Talk:Bcrypt
From Wikipedia, the free encyclopedia
 | This article is rated C-class on Wikipedia's content assessment scale. It is of interest to the following WikiProjects: | |||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||
.svg){kind=logo}
bcrypt is not a key derivation function
The lead of this article describes bcrypt as a KDF. This is wrong:
- Nowhere in the original paper is bcrypt referred to as a KDF. It's specifically called a "hash function" or "password hashing function" in the paper: https://www.usenix.org/legacy/event/usenix99/full_papers/provos/provos.pdf
- bcrypt does not meet the criteria on a KDF as described in the Wikipedia key derivation function page. These properties include: deriving one _or more_ secret keys from a master secret and stretching key into longer keys. Where typical KDFs produce variable length outputs, the bcrypt paper describes a function that only produces a 192-bit output, and in practice bcrypt produces 184-bits. This can't even be used to derive e.g. a 256-bit encryption key (or multiple 128-bit keys from a single input).
- Where PBKDF2 and scrypt are commonly used to derive keys, bcrypt is not: it is used nearly exclusively for password storage. The Wikipedia key derivation function page notes that "KDFs happen to have the characteristics desired for a 'password hash function', even though they were not originally designed for this purpose" however the reverse is not necessarily true. Where password hashing functions like PBKDF2, scrypt, and Argon2 are KDFs, bcrypt does not provide the basic features of a KDF.
There is a KDF based on bcrypt used by e.g. OpenSSH, namely a variant of PBKDF2 which uses bcrypt as its PRF, but in this case the real KDF is PBKDF2, not bcrypt: bcrypt is simply acting as a PRF.
I challenge anyone claiming bcrypt itself is a KDF to find any reputable source saying so. That said I'm going to change it to "password hashing function" to match what's in the paper. Tarcieri (talk) 21:21, 8 May 2016 (UTC)
- I'm 5 years late, but I agree that this is not a KDF and the article should not call it one. BernardoSulzbach (talk) 15:27, 4 July 2021 (UTC)
Seriously misleading description, now fixed
This fragment "(.. bcrypt computes..) a hash from a given input as follows: bcrypt(cost, salt, key, input)" suggested that the password is fed in input. But the intend in the original definition, and many implementations, is feeding password in key, with input a constant derived from "OrpheanBeholderScryDoubt" broken as three 64-bit blocks. Now fixed. Fgrieu (talk) 20:27, 26 June 2012 (UTC)
Popular password hashing bcrypt vs later obscure file encryption bcrypt
I bet 99% of people looking for bcrypt think of the password derivation function, not a pretty obscure program using an outdated cipher... JidGom (talk) (2011-03-30T04:58:28)
- We had the same thought on the same day. Right - all the links to bcrypt on wikipedia were about the hash. And the hash is about more than the "crypt (Unix)" program. So I fixed it. ★NealMcB★ (talk) 15:35, 30 March 2011 (UTC)
I came here today looking for information on the unix command, since I downloaded it and it does NOT seem to implement a hash function. I would have liked to have found that information here. DouglasHeld (talk) 15:51, 11 January 2018 (UTC)
Cryptographic hash function page
Why isn't this page listed in the Cryptographic hash function page and corresponding template? Dserodio (talk) 20:32, 20 August 2012 (UTC)
- Technically it's not a hash, it's a Key derivation function.
- At least some Wikipedia user claims this is not the case and that there are no references found stating that bcrypt is a key derivation function (KDF). Now how would be an authoritative source to clear this once and for all? Or is there consent now that bcrypt is no KDF? --79.212.58.2 (talk) 14:47, 7 June 2020 (UTC)
Explain What Bcrypt Does, Not How It Is Implemented
The article lacks a clear statement about how Bcrypt is different from other hashing functions. What parts are essential to its functioning and how it may be used. I.e. something that would speak to the broader audience of people not versed in cryptography, users of cryptography, not cryptographers themselves. An explanation would be especially beneficial because most times I've seen it being used, it was used wrongly. The fact that it uses the hash, previously generated from input to produce the salt when verifying that the hash generated from another input matches the hash generated from the previous input - is very counter-intuitive and deserves special attention IMO. 79.176.130.107 (talk) 14:02, 9 October 2013 (UTC)
ExpandKey function code looks wrong
what I can see: it takes an input, does lots of stuff, discards it and returns the input state. — Preceding unsigned comment added by 84.146.72.200 (talk) 19:20, 21 January 2014 (UTC)
I second that. It looks like a no-op, returning the same `state` that was passed as a parameter. This makes no sense. Tempel (talk) 07:38, 30 August 2016 (UTC)