Hot answers tagged

18 votes
Accepted

Password hash contained '\x00' in middle, resulting in ValueError from bcrypt.hashpw

You should not be hashing it before passing to bcrypt, which is designed to do the hashing and key-stretching work itself. It's choking on the hash result because it's expecting a redundant, mushy, ...
user avatar
2 votes

Password hash contained '\x00' in middle, resulting in ValueError from bcrypt.hashpw

bcrypt is still considered a reliable password hash (when used with an appropriate cost parameter for modern hardware) but it's quite old and has a bunch of odd quirks; the 72-byte input limit is one ...
user avatar
  • 765
2 votes

Password hash contained '\x00' in middle, resulting in ValueError from bcrypt.hashpw

Is there a best practice that sanitizes the hash prior to passing it to bcrypt that I am missing, or is there another type of byte-encoding that should be used with passwords? One reasonable thing is ...
user avatar
  • 122k
1 vote
Accepted

Using bcrypt to always produce the same hash like SHA, MD

As mentioned in the comments, bcrypt is a password hash, and has significant limitations compared with a general cryptographic hash function. Using it as intended, for password input, but with the ...
user avatar
  • 12.6k
1 vote
Accepted

Use peppers with Bcrypt (HMAC + Bcrypt)

The goal of a pepper is to protect passwords in the event that a database of password hashes is compromised but other parts of the authentication system are not compromised. Password hashing functions'...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible