Mixing
How to use bcrypt in OpenSSL?
I want to use bcrypt encryption for storing passwords and I know OpenSSL implements Blowfish Cipher (which I'm assuming is the same thing).
I made some adaptations from the code shown in this page https://wiki.openssl.org/index.php/EVP_Symmetric_Encryption_and_Decryption
and came up with this:
int OpenSSLEncrypt(
unsigned char* plaintext,
int plaintext_len,
unsigned char* key,
unsigned char* iv,
unsigned char* ciphertext)
{
EVP_CIPHER_CTX *ctx;
int len;
int ciphertext_len;
if (!(ctx = EVP_CIPHER_CTX_new())) OpenSSLHandleErrors();
if (1 != EVP_EncryptInit_ex(ctx, EVP_bf_cbc(), 0, key, 0))
OpenSSLHandleErrors();
if (1 != EVP_EncryptUpdate(ctx, ciphertext, &len, plaintext, plaintext_len))
OpenSSLHandleErrors();
ciphertext_len = len;
if (1 != EVP_EncryptFinal_ex(ctx, ciphertext + len, &len))
OpenSSLHandleErrors();
ciphertext_len += len;
/* Clean up */
EVP_CIPHER_CTX_free(ctx);
return ciphertext_len;
}
int OpenSSLDecrypt(
unsigned char* ciphertext,
int ciphertext_len,
unsigned char* key,
unsigned char* iv,
unsigned char* plaintext)
{
EVP_CIPHER_CTX *ctx;
int len;
int plaintext_len;
if (!(ctx = EVP_CIPHER_CTX_new())) OpenSSLHandleErrors();
if (1 != EVP_DecryptInit_ex(ctx, EVP_bf_cbc(), NULL, key, 0))
OpenSSLHandleErrors();
if (1 != EVP_DecryptUpdate(ctx, plaintext, &len, ciphertext, ciphertext_len))
OpenSSLHandleErrors();
plaintext_len = len;
if (1 != EVP_DecryptFinal_ex(ctx, plaintext + len, &len))
OpenSSLHandleErrors();
plaintext_len += len;
/* Clean up */
EVP_CIPHER_CTX_free(ctx);
return plaintext_len;
}
But the length of the cipher that I get from OpenSSLEncrypt(...) depends on the length of the plaintext input parameter, which is not what I was expecting. I was expecting the output to be 64 bytes long no matter the length of the password.
Also, I don't know if EVP_EncryptInit_ex needs an iv (initialization vector) or not for EVP_bf_cbc, and I found no documentation that could help me with this.
c openssl bcrypt libcrypto
edited Jan 2 at 21:36
Cinder Biscuits
2,5921526
asked Jan 2 at 20:46
Davi DoroDavi Doro
313
|
show 1 more comment
I want to use bcrypt encryption for storing passwords and I know OpenSSL implements Blowfish Cipher (which I'm assuming is the same thing).
I made some adaptations from the code shown in this page https://wiki.openssl.org/index.php/EVP_Symmetric_Encryption_and_Decryption
and came up with this:
int OpenSSLEncrypt(
unsigned char* plaintext,
int plaintext_len,
unsigned char* key,
unsigned char* iv,
unsigned char* ciphertext)
{
EVP_CIPHER_CTX *ctx;
int len;
int ciphertext_len;
if (!(ctx = EVP_CIPHER_CTX_new())) OpenSSLHandleErrors();
if (1 != EVP_EncryptInit_ex(ctx, EVP_bf_cbc(), 0, key, 0))
OpenSSLHandleErrors();
if (1 != EVP_EncryptUpdate(ctx, ciphertext, &len, plaintext, plaintext_len))
OpenSSLHandleErrors();
ciphertext_len = len;
if (1 != EVP_EncryptFinal_ex(ctx, ciphertext + len, &len))
OpenSSLHandleErrors();
ciphertext_len += len;
/* Clean up */
EVP_CIPHER_CTX_free(ctx);
return ciphertext_len;
}
int OpenSSLDecrypt(
unsigned char* ciphertext,
int ciphertext_len,
unsigned char* key,
unsigned char* iv,
unsigned char* plaintext)
{
EVP_CIPHER_CTX *ctx;
int len;
int plaintext_len;
if (!(ctx = EVP_CIPHER_CTX_new())) OpenSSLHandleErrors();
if (1 != EVP_DecryptInit_ex(ctx, EVP_bf_cbc(), NULL, key, 0))
OpenSSLHandleErrors();
if (1 != EVP_DecryptUpdate(ctx, plaintext, &len, ciphertext, ciphertext_len))
OpenSSLHandleErrors();
plaintext_len = len;
if (1 != EVP_DecryptFinal_ex(ctx, plaintext + len, &len))
OpenSSLHandleErrors();
plaintext_len += len;
/* Clean up */
EVP_CIPHER_CTX_free(ctx);
return plaintext_len;
}
But the length of the cipher that I get from OpenSSLEncrypt(...) depends on the length of the plaintext input parameter, which is not what I was expecting. I was expecting the output to be 64 bytes long no matter the length of the password.
Also, I don't know if EVP_EncryptInit_ex needs an iv (initialization vector) or not for EVP_bf_cbc, and I found no documentation that could help me with this.
c openssl bcrypt libcrypto
edited Jan 2 at 21:36
Cinder Biscuits
2,5921526
asked Jan 2 at 20:46
Davi DoroDavi Doro
313
Why are you assuming that bcrypt is just Blowfish?
– stark
Jan 2 at 21:33
Best lesson you can learn in cryptography, don't roll your own when a cryptographer already has done the work: github.com/libressl-portable/openbsd/blob/master/src/lib/libc/…
– Cinder Biscuits
Jan 2 at 21:41
Blowfish and BCrypt aren't the same thing. Blowfish is a cryptographic cipher, BCrypt is a password hashing algorithm based on blowfish.
– Cinder Biscuits
Jan 2 at 21:42
Finally, I would not recommend skipping the IV in any password hashing scheme, it opens your software up to rainbow table attacks (see my first comment)
– Cinder Biscuits
Jan 2 at 21:44
What your code is doing is blowfish-CBC. Bcrypt has nothing to do with it. Unclear what you're asking.
– rustyx
Jan 2 at 21:54
|
show 1 more comment
I want to use bcrypt encryption for storing passwords and I know OpenSSL implements Blowfish Cipher (which I'm assuming is the same thing).
I made some adaptations from the code shown in this page https://wiki.openssl.org/index.php/EVP_Symmetric_Encryption_and_Decryption
and came up with this:
int OpenSSLEncrypt(
unsigned char* plaintext,
int plaintext_len,
unsigned char* key,
unsigned char* iv,
unsigned char* ciphertext)
{
EVP_CIPHER_CTX *ctx;
int len;
int ciphertext_len;
if (!(ctx = EVP_CIPHER_CTX_new())) OpenSSLHandleErrors();
if (1 != EVP_EncryptInit_ex(ctx, EVP_bf_cbc(), 0, key, 0))
OpenSSLHandleErrors();
if (1 != EVP_EncryptUpdate(ctx, ciphertext, &len, plaintext, plaintext_len))
OpenSSLHandleErrors();
ciphertext_len = len;
if (1 != EVP_EncryptFinal_ex(ctx, ciphertext + len, &len))
OpenSSLHandleErrors();
ciphertext_len += len;
/* Clean up */
EVP_CIPHER_CTX_free(ctx);
return ciphertext_len;
}
int OpenSSLDecrypt(
unsigned char* ciphertext,
int ciphertext_len,
unsigned char* key,
unsigned char* iv,
unsigned char* plaintext)
{
EVP_CIPHER_CTX *ctx;
int len;
int plaintext_len;
if (!(ctx = EVP_CIPHER_CTX_new())) OpenSSLHandleErrors();
if (1 != EVP_DecryptInit_ex(ctx, EVP_bf_cbc(), NULL, key, 0))
OpenSSLHandleErrors();
if (1 != EVP_DecryptUpdate(ctx, plaintext, &len, ciphertext, ciphertext_len))
OpenSSLHandleErrors();
plaintext_len = len;
if (1 != EVP_DecryptFinal_ex(ctx, plaintext + len, &len))
OpenSSLHandleErrors();
plaintext_len += len;
/* Clean up */
EVP_CIPHER_CTX_free(ctx);
return plaintext_len;
}
But the length of the cipher that I get from OpenSSLEncrypt(...) depends on the length of the plaintext input parameter, which is not what I was expecting. I was expecting the output to be 64 bytes long no matter the length of the password.
Also, I don't know if EVP_EncryptInit_ex needs an iv (initialization vector) or not for EVP_bf_cbc, and I found no documentation that could help me with this.
c openssl bcrypt libcrypto
edited Jan 2 at 21:36
Cinder Biscuits
2,5921526
asked Jan 2 at 20:46
Davi DoroDavi Doro
313
I want to use bcrypt encryption for storing passwords and I know OpenSSL implements Blowfish Cipher (which I'm assuming is the same thing).
I made some adaptations from the code shown in this page https://wiki.openssl.org/index.php/EVP_Symmetric_Encryption_and_Decryption
and came up with this:
int OpenSSLEncrypt(
unsigned char* plaintext,
int plaintext_len,
unsigned char* key,
unsigned char* iv,
unsigned char* ciphertext)
{
EVP_CIPHER_CTX *ctx;
int len;
int ciphertext_len;
if (!(ctx = EVP_CIPHER_CTX_new())) OpenSSLHandleErrors();
if (1 != EVP_EncryptInit_ex(ctx, EVP_bf_cbc(), 0, key, 0))
OpenSSLHandleErrors();
if (1 != EVP_EncryptUpdate(ctx, ciphertext, &len, plaintext, plaintext_len))
OpenSSLHandleErrors();
ciphertext_len = len;
if (1 != EVP_EncryptFinal_ex(ctx, ciphertext + len, &len))
OpenSSLHandleErrors();
ciphertext_len += len;
/* Clean up */
EVP_CIPHER_CTX_free(ctx);
return ciphertext_len;
}
int OpenSSLDecrypt(
unsigned char* ciphertext,
int ciphertext_len,
unsigned char* key,
unsigned char* iv,
unsigned char* plaintext)
{
EVP_CIPHER_CTX *ctx;
int len;
int plaintext_len;
if (!(ctx = EVP_CIPHER_CTX_new())) OpenSSLHandleErrors();
if (1 != EVP_DecryptInit_ex(ctx, EVP_bf_cbc(), NULL, key, 0))
OpenSSLHandleErrors();
if (1 != EVP_DecryptUpdate(ctx, plaintext, &len, ciphertext, ciphertext_len))
OpenSSLHandleErrors();
plaintext_len = len;
if (1 != EVP_DecryptFinal_ex(ctx, plaintext + len, &len))
OpenSSLHandleErrors();
plaintext_len += len;
/* Clean up */
EVP_CIPHER_CTX_free(ctx);
return plaintext_len;
}
But the length of the cipher that I get from OpenSSLEncrypt(...) depends on the length of the plaintext input parameter, which is not what I was expecting. I was expecting the output to be 64 bytes long no matter the length of the password.
Also, I don't know if EVP_EncryptInit_ex needs an iv (initialization vector) or not for EVP_bf_cbc, and I found no documentation that could help me with this.
c openssl bcrypt libcrypto
c openssl bcrypt libcrypto
edited Jan 2 at 21:36
Cinder Biscuits
2,5921526
asked Jan 2 at 20:46
Davi DoroDavi Doro
313
edited Jan 2 at 21:36
Cinder Biscuits
2,5921526
asked Jan 2 at 20:46
Davi DoroDavi Doro
313
edited Jan 2 at 21:36
Cinder Biscuits
2,5921526
edited Jan 2 at 21:36
Cinder Biscuits
2,5921526
edited Jan 2 at 21:36
Cinder Biscuits
2,5921526
2,5921526
asked Jan 2 at 20:46
Davi DoroDavi Doro
313
asked Jan 2 at 20:46
Davi DoroDavi Doro
313
asked Jan 2 at 20:46
Davi DoroDavi Doro
313
313
Why are you assuming that bcrypt is just Blowfish?
– stark
Jan 2 at 21:33
Best lesson you can learn in cryptography, don't roll your own when a cryptographer already has done the work: github.com/libressl-portable/openbsd/blob/master/src/lib/libc/…
– Cinder Biscuits
Jan 2 at 21:41
Blowfish and BCrypt aren't the same thing. Blowfish is a cryptographic cipher, BCrypt is a password hashing algorithm based on blowfish.
– Cinder Biscuits
Jan 2 at 21:42
Finally, I would not recommend skipping the IV in any password hashing scheme, it opens your software up to rainbow table attacks (see my first comment)
– Cinder Biscuits
Jan 2 at 21:44
What your code is doing is blowfish-CBC. Bcrypt has nothing to do with it. Unclear what you're asking.
– rustyx
Jan 2 at 21:54
|
show 1 more comment
Why are you assuming that bcrypt is just Blowfish?
– stark
Jan 2 at 21:33
Best lesson you can learn in cryptography, don't roll your own when a cryptographer already has done the work: github.com/libressl-portable/openbsd/blob/master/src/lib/libc/…
– Cinder Biscuits
Jan 2 at 21:41
Blowfish and BCrypt aren't the same thing. Blowfish is a cryptographic cipher, BCrypt is a password hashing algorithm based on blowfish.
– Cinder Biscuits
Jan 2 at 21:42
Finally, I would not recommend skipping the IV in any password hashing scheme, it opens your software up to rainbow table attacks (see my first comment)
– Cinder Biscuits
Jan 2 at 21:44
What your code is doing is blowfish-CBC. Bcrypt has nothing to do with it. Unclear what you're asking.
– rustyx
Jan 2 at 21:54
Why are you assuming that bcrypt is just Blowfish?
– stark
Jan 2 at 21:33
Why are you assuming that bcrypt is just Blowfish?
– stark
Jan 2 at 21:33
Best lesson you can learn in cryptography, don't roll your own when a cryptographer already has done the work: github.com/libressl-portable/openbsd/blob/master/src/lib/libc/…
– Cinder Biscuits
Jan 2 at 21:41
Best lesson you can learn in cryptography, don't roll your own when a cryptographer already has done the work: github.com/libressl-portable/openbsd/blob/master/src/lib/libc/…
– Cinder Biscuits
Jan 2 at 21:41
Blowfish and BCrypt aren't the same thing. Blowfish is a cryptographic cipher, BCrypt is a password hashing algorithm based on blowfish.
– Cinder Biscuits
Jan 2 at 21:42
Blowfish and BCrypt aren't the same thing. Blowfish is a cryptographic cipher, BCrypt is a password hashing algorithm based on blowfish.
– Cinder Biscuits
Jan 2 at 21:42
Finally, I would not recommend skipping the IV in any password hashing scheme, it opens your software up to rainbow table attacks (see my first comment)
– Cinder Biscuits
Jan 2 at 21:44
Finally, I would not recommend skipping the IV in any password hashing scheme, it opens your software up to rainbow table attacks (see my first comment)
– Cinder Biscuits
Jan 2 at 21:44
What your code is doing is blowfish-CBC. Bcrypt has nothing to do with it. Unclear what you're asking.
– rustyx
Jan 2 at 21:54
What your code is doing is blowfish-CBC. Bcrypt has nothing to do with it. Unclear what you're asking.
– rustyx
Jan 2 at 21:54
|
show 1 more comment
1 Answer
1
active
oldest
votes
As it was pointed out in the comments, I was wrong in assuming Blowfish and BCrypt are the same thing, just because I read somewhere B stands for Blowfish.
I ended up following the suggestion from Cinder Biscuits of using the OpenBSD implementation of bcrypt, avaiable at
https://github.com/libressl-portable/openbsd/blob/master/src/lib/libc/crypt/bcrypt.c
answered Jan 3 at 1:39
Davi DoroDavi Doro
313
add a comment |
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54012951%2fhow-to-use-bcrypt-in-openssl%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
As it was pointed out in the comments, I was wrong in assuming Blowfish and BCrypt are the same thing, just because I read somewhere B stands for Blowfish.
I ended up following the suggestion from Cinder Biscuits of using the OpenBSD implementation of bcrypt, avaiable at
https://github.com/libressl-portable/openbsd/blob/master/src/lib/libc/crypt/bcrypt.c
answered Jan 3 at 1:39
Davi DoroDavi Doro
313
add a comment |
As it was pointed out in the comments, I was wrong in assuming Blowfish and BCrypt are the same thing, just because I read somewhere B stands for Blowfish.
I ended up following the suggestion from Cinder Biscuits of using the OpenBSD implementation of bcrypt, avaiable at
https://github.com/libressl-portable/openbsd/blob/master/src/lib/libc/crypt/bcrypt.c
answered Jan 3 at 1:39
Davi DoroDavi Doro
313
add a comment |
As it was pointed out in the comments, I was wrong in assuming Blowfish and BCrypt are the same thing, just because I read somewhere B stands for Blowfish.
I ended up following the suggestion from Cinder Biscuits of using the OpenBSD implementation of bcrypt, avaiable at
https://github.com/libressl-portable/openbsd/blob/master/src/lib/libc/crypt/bcrypt.c
answered Jan 3 at 1:39
Davi DoroDavi Doro
313
As it was pointed out in the comments, I was wrong in assuming Blowfish and BCrypt are the same thing, just because I read somewhere B stands for Blowfish.
I ended up following the suggestion from Cinder Biscuits of using the OpenBSD implementation of bcrypt, avaiable at
https://github.com/libressl-portable/openbsd/blob/master/src/lib/libc/crypt/bcrypt.c
answered Jan 3 at 1:39
Davi DoroDavi Doro
313
answered Jan 3 at 1:39
Davi DoroDavi Doro
313
answered Jan 3 at 1:39
Davi DoroDavi Doro
313
answered Jan 3 at 1:39
Davi DoroDavi Doro
313
313
add a comment |
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54012951%2fhow-to-use-bcrypt-in-openssl%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Why are you assuming that bcrypt is just Blowfish?
– stark
Jan 2 at 21:33
Best lesson you can learn in cryptography, don't roll your own when a cryptographer already has done the work: github.com/libressl-portable/openbsd/blob/master/src/lib/libc/…
– Cinder Biscuits
Jan 2 at 21:41
Blowfish and BCrypt aren't the same thing. Blowfish is a cryptographic cipher, BCrypt is a password hashing algorithm based on blowfish.
– Cinder Biscuits
Jan 2 at 21:42
Finally, I would not recommend skipping the IV in any password hashing scheme, it opens your software up to rainbow table attacks (see my first comment)
– Cinder Biscuits
Jan 2 at 21:44
What your code is doing is blowfish-CBC. Bcrypt has nothing to do with it. Unclear what you're asking.
– rustyx
Jan 2 at 21:54