Questions tagged [bcrypt]

BCrypt is an adaptive cryptographic hash function for passwords. It incorporate a salt to protect against rainbow table attacks and is also an adaptive hash - over time it can be made slower and slower so it remains resistant to specific brute-force search attacks against the hash and the salt.

Filter by
Sorted by
Tagged with
44
votes
4answers
7k views

Is Bcrypt a hashing algorithm or is my study material wrong?

I'm currently studying for my Comptia Security+ exam and on a practice test online I got this question: Or, represented as text: ▶ Which of the following are hashing algorithms? (Select all that ...
1
vote
3answers
288 views

What can someone do with a Google auth token?

I just received an email from "Have I been pwned" to say my credentials have been made public via a breach. The quoted text is: "The exposed data included names, email addresses, genders, spoken ...
2
votes
1answer
80 views

Has scrypt gone through enough testing to be considered secure?

Five years ago, an extremely similar question was asked: has scrypt withstood the test of time. Since this was asked five years ago and some of the responses were mixed, such as: "Scrypt has mostly ...
0
votes
0answers
34 views

Is this implementation of a bcrypt EtM flawed?

I know that you should never roll your own crypto, but I'm just implementing/combining(?) two highly trusted algorithms into Javascript First, I am using a bcrypt implementation that I did not code. ...
32
votes
3answers
5k views

Which is the best password hashing algorithm in .NET Core?

What are the considerations when picking the best password hashing algorithm in .NET Core? I read that not all hashing algorithms are compliant / unverified, so I am a hesitant on just getting ...
0
votes
0answers
100 views

Why does linux cryptsetup use PBKDF2 instead of bcrypt?

I've noticed that linux's cryptsetup utility by default uses the PBKDF2 for a key derivative function (KDF) versus using bcrypt, when bcrypt has more resistance to brute forcing from gpus. Why would ...
0
votes
1answer
140 views

How to ensure same BCrypt hash on different platforms?

Do I get it right that BCrypt hash depends on implementation? I'm using jBCrypt on client side (android) and spring-security-core BCryptPasswordEncoder on server side (with the same strength=10) and ...
2
votes
2answers
98 views

Token-based group invitation link

I've searched this site and the web for an answer to this question, but haven't found what I'm looking for, so here goes. Pointers to existing relevant answers are much welcome as well. I'm building ...
0
votes
1answer
531 views

Alternative to bcrypt in .NET Core?

I'm porting an app from Node to ASP.NET Core, and discovered that the .NET Core framework doesn't have a bcrypt implementation. There are community supported bcrypt implementations but they are very ...
3
votes
2answers
747 views

Explain BCrypt like I'm 5

I know this is a little bit broad, but I'd like to understand the function of this algorithm by explaining like I'm 5. And I'd like to know the difference between BCrypt and blowfish, is it because ...
0
votes
0answers
387 views

bcrypt.checkpw() returning true for different salt+hash

new user here. I've tried searching for an answer but I don't think I know the correct terms to search for. I've tried things like "bcrypt same password different hash" but can't find an answer to my ...
1
vote
2answers
121 views

Deriving 2 keys from user password - one for login - one for encryption? [duplicate]

Context We have a browser-based client-server application. The client registers with email and password. The password is enforced to some guidelines. Problem The User needs an encrypted vault on ...
3
votes
2answers
224 views

BCrypt workfactor for salt?

From what I read here: How to securely hash passwords?, you're supposed to iterate the hashing. However in the implementation of BCrypt for .Net uses the workfactor (2^wf iterations) in the '...
1
vote
1answer
60 views

Shareable encrypted data in a web application

This is a follow up on my previous question about Storing sensitive, sharable data for a company where several of the employees have access to the server. This solution has worked well for our ...
1
vote
1answer
106 views

Is it safe to reuse a user's hashed password as his token in the email confirmation link?

The user password is hashed with bycrypt. According to this answer: bcrypt is not an encryption function, it's a password hashing function, relying on Blowfish's key scheduling, not its encryption. ...
2
votes
1answer
75 views

Hash password with bcrypt before encrypting document with openpgp

Hi all first time posting thanks for putting together this great community. I'm working on an extension to allow users to store encrypted documents on a server I host. I'd like to avoid having them ...
3
votes
3answers
576 views

How is a pepper used with salted passwords?

How is a pepper (a large constant number) used after a password has been salted with a salt by a hashing function such as bcrypt? From Sybex CISSP Official Study Guide, 8th Edition (2018): Adding ...
0
votes
1answer
25k views

Is it possible to decrypt Bcrypt encryption? [duplicate]

I do have password that has been encrypted with Bcrypt and the salt . Is it possible if I want to decrypt the password into normal text ?
49
votes
1answer
18k views

In 2018, what is the recommended hash to store passwords: bcrypt, scrypt, Argon2?

There are many questions about picking a hash function, including How to securely hash passwords? or Are there more modern password hashing methods than bcrypt and scrypt?, with very detailed answers, ...
2
votes
0answers
965 views

Should I hash my refresh tokens before storing them in the server's database? [duplicate]

I have a service with a client app (Mac). To log in, users enter their username and password in the client app, which sends this information to the server. The server verifies this information using ...
3
votes
1answer
198 views

Change from bcrypt hashes to sha1 or even plaintext, for performance

I developed an application that is similar in concept to an FTP server. There are several hundred user accounts, and it uses bcrypt to store hashed passwords. All user passwords are randomly-...
3
votes
2answers
238 views

Is there a cryptographic disadvantage to applying bcrypt to an already hashed password

I originally asked this on stackoverflow, but due to lack of traction and a recommendation by a user there I have asked it here too. Imagine a scenario where a client application is sending a ...
38
votes
7answers
7k views

Does replacing a bcrypt hash with an invalid hash result in no possible working password?

I have a manager who likes to "deactivate" accounts by replacing the existing bcrypt hash in the database with a simple dash (-). This seems to work as the old password is no longer valid and there ...
10
votes
1answer
5k views

bcrypt no need to store salt?

I'm confused with bcrypt, I would think I would need to store my salt, and then compare my plain text password + salt to the hashed password, however from documentation it does not look like storing ...
19
votes
2answers
6k views

How secure is BCRYPT(SHA1(Password)) [duplicate]

This question is a fork from a previous question here: Is it safe/wise to store a salt in the same field as the hashed password? Assume you run a web portal, and store passwords in SHA1 hashes. How ...
1
vote
1answer
594 views

How to best hash patient names to generate a pseudonym?

I am working on a data acquisition and preprocessing tool for a brain tumor database. The tool preprocesses the data and harmonizes it so it can be united in a one big database. Due to privacy ...
3
votes
1answer
123 views

If a password is encrypted and then the encryption is stolen is it best practise to change plaintext passwords?

Backgound Reading this article on BBC News dated 29th March 2018, the company in question suffered a data breach and up to 150 million accounts usernames, email addresses and passwords were ...
6
votes
1answer
419 views

Ruby Devise salt exposed

The remember_user_token cookie token generated by the Ruby Devise authentication component reveals part of a bcrypt salted credential when decoded. For example: remember_user_token=...
11
votes
2answers
4k views

Mathematically, how long would it take to crack a bcrypt password hash?

So I'm currently using bcrypt to hash passwords with a randomly generated salt (as seen in the pip bcrypt module), with 12 rounds. I have been looking around, but I cannot find a detailed and clear ...
-1
votes
1answer
650 views

Is it ok to use 6 as a cost of bcrypt algortihm for 64 chars string? [duplicate]

What should the ideal $cost be in this case to prevent brute force attack even by ASIC or an FPGA $cost = '06'; $secret_key = bin2hex(random_bytes(64)); $store_data = crypt($secret_key, '$2a$.$cost.$'...
2
votes
3answers
722 views

Using BCrypt to transmit sensitive data in client/server configuration

I'm developing a software in which I need to transmit sensitive data (passwords) in a server/client configuration using TCP. All data is encrypted using AES (the symmetric key is unique to each ...
0
votes
2answers
1k views

Is it security if an alternative of the full credit card number is stored in database

Short Description I am wondering if there is a way to store an alternative of the full credit card number securely, which the card number is not required to be retrieved from the alternative. Long ...
0
votes
1answer
712 views

BCrypt Tables for 6 digit numbers 000000-999999

This is an example of a bcrypt project I am working on. 2a and 04 are always used and the password is a 6 digit number from 000000 to 999999 Using 2a and 4 rounds is there a hash table or calculator ...
0
votes
0answers
140 views

MD5 Bcrypt best practice [duplicate]

I'm currently storing bcrypt encrypted passwords in my database. At the moment my html forms submit a clear text password to my server, which then compares the bcrypt result (of the clear text) for a ...
3
votes
2answers
2k views

bcrypt cost 10/12/14 brute force time?

Earlier I added bcrypt with cost 12 (15 is a bit too long for login, 12 looks about right). I'm also planning to add the https://howsecureismypassword.net/ open source version but I'd rather not ...
0
votes
1answer
199 views

Will I jeopardize security if I store the first three characters (hashed) in a separate table?

In order for a customer service representative to identify a customer, they'd like to ask the customer for the three first characters of her password. The minimum length of the password is currently ...
-2
votes
3answers
2k views

Is it useful to hash the password before sending to server for authentication? [duplicate]

In the design of a backend database, the password field suppose to be hashed using bcrypt. There are two approaches backend only: password = bcrypt(plain_passsword) frontend + backend = password = ...
0
votes
1answer
905 views

Should I use SHA-512 with many rounds or bcrypt/scrypt

I am currently using SHA-512 with 100000 rounds because of the easier implementation. The algorithm generates passwords from a service (e.g amazon) and a master password. Would I benefit from ...
0
votes
1answer
333 views

Is my BCrypt variant ($2a$) fine, up to date and secure?

As far as I know, there are a couple of BCrypt variants and I also understood that some of those variants have security flaws so I was wondering whether it is fine or not that the library which I am ...
0
votes
1answer
355 views

BCrypt hash as database table ID

In my web application I have to store hashed values (using BCrypt) as ID for a database table. The input for each hash value is a unique string. I am concerned about possible collisions. 1) What is a ...
2
votes
1answer
522 views

What does ssh-keygen's -a option really mean?

I discovered the newer OpenSSH format for storing SSH private keys (ssh-keygen -o) uses bcrypt to generate the symmetric key to encrypt the private key. I understand that the -a option is used to ...
2
votes
1answer
275 views

Double hashing passwords between Java microservices to increase security?

We have a Java Zuul gateway microservice that runs infront of all of our services. This gateway provides security check for all inbound traffic. We also have an IAM service that provides login/logout/...
0
votes
2answers
686 views

How is bcrypt able to generate secure random hashes? If someone nabs the hash from my db wouldn't they just be able to run it through bcrypt?

Sorry for being such a noob, but I'm having a hard time wrapping my head around this. I am using bcrypt to encode plain text passwords into unique hashes before I store them in my database or ...
1
vote
1answer
21k views

Is BCRYPT easy do decrypt?

I know that bcrypt doesn't encrypt, but how easy would it be to get the password from a stored bcrypt hash? I wanna split my question about bcrypt into 2: I read over here that bcrypt generates ...
1
vote
2answers
3k views

BCrypt password hashing with user email as salt?

I'm using dcodeIO/bcrypt.js to hash user password on login before sending it to the server. On the server-side I then hash this again and compare with the doubly hashed stored password. The question: ...
6
votes
2answers
651 views

Can I trust a security hash implementation after testing it with random inputs against another implementation?

Let's say I want to use a security hashing algorithm, like bcrypt, and I want to use a young bcrypt implementation, e.g. called libfancybcrypt, instead of an well established implementation. Of ...
3
votes
4answers
376 views

Nesting bcrypt + PHPass for improving the security of password storage in legacy software?

I've been tasked with improving the security of the password storage of a site which currently uses Openwall's PHPass. All the hashes will be converted at once, i. e. we don't want to wait for the ...
0
votes
2answers
119 views

Anonymity of ballots when voting with BYCRYPT hashes

Hello Security Experts! I am implementing a small web application where users can cast votes. On the one hand, I want ballots to by anonymous. So the username is not stored with the ballot. But on ...
5
votes
1answer
361 views

Dictionary attack knowing the cipher

Let's suppose I know a website is using BCrypt with salts and the default round of 10. Can I do a dictionary attack by hashing all the words using BCrypt with the same parameters?
31
votes
2answers
7k views

What maximum password length to choose when using bcrypt?

When I generated password for GitHub with KeePass I got a message on GitHub site that said the limit for password length is 72 characters. It seemed weird it not being a power of 2 so I googled a bit ...