BCryptSha256PasswordHasher

Implementation of the password hasher based on BCrypt.

The designers of bcrypt truncate all passwords at 72 characters which means that bcrypt(password_with_100_chars) == bcrypt(password_with_100_chars[:72]). The original BCryptPasswordHasher does not have any special handling and thus is also subject to this hidden password length limit. BCryptSha256PasswordHasher fixes this by first hashing the password using sha256. This prevents the password truncation and so should be preferred over the BCryptPasswordHasher. The practical ramification of this truncation is pretty marginal as the average user does not have a password greater than 72 characters in length and even being truncated at 72 the compute powered required to brute force bcrypt in any useful amount of time is still astronomical. Nonetheless, we recommend you use BCryptSha256PasswordHasher anyway on the principle of "better safe than sorry".

See also: https://crypto.stackexchange.com/questions/24993/is-there-a-way-to-use-bcrypt-with-passwords-longer-than-72-bytes-securely
https://docs.djangoproject.com/en/1.10/topics/auth/passwords/#using-bcrypt-with-django
gensalt

Linear Supertypes

BCryptPasswordHasher, PasswordHasher, AnyRef, Any

Instance Constructors

new BCryptSha256PasswordHasher(logRounds: Int = 10)

logRounds
The log2 of the number of rounds of hashing to apply.

Value Members

final def !=(arg0: Any): Boolean

Definition Classes
AnyRef → Any
final def ##(): Int

Definition Classes
AnyRef → Any
final def ==(arg0: Any): Boolean

Definition Classes
AnyRef → Any
final def asInstanceOf[T0]: T0

Definition Classes
Any
def clone(): AnyRef

Attributes
protected[java.lang]
Definition Classes
AnyRef
Annotations
@throws( ... )
final def eq(arg0: AnyRef): Boolean

Definition Classes
AnyRef
def equals(arg0: Any): Boolean

Definition Classes
AnyRef → Any
def finalize(): Unit

Attributes
protected[java.lang]
Definition Classes
AnyRef
Annotations
@throws( classOf[java.lang.Throwable] )
final def getClass(): Class[_]

Definition Classes
AnyRef → Any
def hash(plainPassword: String): PasswordInfo

Hashes a password.
Hashes a password.
This implementation does not return the salt separately because it is embedded in the hashed password. Other implementations might need to return it so it gets saved in the backing store.
plainPassword
The password to hash.
returns
A PasswordInfo containing the hashed password.

Definition Classes
BCryptSha256PasswordHasher → BCryptPasswordHasher → PasswordHasher
def hashCode(): Int

Definition Classes
AnyRef → Any
def id: String

Gets the ID of the hasher.
Gets the ID of the hasher.
returns
The ID of the hasher.

Definition Classes
BCryptSha256PasswordHasher → BCryptPasswordHasher → PasswordHasher
def isDeprecated(passwordInfo: PasswordInfo): Option[Boolean]

Indicates if a password info hashed with this hasher is deprecated.
Indicates if a password info hashed with this hasher is deprecated.
In case of the BCrypt password hasher, a password is deprecated if the log rounds have changed.
passwordInfo
The password info to check the deprecation status for.
returns
True if the given password info is deprecated, false otherwise. If a hasher isn't suitable for the given password, this method should return None.

Definition Classes
BCryptPasswordHasher → PasswordHasher
final def isInstanceOf[T0]: Boolean

Definition Classes
Any
def isSuitable(passwordInfo: PasswordInfo): Boolean

Definition Classes
PasswordHasher
def matches(passwordInfo: PasswordInfo, suppliedPassword: String): Boolean

Checks if a password matches the hashed version.
Checks if a password matches the hashed version.
passwordInfo
The password retrieved from the backing store.
suppliedPassword
The password supplied by the user trying to log in.
returns
True if the password matches, false otherwise.

Definition Classes
BCryptSha256PasswordHasher → BCryptPasswordHasher → PasswordHasher
final def ne(arg0: AnyRef): Boolean

Definition Classes
AnyRef
final def notify(): Unit

Definition Classes
AnyRef
final def notifyAll(): Unit

Definition Classes
AnyRef
final def synchronized[T0](arg0: ⇒ T0): T0

Definition Classes
AnyRef
def toString(): String

Definition Classes
AnyRef → Any
final def wait(): Unit

Definition Classes
AnyRef
Annotations
@throws( ... )
final def wait(arg0: Long, arg1: Int): Unit

Definition Classes
AnyRef
Annotations
@throws( ... )
final def wait(arg0: Long): Unit

Definition Classes
AnyRef
Annotations
@throws( ... )

Related Docs: object BCryptSha256PasswordHasher | package password

class BCryptSha256PasswordHasher extends BCryptPasswordHasher

Instance Constructors

new BCryptSha256PasswordHasher(logRounds: Int = 10)

Value Members

final def !=(arg0: Any): Boolean

final def ##(): Int

final def ==(arg0: Any): Boolean

final def asInstanceOf[T0]: T0

def clone(): AnyRef

final def eq(arg0: AnyRef): Boolean

def equals(arg0: Any): Boolean

def finalize(): Unit

final def getClass(): Class[_]

def hash(plainPassword: String): PasswordInfo

def hashCode(): Int

def id: String

def isDeprecated(passwordInfo: PasswordInfo): Option[Boolean]

final def isInstanceOf[T0]: Boolean

def isSuitable(passwordInfo: PasswordInfo): Boolean

def matches(passwordInfo: PasswordInfo, suppliedPassword: String): Boolean

final def ne(arg0: AnyRef): Boolean

final def notify(): Unit

final def notifyAll(): Unit

final def synchronized[T0](arg0: ⇒ T0): T0

def toString(): String

final def wait(): Unit

final def wait(arg0: Long, arg1: Int): Unit

final def wait(arg0: Long): Unit

Inherited from BCryptPasswordHasher

Inherited from PasswordHasher

Inherited from AnyRef

Inherited from Any

Ungrouped