BCrypt Algorithm (2024)

Saving passwords in plain text should never be an option. Instead, we need to supply a one-way street to security by hashing passwords. We have previously explored that hashing alone isn’t adequate to moderate more involved attacks such as rainbow tables. A better practice for storing passwords is to include salt in the hashing handle. In other words, include extra arbitrary information to the hashing input that produces a secret word to make the hash one of a kind. The perfect verification stage would coordinate these two forms: hashing and salting consistently.

There are a bounty of cryptographic functions to select from such as the SHA2 family and the SHA3 family. One design issue with the Secure Hash Algorithm (SHA) families is that they were outlined to be computationally quick. How quickly a cryptographic method can generate a hash has a bearing on how secure and safe the password is.

Nowadays hardware, along with CPU and GPU, is very capable. It can compute millions or certainly billions of SHA-256 hashes per moment against a stolen database that makes Denial of Service (DoS), Distributed Denial of Service (DDoS), or repeated brute-force attacks so easy. We need an attempt that’s intermediate or moderate at hashing, i.e cracking passwords, to bring attackers nearly to a standstill. Moreover, we need this work to be versatile so that we will be ready to compensate for future quicker hardware by making the function run slower and slower over time.

Integrity and security of data is always one’s highest priority. BCrypt Algorithm is used to hash and salt passwords securely. BCrypt permits building a password security stage that can advance nearby hardware innovation to guard against dangers or threats in the long run, like attackers having the computing power to guess passwords twice as quickly. Let’s dive into the specifications and design that make BCrypt a cryptographic security standard.

The aim behind BCrypt

Technology changes quickly. Expanding the speed, power, and control of computers can give advantage to both the engineers attempting to build program systems and the assailants attempting to misuse them. A few cryptographic programs aren’t outlined to scale with computing control. As clarified prior, password security depends on how quickly the opted cryptographic hashing method can calculate the password hash. A quick method would execute faster when running on much more capable hardware.

To moderate this attack vector, we may generate a cryptographic hash method that can be tuned to run slower in recently accessible hardware, i.e. the method scales with computing control power. Thus, within the plan of a cryptographic result for this issue, we must account for quickly advancing hardware and a steady length of the password.

In actuality, what is BCrypt?

BCrypt was first introduced by David Mazières and Niels Provos based on BlowFish Cipher. B stands for BlowFish & Crypt for the title of the hashing method utilized by the UNIX password framework.

Crypt may be an extraordinary case of disappointment in adjusting to technology changes. According to data provided by USENIX, in 1976, crypt could hash less than four passwords in one second. After twenty years, an optimized computer program, along with extraordinary hardware, was competent in hashing 200,000 passwords in one second utilizing that method!

BCrypt in action

As a case on how expanding the salt rounds (work factor) is directly proportional to the hashing time, I made a script in Node.js that calculated the hash of EDYu9943^%*_79 using a taken salt round from nine to fifteen.

Implementation

In this, we produce salt and hash of plain text in different function invocations-

12345678910111213const bcrypt = require("bcrypt");const saltRounds = 10;const plainText = "EDYu9943^%*_79";bcrypt .genSalt(saltRounds) .then(salt => { console.log(`salt = {salt}`); return bcrypt.hash(plainText, salt); }) .then(hash => { console.log(`hash = {hash}`); }) .catch(err => console.error(err.message));

At the start, we define three variables. The first to import the BCrypt module and capture it in an alias named bcrypt, the second to define how many salt rounds are needed to hash. Here we note that the more salt rounds, the more the password will be hashed, and the more secure our password is. Here we are taking ten salt rounds and the third is the text we want to hash, in our case that is EDYu9943^%*_79.

Then we have to invoke the inbuilt function genSalt() of the BCrypt module and have to pass a number of salt rounds as an argument. If successful, in the “then” block we return the hash of text by again calling an inbuilt function hash of the BCrypt module.

In the first run this is what I get on my command line as output -

12salt = $2b$10$ //DXiVVE59p7G5k/4Klx/ehash = $2b$10$ //DXiVVE59p7G5k/4Klx/ezF7BI42QZKmoOD0NDvUuqxRE5bFFB

Validating password

As we know we got the hash, i.e. $2b$10$//DXiVVE59p7G5k/4Klx/ezF7BI42QZKmoOD0NDvUuqxRE5bFFB.

Now, we are going to compare the given hash with the plain text we were given at the time of hashing to check if the hash is of that plain text password or not.

For this, we are going to use an inbuilt function of BCrypt module, “compare”, that takes plain text and hash as its arguments. If it matches, go into the “then” block, or else into the “catch” block.

123456789const bcrypt = require("bcrypt");const hash = "$2b$10$//DXiVVE59p7G5k/4Klx/ezF7BI42QZKmoOD0NDvUuqxRE5bFFB";const plainText = "EDYu9943^%*_79";bcrypt .compare(plainText, hash) .then(result => { console.log("result = ", result); }) .catch(err => console.error("error = ", err.message));

Chat on Discord

I'm an expert in cybersecurity, particularly in the field of password security and cryptographic techniques. My expertise is grounded in both theoretical knowledge and practical application, and I have hands-on experience in implementing and analyzing various cryptographic algorithms.

Now, let's delve into the concepts mentioned in the article about password security and the use of BCrypt:

Hashing and Salting:
- Hashing is a one-way function that converts plaintext passwords into a fixed-size string of characters. It's crucial for protecting passwords.
- Salting involves adding extra, randomly generated information to the password before hashing. This prevents attacks like rainbow tables, as each hashed password is unique.
Cryptographic Functions:
- The article mentions the SHA2 and SHA3 families as cryptographic functions. These are widely used hashing algorithms, with SHA-256 being a prominent example.
Computational Speed and Security:
- The speed at which a cryptographic method can generate a hash affects password security. Fast algorithms are vulnerable to brute-force attacks, especially with powerful hardware.
- The article emphasizes the need for an intermediate or moderate hashing method to slow down attackers, adapting to the capabilities of modern hardware.
BCrypt Algorithm:
- BCrypt is a cryptographic hashing algorithm designed to securely hash passwords. It incorporates the BlowFish Cipher and is resistant to fast brute-force attacks.
- The article highlights BCrypt's ability to adapt to evolving hardware by allowing the tuning of hashing speed (work factor) to counteract increasing computing power.
BCrypt Implementation Example:
- The provided Node.js script demonstrates how to use BCrypt to hash a password with varying salt rounds (work factor). Increasing salt rounds increases hashing time, contributing to stronger password security.
BCrypt Validation:
- The article explains how to validate a password using BCrypt's built-in compare function. This involves checking if a given plaintext password matches the stored hash.
Adapting to Technology Changes:
- The article emphasizes the importance of cryptographic methods that can scale with computing power to remain effective against evolving hardware capabilities.
BCrypt Origin:
- BCrypt was introduced by David Mazières and Niels Provos based on the BlowFish Cipher. It was designed for the UNIX password system and has proven resilient to technological changes.

In conclusion, the article underscores the importance of robust password security measures, introduces the BCrypt algorithm as a solution, and provides practical insights into its implementation and validation processes.