45 votes
Accepted

Why do I need to store the salt for generated hashes?

The hash returned by bcrypt.hashSync is more than the hash itself, it contains all parameters needed by bcrypt. You do not need to store anything else yourself, ...
Marc's user avatar
  • 1,583
33 votes
Accepted

Looking at hash output – is Base64 encoding in any way better than HEX encoding?

The algorithms themselves just output binary (i.e. bytes) if you read their specifications. It's the implementation in API's and applications that output the hexadecimals and/or base64. Sometimes ...
Maarten Bodewes's user avatar
  • 92.6k
30 votes
Accepted

Dropbox Password security

Is this really more secure than using bcrypt with a complexity of 11 or 12 ? It depends. Obviously if you consider everything on their servers compromised this isn't more secure than using a higher ...
SEJPM's user avatar
  • 46k
29 votes

Looking at hash output – is Base64 encoding in any way better than HEX encoding?

Using Base64/HEX has nothing to do with security of a hash algorithm. Base64 and HEX are ways to represent binary data, which is the actual output of a hash algorithm. Base64 is shorter simple ...
DDoSolitary's user avatar
21 votes
Accepted

Best cryptographic algo with asymmetric cost: expensive to sign, cheap to validate

The immediately obvious solution would be to do a simple proof-of-work scheme. For example: The server selects two random bitstrings $A$ and $B$, and computes $\text{Hash}(A || B)$. The server ...
poncho's user avatar
  • 147k
18 votes
Accepted

Password hash contained '\x00' in middle, resulting in ValueError from bcrypt.hashpw

You should not be hashing it before passing to bcrypt, which is designed to do the hashing and key-stretching work itself. It's choking on the hash result because it's expecting a redundant, mushy, ...
JamesTheAwesomeDude's user avatar
14 votes

Dropbox Password security

I understand that the Global "pepper" means that a DB dump protects the hashes until that pepper is found, and then each hash is still salted per user, but how much would that slow down people ...
Luis Casillas's user avatar
13 votes
Accepted

Encrypting bcrypt hashes

Your core problem is the fact that you only have about 20 bits of entropy at most (assuming users pick fully random 6-digit PINs which most probably won't). 20 bits of entropy also means that it takes ...
SEJPM's user avatar
  • 46k
12 votes
Accepted

Benchmark differences between SHA-512 and bcrypt

SHA-512 is a cryptographic hash while bcrypt is a password hash or PBKDF (password based key derivation function). SHA-512 has been designed to be fast. You don't want any delays when validating a ...
Maarten Bodewes's user avatar
  • 92.6k
10 votes
Accepted

The internals of bcrypt

You are correct, Blowfish is a reversible cipher if you know the key. Bcrypt has three parameters it uses to hash a password: Salt Password Cost It derives a key using the salt, password and cost to ...
Lucas Kauffman's user avatar
10 votes
Accepted

Does a big salt have the same memory effects as Bcrypt?

So in general, isn't this equivalent to what Bcrypt and PBKDF2 do in terms of password storage security? PBKDF2, yes, pretty much. The only real difference is that salt/password are used the other ...
otus's user avatar
  • 32.1k
8 votes
Accepted

Why does 0x00 make bcrypt weaker?

In many cases, 0x00 is treated as end of string. That is where the problem comes into play. So if I passed ...
mikeazo's user avatar
  • 38.6k
7 votes

Why is Bcrypt called a Key Derivation Function?

BCrypt is not a key derivation function, it is a password hashing algorithm. If you needed to derive a key from a password, bcrypt has no capability to generate a 256-bit key. On the other hand, ...
Ian Boyd's user avatar
  • 1,001
6 votes

Can multiple hashing weaken the password?

Do I really weaken the password? To some degree, yes. The function is considered public, and the attacker can test random passwords with it and check the output and compare it to your key. Then he ...
tylo's user avatar
  • 12.7k
6 votes

If and why is it bad to scrypt a bcrypted password?

The combined strength of two key stretching algorithms is not greater than the sum of its parts. It is at best equal to the sum of its parts. If you budget $x$ amount of CPU time to password ...
Future Security's user avatar
5 votes

The internals of bcrypt

Lucas Kauffman is correct that the more recent algorithms were either too new to be proven, or not available at all, when bcrypt was designed. But this immediately brings up the question of whether a ...
Tom Zych's user avatar
  • 328
5 votes

What is best practise for salting and multiple-hashing of passwords?

Current best practice does include bcrypt, which is the same as PHP's built in password_hash() function. Future best practice will probably be Argon2. Other widely used secure KDF options include ...
Richie Frame's user avatar
  • 13.1k
4 votes
Accepted

Can pbkdf2 be used with a fixed salt to give a deterministic slow hash?

Yes, this is thought to be so. The point of PBKDF2, scrypt & bcrypt is to produce the same output on the same input, otherwise they would be useless as key derivation function (KDF). I personally ...
Lery's user avatar
  • 7,679
4 votes
Accepted

What impact could general quantum computing have on BCrypt?

I'm not aware of any quantum-based cryptanalysis results of symmetric ciphers that would perform better than Grover's algorithm on any symmetric cipher. Now here's the interesting part: Grover's ...
SEJPM's user avatar
  • 46k
4 votes

Why bcrypt is one-way while Blowfish is reversible?

Because bcrypt uses Blowfish as a component inside an irreversible algorithm. This is very common—many variable-input length cryptographic algorithms are built from smaller, fixed-input-length ...
Luis Casillas's user avatar
4 votes
Accepted

Why bcrypt is one-way while Blowfish is reversible?

bcrypt uses the EksBlowfishSetup which is the expansion key step function of the blowfish cipher, to expand your key into a ...
Mr. E's user avatar
  • 196
4 votes

Dropbox Password security

The existing answers cover the usefulness of the encryption step in different scenarios, but nobody mentioned the hashing step yet. Blowfish (on which bcrypt is based) mandates a maximum key length ...
Dennis's user avatar
  • 2,151
4 votes

Using bcrypt for MAC - is it correct and secure?

Although your scheme is secure - especially with a random key of 32 bytes or higher - it won't offer any benefit over HMAC. It's therefore not recommended to use such a scheme. Also note that `...
Maarten Bodewes's user avatar
  • 92.6k
4 votes
Accepted

"Work factor" and "iteration count" nomenclature in adaptive functions

There is no international committee on which function / term is correct or not. Work factor seems to be a more generic term, and I'd prefer that when talking about the relative amount of work that ...
Maarten Bodewes's user avatar
  • 92.6k
4 votes
Accepted

How long would it take to calculate the hash of a password by hand?

If you want a "quick" way of determining how long it will take for bcrypt-n10, you can process by hand a very very VERY small subset of its calculation, ...
Richie Frame's user avatar
  • 13.1k
3 votes
Accepted

Using bcrypt for MAC - is it correct and secure?

The question is how much is this schema secure? Not significantly more secure than sha256(m + k) is and may be less secure. An attacker who could arrange a ...
otus's user avatar
  • 32.1k
3 votes

Why bcrypt is one-way while Blowfish is reversible?

Why do you say that computing the key using a known plaintext attack is "computationally feasible"? It's not. As far as I know, Blowfish is not "broken" for short texts, requiring gigabytes of data to ...
Ben's user avatar
  • 128
3 votes

The internals of bcrypt

Bcrypt relies on the blowfish cipher, which is a reversible method of encryption. But bcrypt is not reversible. How is that possible? Or am I mistaken? What does bcrypt do on top of blowfish to make ...
Ella Rose's user avatar
  • 19.6k
3 votes

Why can't one implement bcrypt in Cuda?

bcrypt has now been implemented for both GPUs and for FPGAs. See Bcrypt password cracking extremely slow? Not if you are using hundreds of FPGAs!. The GPU implementation described there is just ...
nealmcb's user avatar
  • 570
3 votes
Accepted

Are there any known security issues when doing the following chaining of BCrypt Hashes: 'bcryt(bcrypt(user-pw, work-factor1), work-factor2)'

First there are a few technical hurdles to deal with. Nominally, bcrypt takes three inputs: the password itself, a work factor, and a salt. To hash or to verify a password, you need the salt. Usual ...
Thomas Pornin's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible