0
$\begingroup$

I have the hashed password and its salt. It is encrypted using SCRYPT by firebase.

How can I extract the plain text password from these two?
Or alternatively, how can I re-encrypt or convert them to hash/salt that is readable by passport-local-mongoose plugin? here is an example of what I have at my disposal:

  "hash": "jHyvk2qCPRncEAq5H05JeO4873MIMeyakVMmUXDjRfcdvflDvOXoEn7AhTW0T4f2zb24JYyPrIwTW96C4/iZ+A==",
  "salt": "zVzcUzIS+wCC+w=="
$\endgroup$

closed as off-topic by e-sushi May 8 '17 at 15:54

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Programming questions are off-topic even if you are writing or debugging cryptographic code. Unless your question is specifically about how the cryptographic algorithm or protocol works, you should look into asking on Stack Overflow instead." – e-sushi
If this question can be reworded to fit the rules in the help center, please edit the question.

1
$\begingroup$

The whole point of a PBKDF like scrypt is that you can't. So that if somebody hacks the server and retrieves the hash and the salt they cannot reconstruct your password which you might have used on other sites.

$\endgroup$
  • $\begingroup$ nor be used by another auth plugin like the passport.js local mongoose plugin? Since I am changing my auth module, and not using firebase anymore, so I would like to keep the same accounts and passwords, so that the users can use their old password to sign in. How can this be possible? $\endgroup$ – cplus May 8 '17 at 15:36
  • 1
    $\begingroup$ It's certainly possible for your new system to authenticate against those credentials as long as the relevant scrypt parameters are the same between the new systems. Whether this is possible for a particular piece of software is a question for another site. $\endgroup$ – bmm6o May 9 '17 at 0:12
  • $\begingroup$ You can try to bruteforce it, but generally you have two options: have the new authentication system understand the old format or implement a function to log the new format for every accepted login on the old system (at login time your user tells you the password) $\endgroup$ – eckes May 11 '17 at 2:35

Not the answer you're looking for? Browse other questions tagged or ask your own question.