B4J Library BCrypt - implementation of OpenBSD's Blowfish password hashing code

M

MathiasM

Active Member
Licensed User
No replies yet, shame.
Bro, nicely done, you're a life saver. This is a _very_ nice lib!
Here, have a Belgian beer (if you're allowed to drink)
 
ilan

ilan

Expert
Licensed User
Longtime User
just tried the library but i get always a different HASH. am i doing something wrong?

B4X: 
    Dim bc As BCrypt
    For i = 0 To 4
        Log(bc.HashPW2("test",10))
    Next

logs:

sorry, my mistake. the salt is always different that's why the hash is different
 
M

MathiasM

Active Member
Licensed User
Security risk, read this:

While this library is very good, it silently truncates the password, not throwing any error. eg:
B4X: 
Dim hash As String = crypt.HashPW("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa")
    Log(crypt.CheckPW("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", hash)) 'True
    Log(crypt.CheckPW("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", hash)) 'Also True

This is normal, as it follows the bcrypt specs. A possible solution is Base64 encoding the password before hashing.
 
You must log in or register to reply here.

Similar Threads

  • Question
B4J Question [BANano] [SOLVED] Transpiler Option to exclude certain css and js files when using B4xlib on new projects?
Replies
6
Views
2K
Mashiane
  • Article
B4J Library BCrypt - Create salted Hashes (compatible with PHP)
Replies
0
Views
4K
DonManfred