bcrypt Discussions Rss Feed

New Post: No hashing of salt, string, workload?

TLM — Tue, 29 Jan 2013 08:47:24 GMT

this might be a year late but here's a good explanation why.

http://stackoverflow.com/questions/5393803/can-someone-explain-how-bcrypt-verifies-a-hash

New Post: Strong Name Signing

Atrejoe — Fri, 08 Jun 2012 09:58:09 GMT

Same here.

Is the idea that the source code cannot contain the key (maybe defeating the purpose of signing altogether), then maybe it would be an idea to ship the binaries with signed dlls, but keep the key out of the source, just for convenience?

For now compilation with my own key seems to be the way to go.

New Post: Strong Name Signing

DonLafferty — Wed, 18 Apr 2012 17:10:43 GMT

I'm trying to use this in a VS2010 VB project but because I have the project signed with a strong name every assembly must also be signed with a strong name. Is it possible for the next version to be signed with a strong name so I can use it in my project?

New Post: No hashing of salt, string, workload?

adamtuliper — Sat, 21 Jan 2012 07:48:09 GMT

The docs don't seem to be right here.

1. BCrypt..::..HashPassword Method (String, Int32)

Hash a password using the OpenBSD bcrypt scheme and a salt generated by GenerateSalt(Int32) using the given workFactor.

This seems to not be correct since there is no salt provided as a parameter for this overload.

Whats the use of having a work factor here but no salt? Ideally you want to provide the salt, text, and work factor to slow the computation time down.

Sure you can set the work factor when generating the salt, but if the salt is already generated, you would likely want to use it when a user types in a password for validation AND include a work factor to slow brute forcing down - the whole purpose as I would see it for the work factor to exist?

Thoughts?

Thanks!

New Post: .NET Membership Provider

mammo — Thu, 14 Jul 2011 14:01:33 GMT

Check the answers (especially the one from GalacticJello) on

http://stackoverflow.com/questions/6460711/adding-a-custom-hashalgorithmtype-in-c-asp-net

Kind regards,

Amanuel

New Post: .NET Membership Provider

enmaku — Thu, 23 Jun 2011 21:48:14 GMT

OK so I'm a bit of a noob when it comes to such things, but is there any way to set this library up so that I can specify hashAlgorithmType="BCrypt" in my web.config's <membership> section?

If so, you might consider including it in future sample code releases as it would make including BCrypt.Net into existing projects much easier when such projects are using ASP.NET's built-in Membership Provider.

Thanks,

David Perry