DEV Community

Discussion on: BCrypt Explained

Collapse
 
sairam profile image
Sai Ram • Edited

also note that everytime bcrypt (the ruby gem) would give you a different output for the same password. This is because "bcrypt-ruby automatically handles the storage and generation of these salts for you."
source: github.com/codahale/bcrypt-ruby

This would prevent rainbow table attacks.

BCrypt::Password.create('password123')
=> "$2a$12$7y.HUfDjTlk/x.W6/qXnU.pr21Zpb8vA8zBUYYbibZ7GId5XtS7VW"

salt # "$2a$12$7y.HUfDjTlk/x.W6/qXnU."
checksum # "pr21Zpb8vA8zBUYYbibZ7GId5XtS7VW"

BCrypt::Password.create('password123')
=> "$2a$12$tzCuyx7OuC7fy5K7lUGJwuOH0SJxriKIfRy4IX6o9To1QtqV08hNe"

Collapse
 
sylviapap profile image
Sylvia Pap • Edited

I actually quoted and cited the ruby gem readme in this post. I covered the definition of a salt, and actually bcrypt handling the generation/storage does not change the fact that a salt will always yield a unique result. The important fact here is that it only gives two different hashes because you aren't saving either instance of password creation. Once a password is created and saved, it will always have the same hash:

pw = BCrypt::Password.create('password123')
 => "$2a$10$/Abmx5sENPk3KlSUviWVwOkiaAYrLf8dclai6wD4wyBCehRLpVRg." 
pw
 => "$2a$10$/Abmx5sENPk3KlSUviWVwOkiaAYrLf8dclai6wD4wyBCehRLpVRg."

The question of rainbow table attacks also misses the point - for longer explanation please read this article that I also linked by the gem creator: codahale.com/how-to-safely-store-a...