Skip to content
EntityQ286896· pop 15· linked from 139 articles

bcrypt is a password-hashing function designed by Niels Provos and David Mazières. It is based on the Blowfish cipher and presented at USENIX in 1999. Besides incorporating a salt to protect against rainbow table attacks, bcrypt is an adaptive function: over time, the iteration count can be increased to make it slower, so it remains resistant to brute-force search attacks even with increasing computation power.

Key facts

Cryptographic hash function.name
bcrypt
Cryptographic hash function.designers
Niels Provos, David Mazières
Cryptographic hash function.publish date
1999
Cryptographic hash function.derived from
Blowfish (cipher)
Cryptographic hash function.digest size
184 bits
Cryptographic hash function.rounds
variable via cost parameter

via Wikipedia infobox

Described at

bcrypt.dvi

usenix.org

playanimportantroleinthevastmajorityofuser- authenticationsystems. Thispaperdiscusseswaysofbuildingsystemsin whichpasswordsecuritykeepsupwithhardware speeds.Wepresenttwoalgorithmswithadaptable cost eksblow sh,ablockcipherwithapurposefully expensivekeyschedule,andbcrypt,arelatedhash function.Failingamajorbreakthroughincomplex- itytheory,thesealgorithmsshouldallowpassword- basedsystemstoadapttohardwareimprovements andremainsecure20yearsintothefuture. Therestofthepaperisorganizedasfollows.In Section2,wediscussrelatedworkonpasswordsecu- rity.InSection3,weexplaintherequirementsfora goodpasswordscheme.Section4presentseksblow- sh,a64-bitblockcipherthatletsuserstunethe costofthekeyschedule.Section5introducesthe variable-costbcryptpasswordhashingfunctionand describesourimplementationintheOpenBSDop- eratingsystem.Finally,Section6comparesbcrypt totwowidely-usedpasswordhashingfunctions. 2RelatedWork Passwordguessingattackscanbecategorizedby theamountofinteractiontheyrequirewithanau- thenticationsystem.Inon-lineattacks,theperpe- tratormustmakeuseofanauthenticationsystem tocheckeachguessofapassword.Ino -lineat- tacks,anattackerobtainsinformation suchasa passwordhash thatallowshimtocheckpassword guessesonhisown,withnofurtheraccesstothe system.On-lineattacksaregenerallyconsiderably slowerthano -lineones.Systemscandetecton- lineattacksfairlyeasilyanddefendagainstthemby slowingtherateofpasswordchecking.Incontrast, onceanattackerhasobtainedpasswordveri cation information,theonlyprotectionasystemhasfrom o -lineattacksisthecomputationalcostofchecking potentialpasswords. Techniquesformitigatingthethreatofo -linepass- wordguessinggenerallyaspiretooneoftwogoals limitingasystem& 39;ssusceptibilitytoo -lineattacks orincreasingtheircomputationalcost.Asasimple exampleoftheformer,manymodernUNIXsystems nowkeeppasswordhashessecretfromusers,stor- ingtheminaread-protectedshadowpassword le ratherthaninthestandardopenlyreadableone. Muchoftheworkonpreventingo -linepassword attackshascenteredaroundcommunicationover insecurenetworks.Ifcryptographicprotocolsrely onuser-chosenpasswordsaskeys,theymayopen themselvesuptoo -lineguessingattacks.Gong et.al.[7]suggestseveralprotocoldesigntricksto thwartpasswordguessingbynetworkattackers.Un- fortunately,theirmostinterestingproposalsrequire encryptionalgorithmswithunusualanddicultto achieveproperties. Severalpeoplehavedesignedsecurepasswordpro- tocolsthatletusersauthenticatethemselvesover insecurenetworkswithouttheneedtorememberor certifypublickeys.BellovinandMerritt[2,3] rst proposedtheidea,givingseveralconcreteproto- colsputativelyresistanttoo -lineguessingattacks. Patel[11]latercryptanalyzedthoseprotocols,but peoplehavesincecontinueddevelopingandre ning othersinthesamevein.Morerecentproposalssuch asSRP[16]showpromiseofbeingsecure. Ofcourse,evenasecurepasswordprotocolrequires someservercapableofvalidatinguserswithcorrect passwords.Anattackerwhoobtainsthatserver& 39;s secretstatecanmountano -lineguessingattack. Becausesecurepasswordprotocolsrequirepublic keycryptography[8],theydohaveatunablekey lengthparameter.However,thisparameterpri- marilycontrolsthedicultyofmountingo -line attackswithoutaserver& 39;ssecretstate;itonlyin- directlya ectsthecostofano -lineattackgiven thatstate.Tuningkeylengthtopreservepassword guessingcostswouldhaveotherunintendedconse- quences,forinstanceincreasingmessagesizesand costingserversunnecessarycomputation.Bycom- biningaschemelikeSRPwiththebcryptalgorithm presentedinthispaper,however,onecanvarythe costofguessingpasswordsindependentlyfrommost otherpropertiesoftheprotocol. Whateverprogressoccursinpreventingo -lineat- tacks,onecanneverrulethemoutentirely.Infact, thedecisiontohaveanopenlyreadablepassword lewasnotanoversightonthepartoftheUNIX systemdesigners[9].Rather,itwasareactionto thedicultyofkeepingthepassword lesecretin previoussystems,andtotherealizationthatasup- posedlysecretpassword lewouldneedtoresist o -lineguessinganyway.Thisrealizationremains equallytruetoday.Asidefromtheobviousissues

Excerpt from a page describing this subject · 40,000 chars · not written by Vinony

Article · Português

bcrypt é um método de criptografia do tipo hash para senhas baseado no Blowfish. Foi criado por Niels Provos e David Mazières e apresentado na conferência da USENIX em 1999 . Este método apresenta uma segurança maior em relação à maioria dos outros métodos criptográficos que é a implementação da variável "custo" que é proporcional à quantidade de processamento necessária para criptografar a senha. O método é conhecido como hash adaptativo às melhorias futuras de hardware por ter esta característica, pois pode permanecer resistente à ataques do tipo "força-bruta" com o tempo usando custos maiores de processamento. Ao contrário do método tradicional "crypt" (concebido em 1976), o algoritmo bcrypt não possui as restrições da época que eram pouco processamento e poucos espaço (bytes) para guardar o salt e o hash gerado da senha criptografada . O algoritmo bcrypt foi implementado em diversas linguagens como Python, Perl, Ruby, Java, C# e outras , além de possuir implementação também para a função "crypt" do UNIX.

Abstract from DBpedia / Wikipedia · CC BY-SA