Questions tagged [bcrypt]

bcrypt is an intentionally slow hash algorithm specially designed for passwords.

Filter by
Sorted by
Tagged with
2
votes
3answers
1k views

Questions about BCrypt and PBKDF2

I would ask you some questions about users' password storage in a login system. What algorithm do you suggest me to use? bcrypt or PBKDF2? I was looking for a way to implement them client-side and i ...
1
vote
2answers
218 views

Can multiple hashing weaken the password?

Problem. I want a longer key out of password than my hashing function provide. Idea. I want to hash password multiple times rotating chars one position each time and use composite key. Question. ...
1
vote
1answer
5k views

Advantages/Disadvantages of Bcrypt vs. hash/salt

I have an application that I use sha3-512 to hash my password with a randomly generated 64 characters salt for each password. Is it bad to use this method to store passwords? I know many people ...
1
vote
2answers
556 views

scrypt and bcrypt for benefits of both?

I've been reading about bcrypt and scrypt, and it seems that the general consensus is that bcrypt is more "tried and true", but scrypt is better in theory. Couldn't you just hash something with ...
1
vote
2answers
808 views

How terribly flawed is this design for key storage?

Dave here, with a plan for storing secrets. Threat model: Database and keyfile may (will?) be stored on un-trusted servers. Database contains many valuable secrets (passwords), encrypted by key ...
1
vote
2answers
128 views

Why authors of bcrypt have chosen blowfish and not some hash function like SHA-1?

I wonder what are the advantages of using bcrypt over an iterated and salted KDF based on some cryptographic hash function like SHA-1 (or SHA-3)? I guess the authors of bcrypt chose Blowfish (a block ...
1
vote
3answers
1k views

How can I accomplish Key Derivation in JavaScript? [closed]

I need to take a potentially weak user password and derive a strong key for AES encryption in JavaScript. How can I do this? I expect the hardest problem is generating a good random salt - perhaps an ...
1
vote
1answer
103 views

Which is more secure for hashing: SHA512 or BCrypt with the same salt reused over and over?

Setting aside questions of if BCrypt should even be used in this way, I was just wondering which one would be more secure hypothetically. If you want to know why I don't just use random salts as per ...
1
vote
1answer
159 views

Practical BCrypt plus XOR encryption for small messages

This is a practical solution available and potentially useful to everyone, so please give some leeway not banning this question. Details are at the end, but here is the question: How secure is the ...
1
vote
1answer
193 views

Relation between encryption algorithms and (password) hash functions

This is a really basic question. Blowfish is not seen as a secure cipher. but bcrypt is one of the most secure hash functions. So first: How can a hash function be based on an encryption algorithm, ...
1
vote
1answer
110 views

Encrypt hash using hash of hash?

I wonder what is wrong with this scheme for authentication. Server sends random challenge, C Client returns (C, B(P)) encrypted in H(B(P)) where B(P) is high work factor salted hash of the user ...
1
vote
1answer
514 views

Blowfish Encryptions in Bcrypt hashing algorithm

I am trying to understand the ExpandKey function used in the bcrypt hashing algorithm. As per the documentation of bcrypt hashing algorithm on USENIX here: http://static.usenix.org/event/usenix99/...
1
vote
1answer
451 views

Question about hashing passwords with PBKDF2

I am new here and new to encrypting and securing passwords, so please forgive me if this question is not posted to the right location or if my question is bad. I have been working on a web app in ...
1
vote
1answer
411 views

What's wrong with my security model - or how can it be attacked?

I'm working on a little personal project where security is very important, and I've thought for a while about the best way to do this. Now I am looking for a little outside help on good practices. The ...
1
vote
1answer
543 views

Can iterated key expansion in Blowfish slow down bruteforce attacks on small key sizes?

Suppose I have to use 64-bit keys for encryption (e.g. to comply with export restrictions). For this question, assume this key is truly random, and the encryption algorithm is Blowfish. Blowfish key ...
1
vote
0answers
27 views

reusing blowfish algorithm to implement bcrypt

I'm trying to implement bcrypt and have a really fast Blowfish implementation available to me. It seems to me that the existant Blowfish implementation is not going to be able to be leveraged to ...
1
vote
0answers
105 views

Looking for alternative key stretching

I am by no means a security expert, but I am curious whether functions that don't produce different outputs when raised to the power of N (without any psuedo-randomness) exist, that are as strong as "...
0
votes
1answer
645 views

What is best practise for salting and multiple-hashing of passwords?

I have been presented with some custom PHP code for salting passwords and applying multiple rounds of hashing. It looks reasonable, but I fear home-grown crypto. Is there an existing password ...
0
votes
1answer
235 views

Why does PHP crypt give this unexpected result [closed]

So I have this PHP code,it is meant to encrypt a users password... Three problems/questions: My 'salt' CHANGES ITS NAME I get the same result Is this actually how the result is meant to be? PHP CODE ...
0
votes
1answer
130 views

Are there any known values for common hashes known to have no preimage

In a system which requires a user to have a password, as a quick workaround I wrote random junk as the bcrypt hash so that no one will be able to login to that user. However theoretically there ...
0
votes
1answer
209 views

Trying to finalize my understanding about password storing

am sorry, an a beginner, so please forgive me if i make mistakes, so here is what I understood: PBKDF2: uses HMAC, so, the message is the password, and the key that crypts the message is the salt? or ...
0
votes
1answer
90 views

Storing passwords in a publicly available database

I have a public database where users need to store configuration files. The file can contain passwords. Everyone can read config files but only the server can read passwords in them. In the browser, ...
0
votes
1answer
112 views

Using hashed password as shared secrets. Good or bad idea?

I built a system that allowed users to generate an unlimited number of email addresses. Instead of storing each one in a db, I created addresses dynamically and made the address an hmac signed ...
0
votes
0answers
33 views

Identifying the exact encryption procedure by database hash

I was asked to develop an external user administration for a legacy system so that it could be integrated into company processes. This system is mostly written in Python, but also uses unmanaged DLLs. ...
0
votes
1answer
176 views

Hashing user password without database to store salt

I am building an Android app that will run purely locally on the user's device, no servers. It has a database that I want to encrypt with the user's password, which requires a 64 byte key. I've ...
0
votes
1answer
260 views

Set/change password functionality on password: should I apply bcrypt server- or client-side?

I am writing a webpage on which a user can set (when registering) and change his/her password. This page is only served over HTTPS. When the user is altering his/her password, he/she is already ...