# enhanced hash password in bcrypt for nuGet library

Why do we use EnhancedHashPassword in nuGet library and chose a SHA algorithm like this?

BCrypt.Net.BCrypt.EnhancedHashPassword(password,hashType:HashType.SHA512)

and when do we use the SHA algorithm after blowfish or before?

## 1 Answer

Why do we use EnhancedHashPassword in nuGet library and chose an SHA algorithm like this?

The Bcrypt uses a 448-bit key that makes a 56-byte password limit. Some libraries can drop parts longer than 56-byte of the passwords or don't accept it. This is not good, therefore before bcrypt a hash is applied to the password. This is the EnhancedHashPassword method in the library and this may increase the entropy.

The nuGet library by default uses SHA-384 which has known resistance to length extension attacks. SHA-512 doesn't have.

when do we use the SHA algorithm after blowfish or before?

We use the hash algorithm before. The aim is using all of the password information in the blowfish. This is achieved by hashing which can hash arbitrary length input into a fixed size.

Modern password hashing algorithm Argon2 doesn't have the small password weakness. It can accept a password up to $$2^{32}\hbox{-}1$$ bytes. On the other hand, PBKDF2 has no theoretical limit except the standard limits of the utilized hash functions 1,2.

• Thanks for attention, In nuGet library we can chose hash type from(SHA1,SHA384,SHA512). For verify I compare output of bcrypt algorithm with SHA512 hash of password? – Juliet Nov 4 '19 at 6:13
• The hash function must be same for both. – kelalaka Nov 4 '19 at 7:22
• I found for verify bcrypt with EnhancedHashPassword, We compare SHA512(pass) with bcrypt? – Juliet Nov 4 '19 at 10:55