Examples of BCrypt

org.mindrot.jbcrypt.BCrypt

BCrypt implements OpenBSD-style Blowfish password hashing using the scheme described in "A Future-Adaptable Password Scheme" by Niels Provos and David Mazieres.

This password hashing system tries to thwart off-line password cracking using a computationally-intensive hashing algorithm, based on Bruce Schneier's Blowfish cipher. The work factor of the algorithm is parameterised, so it can be increased as computers get faster.

Usage is really simple. To hash a password for the first time, call the hashpw method with a random salt, like this:

String pw_hash = BCrypt.hashpw(plain_password, BCrypt.gensalt());

To check whether a plaintext password matches one that has been hashed previously, use the checkpw method:

if (BCrypt.checkpw(candidate_password, stored_hash)) System.out.println("It matches"); else System.out.println("It does not match");

The gensalt() method takes an optional parameter (log_rounds) that determines the computational complexity of the hashing:

String strong_salt = BCrypt.gensalt(10) String stronger_salt = BCrypt.gensalt(12)

The amount of work increases exponentially (2**log_rounds), so each increment is twice as much work. The default log_rounds is 10, and the valid range is 4 to 31. @author Damien Miller @version 0.2

        rounds = determineBestRounds();
      }


      int plaintext[] = {0x155cbf8e, 0x57f57513, 0x3da787b9, 0x71679d82,
                         0x7cf72e93, 0x1ae25274, 0x64b54adc, 0x335cbd0b};
      BCrypt bcrypt = new BCrypt();
      byte[] rawBytes = bcrypt.crypt_raw(password.getBytes("UTF-8"),
                                         salt, rounds, plaintext);
      SecretKeySpec spec = new SecretKeySpec(rawBytes, KEY_FACTORY);
      info.encryptCipher = Cipher.getInstance(KEY_FACTORY);
      info.encryptCipher.init(Cipher.ENCRYPT_MODE, spec);

  public static int determineBestRounds() {
      byte[] salt = createNewSalt();
      int plaintext[] = {0x155cbf8e, 0x57f57513, 0x3da787b9, 0x71679d82,
                         0x7cf72e93, 0x1ae25274, 0x64b54adc, 0x335cbd0b};
      final byte[] password = {1, 2, 3, 4, 5, 6, 7, 8};
      BCrypt bcrypt = new BCrypt();


      // Calculate the time to create a cipher key with 4 rounds, in msecs.
      // Do it twice and take the average.
      final long start = System.currentTimeMillis();
      bcrypt.crypt_raw(password, salt, 4, plaintext);
      bcrypt.crypt_raw(password, salt, 4, plaintext);
      final long T4 = (System.currentTimeMillis() - start) / 2;


      // If T4 is the time in msecs to create the key with 4 rounds, then
      // the time Tn to calculate the key using n rounds (n > 4) is:
      //

All source code are property of their respective owners. Java is a trademark of Sun Microsystems, Inc and owned by ORACLE Inc. Contact coftware#gmail.com.

Examples of BCrypt

Examples of org.mindrot.jbcrypt.BCrypt

Examples of org.mindrot.jbcrypt.BCrypt