Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support 2b and 2y hashes. #18

Open
wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Conversation

dolda2000
Copy link

@dolda2000 dolda2000 commented Jan 22, 2020

This adds support for 2b and 2y hash revisions.

It is perhaps worthy to note that jBCrypt's support for 2a hashes is incorrect, as it should mimic the bug in the OpenBSD implementation that spawned the 2b hash, that is, wrapping the password length at 256. Since it's probably mostly used in "private" systems where it doesn't interact with other implementations, it's probably best to leave the 2a support as is, so as to not break current hashes, but it is nevertheless technically incorrect.

Also, jBCrypt should generate 2b hashes in gensalt, but that could cause problems where several systems that use the same password database might be at different versions. OpenBSD solved this by first adding support for 2b hashes, and then half a year later also generating them by default. Arguably, jBCrypt should do the same thing.

Finally, 2y hashes should be identical to 2b hashes, so I added support for those as well, even though they're only used in the PHP implementation of bcrypt. I noticed there were a number of forks that did nothing but add 2y-hash support, so I figured why not add it. I'd like to note that 2y is not the same as 2x, since 2x indicates a bug in a previous PHP version of bcrypt, that I don't have any personal reason to track down and recreate.

@ipkpjersi
Copy link

ipkpjersi commented Feb 2, 2020

This worked nicely for me, I made a jar of it and it worked, good job. Thanks for adding support for these newer hashes.

@v4ultboy
Copy link

v4ultboy commented Oct 5, 2022

I ended up using Password4j since my project cannot rely on solutions not delivered via maven.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants