Questions tagged [bcrypt]

BCrypt is an adaptive cryptographic hash function for passwords. It incorporate a salt to protect against rainbow table attacks and is also an adaptive hash - over time it can be made slower and slower so it remains resistant to specific brute-force search attacks against the hash and the salt.

Filter by
Sorted by
Tagged with
0
votes
1answer
31 views

Search by hashed value [closed]

I would like to design a REST API endpoint (POST) that takes in some sensitive identifier information in the request body: { "someDataToSearch": "abcdefgh" } I then want to ...
2
votes
0answers
57 views

Is it possible to use Argon2id hashes with PAM?

I was wondering if it's possible to implement more secure KDF like bcrypt, scrypt, pbkdf2 and argon2id in PAM authentication. Ideally I would like to have their hashes instead of SHA-512 ones directly ...
44
votes
3answers
7k views

Is bcrypt(strtolower(hex(md5(pass)))) ok for storing passwords? [duplicate]

I have a large database where passwords are stored as strtolower(hex(md5(pass))) (which is a bad way to store passwords, prone to rainbow tables, cheap to dictionary attack, no salt, etc.), and I'm ...
3
votes
2answers
91 views

Is single iteration SHA-256 safe enough for hashing 128bit random number API keys?

I implemented this kind of authentication for my REST API, is this secure and is my logic sound? I am primarily curious about the SHA-256 hash & iterations = 1 aspect. I have omitted some details ...
-1
votes
1answer
50 views

How authenticate a login with javascript

I want to authenticate a user using a username and password in a web app running javascript interfacing to a non node js or php server. In a normal desktop app I could use bcrypt or an hmac or ??. ...
28
votes
4answers
6k views

How secure is this hash-based personal password scheme? [duplicate]

I use a password scheme where I keep a small number of easy to remember personal passwords. Instead of using the passwords directly for each service, I run them through a hashing algorithm first, as a ...
0
votes
2answers
83 views

Is chain hashing algorithms the ultimate solution for hashing passwords?

Let's say I my password is a simple password, 123456 Then if the database was exposed, if the password was: -- stored in plain text -> cracked -- stored it hashed with no salt -> prone to rainbow ...
2
votes
2answers
133 views

Can you help me with some misconceptions about bcrypt and salting?

I researched password hashing and cracking and I have some misconceptions: First rule of thumb to create a strong password is to use 10+ combination of digits/upper/lower/symbols to prevent brute ...
1
vote
1answer
197 views

Encryption and decryption in the browser on the client's side – is it safe?

There is a possibility to download the file with one’s PII from the dedicated web server. The file might be decrypted by filling the two factors. These two factors are delivered via email and SMS. The ...
0
votes
1answer
605 views

BCrypt vs PBKDF2-SHA256

I read that LastPass uses PBKDF2-SHA256 for storing the Master Password hash, I wonder how this compares to BCrypt and why did they chose this, as SHA256 is a quick hash (probably compensated by PKDF2?...
1
vote
0answers
98 views

Is it safe to encrypt a user's third party API key with their own password?

I'm running a node application which needs to make calls to a third party API, on behalf of my user, using their own API keys. API calls only need to be made on behalf of the user while they are ...
5
votes
1answer
270 views

Why is the BCrypt text “OrpheanBeholderScryDoubt”

I'm looking for a reference about the weird initial BCrypt text "OrpheanBeholderScryDoubt" Why was this string used? Would using 192 zeros or ones not have worked well in practice for some reason? ...
0
votes
2answers
180 views

How can I give out a secret to the public that only I can decipher?

I wish to add an extra layer of security to my product (web app that people download and install on their server) that have a module that allows me, the developer, to access their sites instantly with ...
1
vote
1answer
122 views

Hashing sensitive data and checking for duplicates

I have some sensitive client data that needs to be hashed, but I also need to check that that data isn’t duplicated by another client. So the hash function needs to produce the same value for the same ...
0
votes
1answer
69 views

How to compare hashes with bcrypt when the salt is different?

There are different ways to perform a MAC, but without doubt the most used and efficient in many cases is HMAC, this serves to verify that the message has not been altered. A hash such as sha-256, sha-...
62
votes
4answers
11k views

Is Bcrypt a hashing algorithm or is my study material wrong?

I'm currently studying for my Comptia Security+ exam and on a practice test online I got this question: Or, represented as text: ▶ Which of the following are hashing algorithms? (Select all that ...
2
votes
3answers
546 views

What can someone do with a Google auth token?

I just received an email from "Have I been pwned" to say my credentials have been made public via a breach. The quoted text is: "The exposed data included names, email addresses, genders, spoken ...
2
votes
1answer
197 views

Has scrypt gone through enough testing to be considered secure?

Five years ago, an extremely similar question was asked: has scrypt withstood the test of time. Since this was asked five years ago and some of the responses were mixed, such as: "Scrypt has mostly ...
0
votes
0answers
37 views

Is this implementation of a bcrypt EtM flawed?

I know that you should never roll your own crypto, but I'm just implementing/combining(?) two highly trusted algorithms into Javascript First, I am using a bcrypt implementation that I did not code. ...
35
votes
3answers
7k views

Which is the best password hashing algorithm in .NET Core?

What are the considerations when picking the best password hashing algorithm in .NET Core? I read that not all hashing algorithms are compliant / unverified, so I am a hesitant on just getting ...
0
votes
0answers
159 views

Why does linux cryptsetup use PBKDF2 instead of bcrypt?

I've noticed that linux's cryptsetup utility by default uses the PBKDF2 for a key derivative function (KDF) versus using bcrypt, when bcrypt has more resistance to brute forcing from gpus. Why would ...
0
votes
1answer
553 views

How to ensure same BCrypt hash on different platforms?

Do I get it right that BCrypt hash depends on implementation? I'm using jBCrypt on client side (android) and spring-security-core BCryptPasswordEncoder on server side (with the same strength=10) and ...
2
votes
2answers
166 views

Token-based group invitation link

I've searched this site and the web for an answer to this question, but haven't found what I'm looking for, so here goes. Pointers to existing relevant answers are much welcome as well. I'm building ...
1
vote
2answers
3k views

Alternative to bcrypt in .NET Core?

I'm porting an app from Node to ASP.NET Core, and discovered that the .NET Core framework doesn't have a bcrypt implementation. There are community supported bcrypt implementations but they are very ...
6
votes
2answers
2k views

Explain BCrypt like I'm 5

I know this is a little bit broad, but I'd like to understand the function of this algorithm by explaining like I'm 5. And I'd like to know the difference between BCrypt and blowfish, is it because ...
0
votes
0answers
672 views

bcrypt.checkpw() returning true for different salt+hash

new user here. I've tried searching for an answer but I don't think I know the correct terms to search for. I've tried things like "bcrypt same password different hash" but can't find an answer to my ...
1
vote
2answers
140 views

Deriving 2 keys from user password - one for login - one for encryption? [duplicate]

Context We have a browser-based client-server application. The client registers with email and password. The password is enforced to some guidelines. Problem The User needs an encrypted vault on ...
3
votes
2answers
397 views

BCrypt workfactor for salt?

From what I read here: How to securely hash passwords?, you're supposed to iterate the hashing. However in the implementation of BCrypt for .Net uses the workfactor (2^wf iterations) in the '...
2
votes
1answer
136 views

Shareable encrypted data in a web application

This is a follow up on my previous question about Storing sensitive, sharable data for a company where several of the employees have access to the server. This solution has worked well for our ...
1
vote
1answer
241 views

Is it safe to reuse a user's hashed password as his token in the email confirmation link?

The user password is hashed with bycrypt. According to this answer: bcrypt is not an encryption function, it's a password hashing function, relying on Blowfish's key scheduling, not its encryption. ...
2
votes
1answer
88 views

Hash password with bcrypt before encrypting document with openpgp

Hi all first time posting thanks for putting together this great community. I'm working on an extension to allow users to store encrypted documents on a server I host. I'd like to avoid having them ...
3
votes
3answers
1k views

How is a pepper used with salted passwords?

How is a pepper (a large constant number) used after a password has been salted with a salt by a hashing function such as bcrypt? From Sybex CISSP Official Study Guide, 8th Edition (2018): Adding ...
4
votes
1answer
57k views

Is it possible to decrypt Bcrypt encryption? [duplicate]

I do have password that has been encrypted with Bcrypt and the salt . Is it possible if I want to decrypt the password into normal text ?
69
votes
1answer
33k views

In 2018, what is the recommended hash to store passwords: bcrypt, scrypt, Argon2?

There are many questions about picking a hash function, including How to securely hash passwords? or Are there more modern password hashing methods than bcrypt and scrypt?, with very detailed answers, ...
3
votes
0answers
2k views

Should I hash my refresh tokens before storing them in the server's database? [duplicate]

I have a service with a client app (Mac). To log in, users enter their username and password in the client app, which sends this information to the server. The server verifies this information using ...
3
votes
1answer
257 views

Change from bcrypt hashes to sha1 or even plaintext, for performance

I developed an application that is similar in concept to an FTP server. There are several hundred user accounts, and it uses bcrypt to store hashed passwords. All user passwords are randomly-...
3
votes
2answers
329 views

Is there a cryptographic disadvantage to applying bcrypt to an already hashed password

I originally asked this on stackoverflow, but due to lack of traction and a recommendation by a user there I have asked it here too. Imagine a scenario where a client application is sending a ...
38
votes
7answers
7k views

Does replacing a bcrypt hash with an invalid hash result in no possible working password?

I have a manager who likes to "deactivate" accounts by replacing the existing bcrypt hash in the database with a simple dash (-). This seems to work as the old password is no longer valid and there ...
18
votes
1answer
10k views

bcrypt no need to store salt?

I'm confused with bcrypt, I would think I would need to store my salt, and then compare my plain text password + salt to the hashed password, however from documentation it does not look like storing ...
19
votes
2answers
6k views

How secure is BCRYPT(SHA1(Password)) [duplicate]

This question is a fork from a previous question here: Is it safe/wise to store a salt in the same field as the hashed password? Assume you run a web portal, and store passwords in SHA1 hashes. How ...
1
vote
1answer
866 views

How to best hash patient names to generate a pseudonym?

I am working on a data acquisition and preprocessing tool for a brain tumor database. The tool preprocesses the data and harmonizes it so it can be united in a one big database. Due to privacy ...
3
votes
1answer
126 views

If a password is encrypted and then the encryption is stolen is it best practise to change plaintext passwords?

Backgound Reading this article on BBC News dated 29th March 2018, the company in question suffered a data breach and up to 150 million accounts usernames, email addresses and passwords were ...
6
votes
1answer
635 views

Ruby Devise salt exposed

The remember_user_token cookie token generated by the Ruby Devise authentication component reveals part of a bcrypt salted credential when decoded. For example: remember_user_token=...
12
votes
2answers
8k views

Mathematically, how long would it take to crack a bcrypt password hash?

So I'm currently using bcrypt to hash passwords with a randomly generated salt (as seen in the pip bcrypt module), with 12 rounds. I have been looking around, but I cannot find a detailed and clear ...
-1
votes
1answer
820 views

Is it ok to use 6 as a cost of bcrypt algortihm for 64 chars string? [duplicate]

What should the ideal $cost be in this case to prevent brute force attack even by ASIC or an FPGA $cost = '06'; $secret_key = bin2hex(random_bytes(64)); $store_data = crypt($secret_key, '$2a$.$cost.$'...
2
votes
3answers
932 views

Using BCrypt to transmit sensitive data in client/server configuration

I'm developing a software in which I need to transmit sensitive data (passwords) in a server/client configuration using TCP. All data is encrypted using AES (the symmetric key is unique to each ...
0
votes
2answers
1k views

Is it security if an alternative of the full credit card number is stored in database

Short Description I am wondering if there is a way to store an alternative of the full credit card number securely, which the card number is not required to be retrieved from the alternative. Long ...
0
votes
1answer
1k views

BCrypt Tables for 6 digit numbers 000000-999999

This is an example of a bcrypt project I am working on. 2a and 04 are always used and the password is a 6 digit number from 000000 to 999999 Using 2a and 4 rounds is there a hash table or calculator ...
0
votes
0answers
162 views

MD5 Bcrypt best practice [duplicate]

I'm currently storing bcrypt encrypted passwords in my database. At the moment my html forms submit a clear text password to my server, which then compares the bcrypt result (of the clear text) for a ...
3
votes
2answers
3k views

bcrypt cost 10/12/14 brute force time?

Earlier I added bcrypt with cost 12 (15 is a bit too long for login, 12 looks about right). I'm also planning to add the https://howsecureismypassword.net/ open source version but I'd rather not ...

1
2 3 4 5