Using bcrypt to secure passwords in Perl

http://gcrawshaw.posterous.com/using-bcrypt-to-secure-passwords-in-a-perl-ap

by geoffc • 15 years ago

29 19 15 years ago

gcrawshaw.posterous.com

draegtun• 15 years ago

Also a very similar post Safely Storing Passwords from a few days earlier on blogs.perl.org which includes a Dancer bcrypt plugin: http://blogs.perl.org/users/james_aitken/2011/07/safely-stor...

LoonyPandora2• 15 years ago

I also blogged about this topic on blogs.perl.org the other week with some code examples that work a little better [1].

Your code appears to work, but is subtly broken in a few ways. Firstly since you don't return the hash in the "standard" format ("$2a", "$", two digits, "$", salt as 22 base 64 digits, '.', and 31 base 64 digits for the pass), one can't tell what work factor was used to create the hash - making it hard to verify a password. Secondly the salt isn't sufficiently random, there are modules out there that provide more randomness for cryptographic applications such as this.

It's nice to see people blogging about this kind of thing for perl, but it's important that the code is correct.

[1] http://blogs.perl.org/users/james_aitken/2011/07/safely-stor...

geoffc6• 15 years ago

Thanks for the feedback. I will make some changes.

LoonyPandora2• 15 years ago

Have a look at Authen::Passphrase::BlowfishCrypt [1]. it handles a lot of my suggestions automatically and is more suited to your general-case than my code is.

[1] http://search.cpan.org/~zefram/Authen-Passphrase-0.007/lib/A...

tomjen3• 15 years ago

And that is why I don't like bcrypt -- it is far too easily to screw something up in non-obvious ways.

rimantas• 15 years ago

Yeah, at least by using md5 one can easily screw everything up in an obvious way.

alfiejohn_• 15 years ago

It's a shame that the first comment was for a typo. Can't people get over these things?

geoffc6• 15 years ago

Yes but the second comment on the blog was great, truly an education in encryption for me.

jrockway2• 15 years ago

No, no, no. Just use Authen::Passphrase.

geoffc6• 15 years ago

Thanks. I updated the blog with a pointer to the module.

jrockway2• 15 years ago

Nice! One thing that's great about blogging is that if you blog your code, a reader is bound to golf it down to one line of code :)

Using bcrypt to secure passwords in Perl

Related Stories