Comment by tptacek | Hacker News Reader

Comment by tptacek | Hacker News Reader

Parent Full thread

   >> BCrypt::Password.create("hi,mom", :cost => 10)
   => "$2a$10$L/c.1uoZSh3oaU1fLrnYK.yyU4PiJXsIAzN22qnbU41liyLn5/of  2"
   >> BCrypt::Password.create("hi,mom", :cost => 10)
   => "$2a$10$3F0BVk5t8/aoS.3ddaB3l.fxg5qvafQ9NybxcpXLzMeAt.nVWn.NO"
   >> BCrypt::Password.create("hi,mom", :cost => 10)
   => "$2a$10$VEVmGHy4F4XQMJ3eOZJAUeb.MedU0W10pTPCuf53eHdKJPiSE8sMK"

Despite the pages and pages and pages and pages of conversation about how to select and format "salts", adding random nonces to hashes is not one of the world's great CS problems.

I don't understand it still. The cost factor and the string remains the same but different hashes are produced. So if a user inputs "hi,mom" and the app generates a hash, how is it going to be the same as the one in DB ?

Or did you make a mistake and the cost factors are supposed to different ?

Just do what the library tells you to do to check passwords and trust me that bcrypt hashes already have nonces built into them.

I had the same question; I don't know the answer yet, but I found a location for the answer http://www.openbsd.org/papers/bcrypt-paper.ps

The documentation for py-bcrypt ( http://www.mindrot.org/projects/py-bcrypt/) doesn't explain what happens, but shows use is very very easy.

EDIT: current guess is that searching for the salt that was used might be part of what makes it hard.

Reply on news.ycombinator.com