# Is HMAC padding the same as bcrypt?

I have been watching Christof Paar on his YouTube lectures also I used bcrypt to store two passwords with salts and I find that I have a few questions.

I am interested in what bcrypt does to the start of the final hash.

$2a$10$ I have two thoughts on this: 1. I know that Christof is speaking about HMACS in the lecture above not bcrypt, but the start of the final hash does seem alot like what he describes as 'padding', is it the same?. 2. The first part ($2a) is saying that there are two vars; a salt and a message, but I am not sure what the a is for here? The second part is the iterations or something to do with the salt length I think as there is no space between the salt and the message.

-
ok, thanks, fixing now.. –  BENZ.404 Jun 19 at 23:18
Looks much better now. (Btw.: thanks for not feeling stepped on your toes.) –  e-sushi Jun 20 at 0:17
I find it a good judge of character when one offers advice rather than shooting down - it gives the offending party chance to 're-target'. –  BENZ.404 Jun 20 at 10:36

This is not padding, nor is it related to the concept.

The output from the bcrypt library you're using is in a format inspired by Linux crypt(3) format. Dollar signs are field separators. 2a is the algorithm identifier. The full list is:

ID  | Method
─────────────────────────────────────────────────────────
1   | MD5
2a  | Blowfish (not in mainline glibc; added in some
| Linux distributions)
5   | SHA-256 (since glibc 2.7)
6   | SHA-512 (since glibc 2.7)


The second field, 10, is the strength factor; I believe this corresponds to $2^{10}$ iterations of the algorithm. The salt and hash are stored concatenated with one-another — they are both fixed widths (128 bits for the salt, 184 bits for the hash), so it is easy to extract them.

-
so this password protection method is unsafe? –  BENZ.404 Jun 20 at 10:32