Why do we use EnhancedHashPassword in nuGet library and chose a SHA algorithm like this?
BCrypt.Net.BCrypt.EnhancedHashPassword(password,hashType:HashType.SHA512)
and when do we use the SHA algorithm after blowfish or before?
$\begingroup$
$\endgroup$
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
3
Why do we use EnhancedHashPassword in
nuGetlibrary and chose an SHA algorithm like this?
The Bcrypt uses a 448-bit key that makes a 56-byte password limit. Some libraries can drop parts longer than 56-byte of the passwords or don't accept it. This is not good, therefore before bcrypt a hash is applied to the password. This is the EnhancedHashPassword method in the library and this may increase the entropy.
The nuGet library by default uses SHA-384 which has known resistance to length extension attacks. SHA-512 doesn't have.
when do we use the SHA algorithm after blowfish or before?
We use the hash algorithm before. The aim is using all of the password information in the blowfish. This is achieved by hashing which can hash arbitrary length input into a fixed size.
Modern password hashing algorithm Argon2 doesn't have the small password weakness. It can accept a password up to $2^{32}\hbox{-}1$ bytes. On the other hand, PBKDF2 has no theoretical limit except the standard limits of the utilized hash functions 1,2.
answered Nov 3, 2019 at 14:15
-
$\begingroup$ Thanks for attention, In nuGet library we can chose hash type from(SHA1,SHA384,SHA512). For verify I compare output of bcrypt algorithm with SHA512 hash of password? $\endgroup$– JulietNov 4, 2019 at 6:13
-
-
$\begingroup$ I found for verify bcrypt with EnhancedHashPassword, We compare SHA512(pass) with bcrypt? $\endgroup$– JulietNov 4, 2019 at 10:55