Bcrypt: Difference between revisions
Bcypt has been in PHP long before 5.5. PHP 5.5 only introduced new api for using it for password hashing. |
Two Bananas (talk | contribs) Updated links from CPAN to MetaCPAN |
||
Line 75: | Line 75: | ||
*[http://www.jayfuerstenberg.com/blog/bcrypt-in-objective-c JFBCrypt - bcrypt implementation for Objective C] |
*[http://www.jayfuerstenberg.com/blog/bcrypt-in-objective-c JFBCrypt - bcrypt implementation for Objective C] |
||
*[http://bcrypt-ruby.rubyforge.org/ bcrypt-ruby - bcrypt implementation for Ruby] |
*[http://bcrypt-ruby.rubyforge.org/ bcrypt-ruby - bcrypt implementation for Ruby] |
||
*[ |
*[https://metacpan.org/module/Crypt::Eksblowfish::Bcrypt Crypt::Eksblowfish::Bcrypt - bcrypt implementation for Perl] |
||
*[https://github.com/ncb000gt/node.bcrypt.js/ bcrypt.js - a bcrypt implementation for node.js] |
*[https://github.com/ncb000gt/node.bcrypt.js/ bcrypt.js - a bcrypt implementation for node.js] |
||
*[http://code.google.com/p/javascript-bcrypt/ jsBCrypt - a bcrypt implementation for JavaScript] |
*[http://code.google.com/p/javascript-bcrypt/ jsBCrypt - a bcrypt implementation for JavaScript] |
Revision as of 21:34, 16 September 2013
![]() | This article's use of external links may not follow Wikipedia's policies or guidelines. (August 2013) |
This article needs additional citations for verification. (August 2013) |
bcrypt is a key derivation function for passwords designed by Niels Provos and David Mazières, based on the Blowfish cipher, and presented at USENIX in 1999.[1] Besides incorporating a salt to protect against rainbow table attacks, bcrypt is an adaptive function: over time, the iteration count can be increased to make it slower, so it remains resistant to brute-force search attacks even with increasing computation power.
Blowfish is notable among block ciphers for its expensive key setup phase. It starts off with subkeys in a standard state, then uses this state to perform a block encryption using part of the key, and uses the result of that encryption (really, a hashing) to replace some of the subkeys. Then it uses this modified state to encrypt another part of the key, and uses the result to replace more of the subkeys. It proceeds in this fashion, using a progressively modified state to hash the key and replace bits of state, until all subkeys have been set.
Provos and Mazières took advantage of this, and took it further. They developed a new key setup algorithm for Blowfish, dubbing the resulting cipher "Eksblowfish" ("expensive key schedule Blowfish"). The key setup begins with a modified form of the standard Blowfish key setup, in which both the salt and password are used to set all subkeys. Then there are a number of rounds in which the standard Blowfish keying algorithm is applied, using alternately the salt and the password as the key, each round starting with the subkey state from the previous round. Cryptotheoretically, this is no stronger than the standard Blowfish key schedule, but the number of rekeying rounds is configurable; this process can therefore be made arbitrarily slow, which helps deter brute-force attacks upon the hash or salt.
The iteration count is a power of two, which is an input to the algorithm. The number is encoded in the textual result.
There are implementations of bcrypt for Ruby, Python, C, C#, Perl, PHP, Java and other languages.
Algorithm
The bcrypt algorithm depends heavily on its "Eksblowfish" key setup algorithm, which runs as follows:
EksBlowfishSetup(cost, salt, key) state InitState() state ExpandKey(state, salt, key) repeat (2cost) state ExpandKey(state, 0, key) state ExpandKey(state, 0, salt) return state
InitState works as in the original Blowfish algorithm, populating the P-array and S-box entries with the fractional part of in hexadecimal.
The ExpandKey function does the following:
ExpandKey(state, salt, key) for(n = 1..18) Pn key[32(n-1)..32n-1] Pn //treat the key as cyclic ctext Encrypt(salt[0..63]) P1 ctext[0..31] P2 ctext[32..63] for(n = 2..9) ctext Encrypt(ctext salt[64(n-1)..64n-1]) //encrypt using the current key schedule and treat the salt as cyclic P2n-1) ctext[0..31] P2n ctext[32..63] for(i = 1..4) for(n = 0..127) ctext Encrypt(ctext salt[64(n-1)..64n-1]) //as above Si[2n] ctext[0..31] Si[2n+1] ctext[32..63] return state
Hence, ExpandKey(state, 0, key)
is the same as regular Blowfish key schedule since all XORs with the all-zero salt value are ineffectual. ExpandKey(state, 0, salt)
is similar, but uses the salt as a 128-bit key.
The full bcrypt algorithm utilizes these functions to compute a hash from a given input derived from the password, as follows:
bcrypt(cost, salt, input) state EksBlowfishSetup(cost, salt, input) ctext "OrpheanBeholderScryDoubt" //three 64-bit blocks repeat (64) ctext EncryptECB(state, ctext) //encrypt using standard Blowfish in ECB mode return Concatenate(cost, salt, ctext)
Mapping of password to input is unspecified in the original revision of bcrypt. Implementations have varied, including sometime reducing the strength of passwords containing special characters. See e.g. Feb 1, 2010 jBCrypt security advisory or Changes in CRYPT_BLOWFISH in PHP 5.3.7.
See also
- crypt - password storage and verification scheme - Blowfish
- scrypt
- Key stretching
- PBKDF2 (Password-Based Key Derivation Function 2)
References
- ^ Provos, Niels (1999). "A Future-Adaptable Password Scheme". Proceedings of 1999 USENIX Annual Technical Conference: 81–92.
{{cite journal}}
: Unknown parameter|coauthors=
ignored (|author=
suggested) (help)
External links
- Openwall C implementation
- jBCrypt - bcrypt implementation for Java
- Spring Security (3.1.x) implements bcrypt in Java based on code from jBCrypt
- bcrypt.go - bcrypt implementation for Go
- py-bcrypt - bcrypt implementation for Python
- BCrypt.Net- bcrypt implementation in C# for .NET
- CryptSharp - bcrypt and other crypt algorithms for .NET
- JFBCrypt - bcrypt implementation for Objective C
- bcrypt-ruby - bcrypt implementation for Ruby
- Crypt::Eksblowfish::Bcrypt - bcrypt implementation for Perl
- bcrypt.js - a bcrypt implementation for node.js
- jsBCrypt - a bcrypt implementation for JavaScript
- bcrypt file encryption program homepage - bcrypt is also the name of a cross-platform file encryption utility implementing the Blowfish cipher, developed in 2002.
- The Portable PHP password hashing framework contains an implementation of bcrypt for PHP
- dBCrypt - a bcrypt implementation for Dart based on code from jBCrypt