{"id":144,"date":"2018-02-15T09:40:00","date_gmt":"2018-02-15T09:40:00","guid":{"rendered":"http:\/\/paradysz.pl\/?p=144"},"modified":"2019-05-16T20:32:48","modified_gmt":"2019-05-16T20:32:48","slug":"bcrypt-really-safety-hash-function","status":"publish","type":"post","link":"https:\/\/paradysz.pl\/index.php\/2018\/02\/15\/bcrypt-really-safety-hash-function\/","title":{"rendered":"BCrypt – really safety hash function"},"content":{"rendered":"

Are you slowly starting to get really annoyed because of weak resistance to brute-force\u00a0or rainbow\u00a0attacks your hashing methods? If so, you should find out more about BCrypt.<\/p>\n

As we know, passwords keeping in\u00a0IT systems can be divided into two groups: hashed and encrypted. The difference\u00a0is obvious, first is\u00a0irreversible,\u00a0second is reversible.\u00a0Anyway, in this post, I want to stay focused on hashed passwords.<\/p>\n

Why won’t just hashing work?<\/strong><\/p>\n

Because it is vulnerable to a brute-force attack or rainbow tables. On the Internet, there are a lot of prepared rainbow tables or tools to crashed hashes, which may be a\u00a0desire for potentials crackers who want to obtain our passwords…<\/p>\n

What if we used salted hashes?<\/strong><\/p>\n

It is not enough as well. Why? Because we still can use brute force attack and in conjunction with super high-end consumer graphics cards what gives us a chance to ‘crack’ passwords. This is an experiment made by Troy Hunt which proves these words: https:\/\/www.troyhunt.com\/our-password-hashing-has-no-clothes\/<\/a><\/p>\n

So, what is the solution? Stretching!<\/strong><\/p>\n

Stretching techniques are used to make a possibly weak key, typically a password or passphrase, more secure against a brute-force attack by increasing the time it takes to test each possible key.<\/p>\n

This method usually consists of repeatedly hashing the function. It is simple to implement and gives very good results. BCrypt, Scrypt, Argon2,\u00a0PBKDF2 are widely used key stretching algorithms and the first one<\/p>\n

BCrypt<\/strong><\/p>\n

BCrypt is a cryptographic hash function, which was created specifically designed to static passwords, not to binary data. The BCrypt hash scheme contains: <salt> <pwhash>,\u00a0whereas, the salt consists of the following elements:<\/p>\n

$ <version> – version of the BCrypt algorithm
$ <rounds> – a number from 4 to 99 specifying work factor of the algorithm
$ <saltaddon> – 22 random chars added to salt. This string is verified by the regular expression [.\/A-Za-z0-9].<\/p>\n

The salt and hash are stored in the database as one string. BCrypt returns a\u00a0hash encoded by an internal version of Base64 binary-to-text encoding scheme. The algorithm may seem more complicated than MD5 or SHA, but using it is very simple.<\/p>\n

Example of the generation of the BCrypt hash in Python using the py-bcrypt library:<\/code><\/p>\n

<\/code><\/pre>\n\n
\nimport bcrypt\n\n# Generate hash with own salt settings\nbcrypt.hashpw("password","$2a$12$1234567890123456789012")\n# Generate hash with work factor 12\nbcrypt.hashpw("password", bcrypt.gensalt(12))\n<\/pre><\/div>\n\n\n
What work factor is? It could explain as a level of the computational complexity. It means that each increase work factor causing increases the computation time twice. <\/p>\n\n\n\n
To sum up, I hope, no one will want to implement BCrypt algorithm on its own, it just better use one of the existing implementations. Lastly,  you need to still aware that human is the most dangerous IT security risk. Even when you have the best security and the best professionals, your drunk assistant, if he meets a sexy girl in the night club, can reveal sensitive data what could do a lot of damage later.<\/p>\n","protected":false},"excerpt":{"rendered":"
Are you slowly starting to get really annoyed because of weak resistance to brute-force\u00a0or rainbow\u00a0attacks your hashing methods? If so, you should find out more about BCrypt. As we know, passwords keeping in\u00a0IT systems can be divided into two groups: hashed and encrypted. The difference\u00a0is obvious, first is\u00a0irreversible,\u00a0second is reversible.\u00a0Anyway, in this post, I want […]<\/p>\n","protected":false},"author":1,"featured_media":362,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[5,10],"tags":[],"_links":{"self":[{"href":"https:\/\/paradysz.pl\/index.php\/wp-json\/wp\/v2\/posts\/144"}],"collection":[{"href":"https:\/\/paradysz.pl\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/paradysz.pl\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/paradysz.pl\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/paradysz.pl\/index.php\/wp-json\/wp\/v2\/comments?post=144"}],"version-history":[{"count":24,"href":"https:\/\/paradysz.pl\/index.php\/wp-json\/wp\/v2\/posts\/144\/revisions"}],"predecessor-version":[{"id":375,"href":"https:\/\/paradysz.pl\/index.php\/wp-json\/wp\/v2\/posts\/144\/revisions\/375"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/paradysz.pl\/index.php\/wp-json\/wp\/v2\/media\/362"}],"wp:attachment":[{"href":"https:\/\/paradysz.pl\/index.php\/wp-json\/wp\/v2\/media?parent=144"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/paradysz.pl\/index.php\/wp-json\/wp\/v2\/categories?post=144"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/paradysz.pl\/index.php\/wp-json\/wp\/v2\/tags?post=144"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}