Skip to content

Support 2b and 2y hashes. - #18

Open
dolda2000 wants to merge 4 commits into
jeremyh:masterfrom
dolda2000:master
Open

Support 2b and 2y hashes.#18
dolda2000 wants to merge 4 commits into
jeremyh:masterfrom
dolda2000:master

Conversation

@dolda2000

@dolda2000 dolda2000 commented Jan 22, 2020

Copy link
Copy Markdown

This adds support for 2b and 2y hash revisions.

It is perhaps worthy to note that jBCrypt's support for 2a hashes is incorrect, as it should mimic the bug in the OpenBSD implementation that spawned the 2b hash, that is, wrapping the password length at 256. Since it's probably mostly used in "private" systems where it doesn't interact with other implementations, it's probably best to leave the 2a support as is, so as to not break current hashes, but it is nevertheless technically incorrect.

Also, jBCrypt should generate 2b hashes in gensalt, but that could cause problems where several systems that use the same password database might be at different versions. OpenBSD solved this by first adding support for 2b hashes, and then half a year later also generating them by default. Arguably, jBCrypt should do the same thing.

Finally, 2y hashes should be identical to 2b hashes, so I added support for those as well, even though they're only used in the PHP implementation of bcrypt. I noticed there were a number of forks that did nothing but add 2y-hash support, so I figured why not add it. I'd like to note that 2y is not the same as 2x, since 2x indicates a bug in a previous PHP version of bcrypt, that I don't have any personal reason to track down and recreate.

@ipkpjersi

ipkpjersi commented Feb 2, 2020

Copy link
Copy Markdown

This worked nicely for me, I made a jar of it and it worked, good job. Thanks for adding support for these newer hashes.

@v4ultboy

v4ultboy commented Oct 5, 2022

Copy link
Copy Markdown

I ended up using Password4j since my project cannot rely on solutions not delivered via maven.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants