extra layer of security to my product (web app that people download and install on their server) that have a module that allows me, the developer, to access their sites instantly with ...
- 11
1
vote
1
answer
468
views
Hashing sensitive data and checking for duplicates
I have some sensitive client data that needs to be hashed, but I also need to check that that data isn’t duplicated by another client.
So the hash function needs to produce the same value for the same ...
- 111
0
votes
1
answer
399
views
How to compare hashes with bcrypt when the salt is different?
There are different ways to perform a MAC, but without doubt the most used and efficient in many cases is HMAC, this serves to verify that the message has not been altered. A hash such as sha-256, sha-...
- 575
62
votes
4
answers
11k
views
Is Bcrypt a hashing algorithm or is my study material wrong?
I'm currently studying for my Comptia Security+ exam and on a practice test online I got this question:
Or, represented as text:
▶ Which of the following are hashing algorithms? (Select all that ...
- 503
2
votes
3
answers
2k
views
What can someone do with a Google auth token?
I just received an email from "Have I been pwned" to say my credentials have been made public via a breach. The quoted text is:
"The exposed data included names, email addresses, genders, spoken
...
- 123
3
votes
1
answer
433
views
Has scrypt gone through enough testing to be considered secure?
Five years ago, an extremely similar question was asked: has scrypt withstood the test of time. Since this was asked five years ago and some of the responses were mixed, such as:
"Scrypt has mostly ...
0
votes
0
answers
81
views
Is this implementation of a bcrypt EtM flawed?
I know that you should never roll your own crypto, but I'm just implementing/combining(?) two highly trusted algorithms into Javascript
First, I am using a bcrypt implementation that I did not code.
...
53
votes
3
answers
17k
views
Which is the best password hashing algorithm in .NET Core?
What are the considerations when picking the best password hashing algorithm in .NET Core?
I read that not all hashing algorithms are compliant / unverified, so I am a hesitant on just getting ...
- 663
2
votes
0
answers
313
views
Why does linux cryptsetup use PBKDF2 instead of bcrypt?
I've noticed that linux's cryptsetup utility by default uses the PBKDF2 for a key derivative function (KDF) versus using bcrypt, when bcrypt has more resistance to brute forcing from gpus. Why would ...
- 688
0
votes
1
answer
950
views
How to ensure same BCrypt hash on different platforms?
Do I get it right that BCrypt hash depends on implementation? I'm using jBCrypt on client side (android) and spring-security-core BCryptPasswordEncoder on server side (with the same strength=10) and ...
1
vote
2
answers
515
views
Token-based group invitation link
I've searched this site and the web for an answer to this question, but haven't found what I'm looking for, so here goes. Pointers to existing relevant answers are much welcome as well.
I'm building ...
- 131
2
votes
2
answers
5k
views
Alternative to bcrypt in .NET Core?
I'm porting an app from Node to ASP.NET Core, and discovered that the .NET Core framework doesn't have a bcrypt implementation. There are community supported bcrypt implementations but they are very ...
- 415
6
votes
2
answers
5k
views
Explain BCrypt like I'm 5
I know this is a little bit broad, but I'd like to understand the function of this algorithm by explaining like I'm 5. And I'd like to know the difference between BCrypt and blowfish, is it because ...
- 163
0
votes
0
answers
1k
views
bcrypt.checkpw() returning true for different salt+hash
new user here. I've tried searching for an answer but I don't think I know the correct terms to search for. I've tried things like "bcrypt same password different hash" but can't find an answer to my ...
- 1
1
vote
2
answers
231
views
Deriving 2 keys from user password - one for login - one for encryption? [duplicate]
Context
We have a browser-based client-server application. The client registers with email and password. The password is enforced to some guidelines.
Problem
The User needs an encrypted vault on ...
- 111
3
votes
2
answers
902
views
BCrypt workfactor for salt?
From what I read here: How to securely hash passwords?, you're supposed to iterate the hashing. However in the implementation of BCrypt for .Net uses the workfactor (2^wf iterations) in the '...
- 400
2
votes
1
answer
406
views
Shareable encrypted data in a web application
This is a follow up on my previous question about Storing sensitive, sharable data for a company where several of the employees have access to the server.
This solution has worked well for our ...
- 123
1
vote
1
answer
387
views
Is it safe to reuse a user's hashed password as his token in the email confirmation link?
The user password is hashed with bycrypt. According to this answer:
bcrypt is not an encryption function, it's a password hashing function, relying on Blowfish's key scheduling, not its encryption. ...
user97744
2
votes
1
answer
161
views
Hash password with bcrypt before encrypting document with openpgp
Hi all first time posting thanks for putting together this great community.
I'm working on an extension to allow users to store encrypted documents on a server I host. I'd like to avoid having them ...
4
votes
3
answers
2k
views
How is a pepper used with salted passwords?
How is a pepper (a large constant number) used after a password has been salted with a salt by a hashing function such as bcrypt?
From Sybex CISSP Official Study Guide, 8th Edition (2018):
Adding ...
- 143
7
votes
1
answer
85k
views
Is it possible to decrypt Bcrypt encryption? [duplicate]
I do have password that has been encrypted with Bcrypt and the salt . Is it possible if I want to decrypt the password into normal text ?
- 111
107
votes
1
answer
53k
views
In 2018, what is the recommended hash to store passwords: bcrypt, scrypt, Argon2?
There are many questions about picking a hash function, including How to securely hash passwords? or Are there more modern password hashing methods than bcrypt and scrypt?, with very detailed answers, ...
- 3,575