What is the likelihood of 2 bcrypt hashes colliding if they use the same work-factor and input?
Are bcrypt's salts large enough to prevent this from happening?
$\begingroup$
$\endgroup$
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
What is the likelihood of 2 bcrypt hashes colliding if they use the same work-factor and input?
You're describing this: $\tau_1,\tau_2=\text{bcrypt}(pw,cost), \Pr[\tau_1=\tau_2]$. This means that the collision probability comes down to the length of the salt. bcrypt uses 128-bit salts. So you expect to find a collision after doing roughly $2^{64}$ hashings (assuming you're PRNG is good).
If you really want to find a collision, $2^{64}$ is feasible. Especially if you'd use FPGAs / ASICs. The practical relevance of this is low though as you rarely see password database (with the same password) beyond $2^{35}$ and even then collision resistance isn't an all that important property of password hashing (what can you do if the tags collide?).
