While bcrypt
is often regarded as an irreversible hashing function, it's based on the reversible Blowfish cipher. I'm just curious about how does this work. Here's the pseudocode from the wiki:
bcrypt(cost, salt, input)
state ← EksBlowfishSetup(cost, salt, input)
ctext ← "OrpheanBeholderScryDoubt" //three 64-bit blocks
repeat (64)
ctext ← EncryptECB(state, ctext) //encrypt using standard Blowfish in ECB mode
return Concatenate(cost, salt, ctext)
I know that first bcrypt will go through EksBlowfishSetup
key shcedule function which outputs a the state as a encryption key. Then it encrypts the text "OrpheanBeholderScryDoubt"
with the key.
According to an answer in https://security.stackexchange.com/questions/66050/should-bcrypt-be-used-for-client-side-password-hashing/66056#66069, bcrypt is irreversible because BCrypt can be seen as encrypting with throwing away of the key. Although a known-plaintext attack is almost impossible with Blowfish, but is this what makes bcypt irreversible? Because I think a known-plaintext attack is still "computationally feasible".
What I want to know is that, if we get the encryption key (produced by EksBlowfishSetup(cost, salt, input)
) with known-plaintext attack or in some other ways and we have the cost and salt which is passed to EksBlowfishSetup, is it possible to get the real password?
According to an answer here, EksBlowfishSetup
is what makes brcypt
one-way as you need to know all 3 arguments passed to it in order to retrieve the plaintext password. So can I say that it is EksBlowfishSetup
that actually makes bcrypt irreversible?
Something might help you: Technology and Practice of Passwords