riverrun/comeonin

Comeonin Bcrypt does not support the 2y prefix?

hariharasudhan94 opened this issue · 8 comments

hariharasudhan94 commented

I have a set passwords which have $2y$ prefix. When i trying to check password using Comeonin.Bcrypt.checkpw("hard to guess", stored_hash) , I am getting error like Comeonin Bcrypt does not support the 2y prefix, how can i resolve this issue

riverrun commented

The $2y$ prefix is provided by another version of Bcrypt (not the OpenBSD version), and it's not supported. There's also no plan to support it.

hariharasudhan94 commented

Is there any other option or libraries, i can try right now?

riverrun commented

I don't know anything in Elixir or Erlang that supports the $2y$ prefix.

hubertlepicki commented

@riverrun as far as I understand, $2y$ does not mark any incompatible algorithm. It is equal to $2a$.

PHP people had a bug in their implementation, and used special prefix $2x$ to mark hashes generated with broken implementation. Then, they decided that it's good idea to introcudce $2y$, to distinguish from possibly broken $2a$ they may have in database, and definitely broken $2x$.

So, in a nutshell, hashes with $2y$ could be treated as $2a$ and we should raise instead on prefix $2x$ that is indeed most likely wrong.

  • 👍3
  • 😄1
riverrun commented

The $2y$ prefix is part of the Openwall implementation, and according to their bcrypt page, it should be compatible with the $2b$ prefix from the OpenBSD version.

However, before I make any change, I obviously need to do a certain amount of research to decide how best to approach it. At the moment, I don't have the time to do that, but if there is a demand for $2y$ prefix support, I can make the time.

I hope that answers your questions.

  • ❤️3
hubertlepicki commented

I'm not sure if this should be supported to be fair.

Maybe we simply need better error message saying that this prefix is not supported, and you should replace it with compatible $2b$ one.

riverrun commented

I could look into improving the error message.

ryanwinchester commented

@riverrun

For what it's worth, this works for me:

  Comeonin.Bcrypt.checkpw(password, fix_prefix(password_hash))

  defp fix_prefix("$2y" <> rest), do: "$2b" <> rest
  defp fix_prefix(password_hash), do: password_hash

  • 👍12
  • 🎉3
  • 🚀1