eiac/crypto
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,322 Commits 11 Branches 57 Tags
cdce021fa6c7d9c7eb2743bfbe551f0a98fd5d62
Commit Graph
6 Commits
Author SHA1 Message Date
Roland Shoemaker bc7d1d1eb5 bcrypt: reject passwords longer than 72 bytes 
By design, bcrypt only uses the first 72 bytes of a password when
generating a hash. Most implementations, including the reference one,
simply silently ignore any trailing input when provided passwords longer
than 72 bytes. This can cause confusion for users who expect the entire
password to be used to generate the hash.

In GenerateFromPassword, reject passwords longer than 72 bytes.
CompareHashAndPassword will still accept these passwords, since we
cannot break hashes that have already been stored.

Fixes golang/go#36546

Change-Id: I039addd2a2961a7fa9d1e4a3e892a9e3c8bf4c9a
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/450415
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-by: Jason McNeil <jmcneil@x2studios.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Auto-Submit: Roland Shoemaker <roland@golang.org>
Run-TryBot: Roland Shoemaker <roland@golang.org>
 2022-12-21 17:19:30 +00:00
Kevin Burke bc7917b19d bcrypt: benchmark defaults 
Currently the benchmarks hard code "10" for the cost but maybe a
better benchmark would be to use the DefaultCost, since this is the
most common use mode for the bcrypt package.

Change-Id: Ie89853fcbe4a3a2830fff812ae5cfe908df145fe
Reviewed-on: https://go-review.googlesource.com/c/144338
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2018-10-30 02:28:21 +00:00
Andreas Auernhammer 6c586e17d9 bcrypt: fix C compatibility code 
The bcrypt implementation must append a zero byte to the user provided key
to be compatible to C implementations.
This will change the user provided key if the slice has enough capacity to
hold the extra zero byte.

This change always allocates a new slice for the C-compatible key.

Fixes golang/go#20425

Change-Id: I8dc4e840c29711daabdabe58d83643cc0103cedd
Reviewed-on: https://go-review.googlesource.com/43715
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
 2017-05-22 14:29:59 +00:00
Adam Langley 8f45c680ce go.crypto/blowfish: allow shorter passwords. 
bcrypt didn't allow one, two and three letter passwords which is a
policy decision best left to the user of the code. Some users have
legacy issues which require such short passwords to be processed.

LGTM=bradfitz
R=golang-codereviews, bradfitz
CC=golang-codereviews
https://golang.org/cl/81800044
 2014-03-31 13:41:02 -04:00
Jeff Hodges 2c5e207468 go.crypto/bcrypt: add Cost function 
Extracts the cost used to generate a bcrypt hash from the hash itself.

R=agl, agl, dchest
CC=golang-dev
https://golang.org/cl/6810051
 2012-10-31 12:35:46 -04:00
Russ Cox 470549d502 go.crypto: initial code 
Manual edits to README.
Moved from main Go repository, deleted Makefiles, ran gofix -r go1rename.

Tested with: go test code.google.com/p/go.crypto/...

R=golang-dev, bradfitz
CC=golang-dev
https://golang.org/cl/5564059
 2012-01-25 15:31:12 -05:00