Why do we use EnhancedHashPassword
in nuGet library and chose a SHA algorithm like this?
BCrypt.Net.BCrypt.EnhancedHashPassword(password,hashType:HashType.SHA512)
and when do we use the SHA algorithm after blowfish or before?
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this communityWhy do we use EnhancedHashPassword in
nuGet
library and chose an SHA algorithm like this?
The Bcrypt uses a 448-bit key that makes a 56-byte password limit. Some libraries can drop parts longer than 56-byte of the passwords or don't accept it. This is not good, therefore before bcrypt
a hash is applied to the password. This is the EnhancedHashPassword
method in the library and this may increase the entropy.
The nuGet
library by default uses SHA-384 which has known resistance to length extension attacks. SHA-512 doesn't have.
when do we use the SHA algorithm after blowfish or before?
We use the hash algorithm before. The aim is using all of the password information in the blowfish. This is achieved by hashing which can hash arbitrary length input into a fixed size.
Modern password hashing algorithm Argon2 doesn't have the small password weakness. It can accept a password up to $2^{32}\hbox{-}1$ bytes. On the other hand, PBKDF2 has no theoretical limit except the standard limits of the utilized hash functions 1,2.