Skip to main content

Questions tagged [bcrypt]

BCrypt is an adaptive cryptographic hash function for passwords. It incorporate a salt to protect against rainbow table attacks and is also an adaptive hash - over time it can be made slower and slower so it remains resistant to specific brute-force search attacks against the hash and the salt.

Filter by
Sorted by
Tagged with
1 vote
1 answer
168 views

Timing Attack using bcrypt.js

I am using bcrypt.js for basic login. I have found that the below code runs noticeably quicker when no user is found, since it exits immediately, and no check is done on the hash. This could give an ...
Timothy Pulliam's user avatar
1 vote
0 answers
29 views

Argon2 is worse than bcrypt at runtimes < 1000 ms? [duplicate]

While Argon2 seems to be recommended for password hashing, based on this twit Argon2 is worse than bcrypt at runtimes < 1000 ms. Based on this answer: You should tweak the parameters to your own ...
ZiiMakc's user avatar
  • 111
1 vote
1 answer
248 views

Is it secure to expose a salted bcrypt hash IF it is maximum length random secure password?

Is it secure to expose a salted bcrypt hash (minimum 14 cost) if the used password is 72 characters (maximum) byte long, randomly generated letters, numbers, and special characters using secure ...
DonEr's user avatar
  • 13
15 votes
1 answer
6k views

Is it a good practice to add hard-coded salt to BCrypt passwords?

I am currently learning about cybersecurity and trying to implement it in my next web application. I have been reading some articles about hashing, specifically SHA2 and Blowfish. In this article, it ...
Josep Enric Sendra Serra's user avatar
0 votes
0 answers
2k views

Best practices for storing passwords for PHP and MySQL applications [duplicate]

I am creating a simplified lead and call management system for a friend's small business. I would like to know the best practices for hardening password storage and verification using PHP 7.4 and ...
huyang888's user avatar
0 votes
1 answer
195 views

Hash collisions in password history

When a user changes password, I'd like to implement a simple check that prevents them from reusing the same password. If the new password matches the old password, reject with an error. Sounds easy, ...
Gigi's user avatar
  • 1,320
0 votes
0 answers
247 views

Is client-side bcrypt sent over tls + server-side sha hmac secure for password storage?

I want to hash passwords for security, but strong bcrypt by nature eat up a bit of resources of the server. So I was thinking to do the encryption on the client side. This would prevent the password ...
user16551018's user avatar
0 votes
1 answer
1k views

How do I properly secure my login using bcrypt in react and a python-flask backend?

I want to store the passwords of accounts hashed into a database that can be accessed through a python-flask application. When you would login, this python application is supposed to provide you with ...
DrRonne's user avatar
1 vote
2 answers
3k views

How many rounds of Bcrypt to use for security equivalent to SHA256?

We regularly use 10000 iterations of SHA256 for hashing passwords. If we want to have similar security, how many rounds/work factor should we use when hashing passwords with bcrypt?
satya's user avatar
  • 141
0 votes
2 answers
4k views

Is it possible to reverse a hashed password? [duplicate]

Is it possible to reverse a password hashed with bcrypt?
Jason's user avatar
  • 17
0 votes
0 answers
619 views

Best secure approach with Basic Auth

Due to several customer reasons our product needs to support Basic Auth as primary authentication mechanism with client's service account. We are using Bcrypt to store customer's password in our DB, ...
Kucera.Jan.CZ's user avatar
2 votes
1 answer
650 views

How can I use a unique salt for each user

I know there are various questions that seem similar, for instance, this one. However, it does not answer my question. I'm creating a signup/login system (with node.js to be particular), and I'm ...
ublec's user avatar
  • 23
3 votes
1 answer
364 views

How can salted passwords work if you don't "keep the salts in the system"?

In this report on the recent ParkMobile breach, the article has this comment from the company: “You are correct that bcrypt hashed and salted passwords were obtained,” Perkins said when asked about ...
Joshua Frank's user avatar
5 votes
4 answers
3k views

Having a list of hashes for the same password compromise the security of the password?

An attacker want's access to a specific account, he doesn't know the password. It's a high entropy password. +128bits The attacker has the hash for the password (Assuming OWASP suggested bcrypt with ...
Justcurious's user avatar
2 votes
1 answer
4k views

Are bcrypt hashes safe enough if exposed?

Considering: A VERY motivated attacker, A large entropy password, as in 256bits¹ hashed in bcrypt (with recommended cost factor of 12), and Attacker knowledge of everything he might need (except the ...
Justcurious's user avatar
0 votes
1 answer
1k views

Is using SHA256 to create 256bit secret key from bcrypt good ok?

I am trying to Use AES to store passwords for a password manager. For authentication I am already using bcrypt. As AES uses 256 bit Key can I use SHA256 to generate 256 bit key from hashed value of ...
Nischal047's user avatar
0 votes
1 answer
4k views

How is the bcrypt algorithm decrypted? [duplicate]

I have a ton of hashed texts and their decrypted or de-hashed forms (I don't know which term is suitable in this case) via bcrypt. The thing I want to learn is how they are decrypted. For example, the ...
Hax's user avatar
  • 1
0 votes
1 answer
512 views

Search by hashed value [closed]

I would like to design a REST API endpoint (POST) that takes in some sensitive identifier information in the request body: { "someDataToSearch": "abcdefgh" } I then want to ...
theartv's user avatar
2 votes
0 answers
430 views

Is it possible to use Argon2id hashes with PAM?

I was wondering if it's possible to implement more secure KDF like bcrypt, scrypt, pbkdf2 and argon2id in PAM authentication. Ideally I would like to have their hashes instead of SHA-512 ones directly ...
Polizi8's user avatar
  • 163
45 votes
3 answers
10k views

Is bcrypt(strtolower(hex(md5(pass)))) ok for storing passwords? [duplicate]

I have a large database where passwords are stored as strtolower(hex(md5(pass))) (which is a bad way to store passwords, prone to rainbow tables, cheap to dictionary attack, no salt, etc.), and I'm ...
user1067003's user avatar
6 votes
2 answers
2k views

Is single iteration SHA-256 safe enough for hashing 128bit random number API keys?

I implemented this kind of authentication for my REST API, is this secure and is my logic sound? I am primarily curious about the SHA-256 hash & iterations = 1 aspect. I have omitted some details ...
Janne Mattila's user avatar
-1 votes
1 answer
208 views

How authenticate a login with javascript

I want to authenticate a user using a username and password in a web app running javascript interfacing to a non node js or php server. In a normal desktop app I could use bcrypt or an hmac or ??. ...
kidzopa's user avatar
28 votes
4 answers
7k views

How secure is this hash-based personal password scheme? [duplicate]

I use a password scheme where I keep a small number of easy to remember personal passwords. Instead of using the passwords directly for each service, I run them through a hashing algorithm first, as a ...
bjaastad_e's user avatar
0 votes
2 answers
322 views

Is chain hashing algorithms the ultimate solution for hashing passwords?

Let's say I my password is a simple password, 123456 Then if the database was exposed, if the password was: -- stored in plain text -> cracked -- stored it hashed with no salt -> prone to rainbow ...
Youssef Mohamed's user avatar
2 votes
2 answers
915 views

Can you help me with some misconceptions about bcrypt and salting?

I researched password hashing and cracking and I have some misconceptions: First rule of thumb to create a strong password is to use 10+ combination of digits/upper/lower/symbols to prevent brute ...
Youssef Mohamed's user avatar
2 votes
1 answer
4k views

Encryption and decryption in the browser on the client's side – is it safe?

There is a possibility to download the file with one’s PII from the dedicated web server. The file might be decrypted by filling the two factors. These two factors are delivered via email and SMS. The ...
gabankel's user avatar
4 votes
1 answer
5k views

BCrypt vs PBKDF2-SHA256

I read that LastPass uses PBKDF2-SHA256 for storing the Master Password hash, I wonder how this compares to BCrypt and why did they chose this, as SHA256 is a quick hash (probably compensated by PKDF2?...
mFeinstein's user avatar
1 vote
0 answers
674 views

Is it safe to encrypt a user's third party API key with their own password?

I'm running a node application which needs to make calls to a third party API, on behalf of my user, using their own API keys. API calls only need to be made on behalf of the user while they are ...
Michael P's user avatar
  • 311
13 votes
2 answers
2k views

Why is the BCrypt text "OrpheanBeholderScryDoubt"

I'm looking for a reference about the weird initial BCrypt text "OrpheanBeholderScryDoubt" Why was this string used? Would using 192 zeros or ones not have worked well in practice for some reason? ...
wim's user avatar
  • 673
0 votes
2 answers
247 views

How can I give out a secret to the public that only I can decipher?

I wish to add an extra layer of security to my product (web app that people download and install on their server) that have a module that allows me, the developer, to access their sites instantly with ...
Daniel M's user avatar
1 vote
1 answer
572 views

Hashing sensitive data and checking for duplicates

I have some sensitive client data that needs to be hashed, but I also need to check that that data isn’t duplicated by another client. So the hash function needs to produce the same value for the same ...
Channing Walton's user avatar
0 votes
1 answer
589 views

How to compare hashes with bcrypt when the salt is different?

There are different ways to perform a MAC, but without doubt the most used and efficient in many cases is HMAC, this serves to verify that the message has not been altered. A hash such as sha-256, sha-...
Carlos Bello's user avatar
61 votes
4 answers
12k views

Is Bcrypt a hashing algorithm or is my study material wrong?

I'm currently studying for my Comptia Security+ exam and on a practice test online I got this question: Or, represented as text: ▶ Which of the following are hashing algorithms? (Select all that ...
treefidy's user avatar
  • 503
2 votes
3 answers
3k views

What can someone do with a Google auth token?

I just received an email from "Have I been pwned" to say my credentials have been made public via a breach. The quoted text is: "The exposed data included names, email addresses, genders, spoken ...
Oliver Burdekin's user avatar
3 votes
1 answer
524 views

Has scrypt gone through enough testing to be considered secure?

Five years ago, an extremely similar question was asked: has scrypt withstood the test of time. Since this was asked five years ago and some of the responses were mixed, such as: "Scrypt has mostly ...
Name of Names's user avatar
0 votes
0 answers
114 views

Is this implementation of a bcrypt EtM flawed?

I know that you should never roll your own crypto, but I'm just implementing/combining(?) two highly trusted algorithms into Javascript First, I am using a bcrypt implementation that I did not code. ...
Name of Names's user avatar
55 votes
3 answers
20k views

Which is the best password hashing algorithm in .NET Core?

What are the considerations when picking the best password hashing algorithm in .NET Core? I read that not all hashing algorithms are compliant / unverified, so I am a hesitant on just getting ...
Water's user avatar
  • 683
2 votes
0 answers
392 views

Why does linux cryptsetup use PBKDF2 instead of bcrypt?

I've noticed that linux's cryptsetup utility by default uses the PBKDF2 for a key derivative function (KDF) versus using bcrypt, when bcrypt has more resistance to brute forcing from gpus. Why would ...
john doe's user avatar
  • 708
0 votes
1 answer
1k views

How to ensure same BCrypt hash on different platforms?

Do I get it right that BCrypt hash depends on implementation? I'm using jBCrypt on client side (android) and spring-security-core BCryptPasswordEncoder on server side (with the same strength=10) and ...
Arnie Schwarzvogel's user avatar
1 vote
2 answers
718 views

Token-based group invitation link

I've searched this site and the web for an answer to this question, but haven't found what I'm looking for, so here goes. Pointers to existing relevant answers are much welcome as well. I'm building ...
Markus's user avatar
  • 131
2 votes
2 answers
6k views

Alternative to bcrypt in .NET Core?

I'm porting an app from Node to ASP.NET Core, and discovered that the .NET Core framework doesn't have a bcrypt implementation. There are community supported bcrypt implementations but they are very ...
lonix's user avatar
  • 445
6 votes
2 answers
5k views

Explain BCrypt like I'm 5

I know this is a little bit broad, but I'd like to understand the function of this algorithm by explaining like I'm 5. And I'd like to know the difference between BCrypt and blowfish, is it because ...
Skizo-ozᴉʞS ツ's user avatar
0 votes
0 answers
1k views

bcrypt.checkpw() returning true for different salt+hash

new user here. I've tried searching for an answer but I don't think I know the correct terms to search for. I've tried things like "bcrypt same password different hash" but can't find an answer to my ...
Deon Tan's user avatar
1 vote
2 answers
298 views

Deriving 2 keys from user password - one for login - one for encryption? [duplicate]

Context We have a browser-based client-server application. The client registers with email and password. The password is enforced to some guidelines. Problem The User needs an encrypted vault on ...
Dachstein's user avatar
  • 111
3 votes
2 answers
1k views

BCrypt workfactor for salt?

From what I read here: How to securely hash passwords?, you're supposed to iterate the hashing. However in the implementation of BCrypt for .Net uses the workfactor (2^wf iterations) in the '...
FalcoGer's user avatar
  • 392
2 votes
1 answer
466 views

Shareable encrypted data in a web application

This is a follow up on my previous question about Storing sensitive, sharable data for a company where several of the employees have access to the server. This solution has worked well for our ...
Jørgen's user avatar
  • 123
1 vote
1 answer
438 views

Is it safe to reuse a user's hashed password as his token in the email confirmation link?

The user password is hashed with bycrypt. According to this answer: bcrypt is not an encryption function, it's a password hashing function, relying on Blowfish's key scheduling, not its encryption. ...
user avatar
2 votes
1 answer
199 views

Hash password with bcrypt before encrypting document with openpgp

Hi all first time posting thanks for putting together this great community. I'm working on an extension to allow users to store encrypted documents on a server I host. I'd like to avoid having them ...
Dmitri Rabinowitz's user avatar
4 votes
3 answers
3k views

How is a pepper used with salted passwords?

How is a pepper (a large constant number) used after a password has been salted with a salt by a hashing function such as bcrypt? From Sybex CISSP Official Study Guide, 8th Edition (2018): Adding ...
BJ Dela Cruz's user avatar
7 votes
1 answer
90k views

Is it possible to decrypt Bcrypt encryption? [duplicate]

I do have password that has been encrypted with Bcrypt and the salt . Is it possible if I want to decrypt the password into normal text ?
akiraro's user avatar
  • 111

1
2 3 4 5