Pasting lemma - Revision history

178.8.24.176: /* References */ Added a specific reference.

2014-09-05T16:37:54Z

References: Added a specific reference.

← Older revision		Revision as of 18:37, 5 September 2014
Line 1:		Line 1:
	~~{{multiple issues\|~~		Hello, I'm Randolph, a 19 year old from Gibsonia, United States.<br>My hobbies include (but are not limited to) Jogging, Darts and watching How I Met Your Mother.<br><br>Visit my web page: [http://www.bestlaptopunder500.org/ best laptops under 600]
	~~{{lead too long\|date=October 2013}}~~
	~~{{external links\|date=August 2013}}~~
	~~{{ref improve\|date=August 2013}}}}~~
	~~{{lowercase\|title=bcrypt}}~~

	'~~''bcrypt''' is~~ a [[key derivation function]] for [[password]]s designed by [[Niels Provos]] and [[David Mazières]], based on the [[Blowfish (cipher)\|Blowfish]] cipher, and presented at [[USENIX]] in 1999.<ref>{{cite journal \| url = http://www.usenix.org/events/usenix99/provos/provos_html/node1.html \| title = A Future-Adaptable Password Scheme \| first = Niels \| last = Provos \| coauthors = Mazières, David \| year = 1999 \| coauthors = Talan Jason Sutton 2012 \| journal = Proceedings of 1999 USENIX Annual Technical Conference \| pages = 81–92}}</ref> Besides incorporating a [[Salt (cryptography)\|salt]] to protect against [[rainbow table]] attacks, bcrypt is an adaptive function: over time, the iteration count can be increased to make it slower, so it remains resistant to [[brute-force search]] attacks even with increasing computation power.

	Blowfish is notable among block ciphers for its expensive key setup phase. It starts off with subkeys in a standard state, then uses this state to perform a block encryption using part of the key, and uses the result of that encryption (which is more accurately a hashing) to replace some of the subkeys. Then it uses this modified state to encrypt another part of the key, and uses the result to replace more of the subkeys. It proceeds in this fashion, using a progressively modified state to hash the key and replace bits of state, until all subkeys have been set.

	Provos and Mazières took advantage of this, and took it further. They developed a new key setup algorithm for Blowfish, dubbing the resulting cipher "Eksblowfish" ("expensive key schedule Blowfish"). The key setup begins with a modified form of the standard Blowfish key setup, in which both the salt and password are used to set all subkeys. There are then a number of rounds in which the standard Blowfish keying algorithm is applied, using alternately the salt and the password as the key, each round starting with the subkey state from the previous round. Cryptotheoretically, this is no stronger than the standard Blowfish key schedule, but the number of rekeying rounds is configurable; this process can therefore be made arbitrarily slow, which helps deter brute-force attacks upon the hash or salt.

	~~The iteration count is a power of two, which is an input to the algorithm. The number is encoded in the textual result.~~

	~~There are implementations of bcrypt for Ruby, Python, C, C#~~, ~~Perl, PHP, Java and other languages~~.

	~~==Algorithm==~~
	~~The bcrypt algorithm depends heavily on its "Eksblowfish" key setup algorithm, which runs as follows:~~
	~~EksBlowfishSetup(''cost'', ''salt'', ''key'')~~
	~~''state''~~ <~~math~~>~~\gets</math> InitState~~()
	~~''state'' <math>\gets</math> ExpandKey(''state'', ''salt'', ''key'')~~
	~~'''repeat''' (2<sup>''cost''</sup>)~~
	~~''state'' <math>\gets</math> ExpandKey(state, 0, key)~~
	~~''state'' <math>\gets</math> ExpandKey(state, 0, salt)~~
	~~'''return''' ''state''~~

	~~InitState works as in the original Blowfish algorithm, populating the P-array and S-box entries with the fractional part of <math>\pi</math> in hexadecimal.~~

	~~The ExpandKey function does the following:~~
	~~ExpandKey(''state'', ''salt'', ''key'')~~
	~~for(''n'' = 1..18)~~
	~~P<sub>n</sub> <math>\gets</math> ''key''[32(n-1)..32n-1] <math>\oplus</math> P<sub>n</sub> //treat the key as cyclic~~
	~~''ctext'' <math>\gets</math> Encrypt(''salt''[0..63])~~
	~~P<sub>1</sub> <math>\gets</math> ''ctext''[0..31]~~
	~~P<sub>2</sub> <math>\gets</math> ''ctext''[32..63]~~
	~~for(''n'' = 2..9)~~
	~~''ctext'' <math>\gets</math> Encrypt(''ctext'' <math>\oplus</math> ''salt''[64(n-1)..64n-1]) //encrypt using the current key schedule and treat the salt as cyclic~~
	~~P<sub>2n-1)</sub> <math>\gets</math> ''ctext''[0..31]~~
	~~P<sub>2n</sub> <math>\gets</math> ''ctext''[32..63]~~
	~~for(''i'' = 1..4)~~
	~~for(''n'' = 0..127)~~
	~~''ctext'' <math>\gets</math> Encrypt(''ctext'' <math>\oplus</math> ''salt''[64(n-1)..64n-1]) //as above~~
	~~S<sub>i</sub>[2n] <math>\gets</math> ''ctext''[0..31]~~
	~~S<sub>i</sub>[2n+1] <math>\gets</math> ''ctext''[32..63]~~
	~~'''return''' ''state''~~

	~~Hence, <code>ExpandKey(''state'', 0, ''key'')</code> is the same as regular Blowfish key schedule since all XORs with the all-zero salt value~~ are ~~ineffectual. <code>ExpandKey(''state'', 0, ''salt'')</code> is similar, but uses the salt as a 128-bit key.~~

	~~The full bcrypt algorithm utilizes these functions~~ to ~~compute a hash from a given input derived from the password, as follows:~~
	~~bcrypt(''cost'', ''salt'', ''input''~~)
	~~''state'' <math>\gets</math> EksBlowfishSetup(''cost''~~, ~~''salt'', ''input'')~~
	~~''ctext'' <math>\gets</math> "OrpheanBeholderScryDoubt" //three 64-bit blocks~~
	~~'''repeat''' (64)~~
	~~''ctext'' <math>\gets</math> EncryptECB(''state'', ''ctext'') //encrypt using standard Blowfish in ECB mode~~
	~~'''return''' Concatenate(''cost'', ''salt'', ''ctext'')~~

	~~Mapping of password to input is unspecified in the original revision of bcrypt. Implementations have varied, including sometime reducing the strength of passwords containing special characters~~. <~~small~~>~~See e.g. [http://www.mindrot.org/files/jBCrypt/internat.adv Feb 1, 2010 jBCrypt security advisory] or [http://php.net/security/crypt_blowfish.php Changes in CRYPT_BLOWFISH in PHP 5.3.7].~~<~~/small~~>

	~~==See also==~~
	~~{{Portal box\|Cryptography\|Free software}}~~
	*[[Crypt_(C)#Blowfish-based_scheme\|crypt - password storage and verification scheme - Blowfish]]
	*[[scrypt]]
	*[[Key stretching]]
	*[[PBKDF2\|PBKDF2 (Password-Based Key Derivation Function 2)]]

	~~==References==~~
	~~{{Reflist}}~~

	~~==External links==~~
	*[http://openwall.com/crypt/ Openwall C implementation]
	*[http://www.mindrot.org/projects/jBCrypt/ jBCrypt - bcrypt implementation for Java]
	*[http://static.springsource.org/spring-security/site/downloads.html Spring Security (3.1.x) implements bcrypt in Java based on code from jBCrypt]
	*[https:~~//code.google.com/p/go/source/browse/bcrypt/bcrypt.go?repo=crypto bcrypt.go - bcrypt implementation for Go]~~
	*[http://code.google.com/p/py-bcrypt/ py-bcrypt - bcrypt implementation for Python]
	*[http://bcrypt.codeplex.com/ BCrypt.Net- bcrypt implementation in C# for .NET]
	*[http://www.zer7.com/software.php?page=cryptsharp CryptSharp - bcrypt and other crypt algorithms for .NET]
	*[http://www.~~jayfuerstenberg.com/blog/bcrypt-in-objective-c JFBCrypt - bcrypt implementation for Objective C]~~
	*[http://bcrypt-ruby.rubyforge.org/ ~~bcrypt-ruby - bcrypt implementation for Ruby]~~
	*[https://metacpan.org/module/Crypt::Eksblowfish::Bcrypt Crypt::Eksblowfish::Bcrypt - bcrypt implementation for Perl]
	*[https://github.com/ncb000gt/node.bcrypt.js/ bcrypt.js - a bcrypt implementation for node.js]
	*[http://code.google.com/p/javascript-bcrypt/ jsBCrypt - a bcrypt implementation for JavaScript]
	*[http://bcrypt.sourceforge.net bcrypt file encryption program homepage] - '''bcrypt''' is also the name of a cross-[[Platform (computing)\|platform]] file [[encryption]] utility implementing the [[Blowfish (cipher)\|Blowfish]] [[cipher]], developed in 2002.
	*[http://php.net/manual/en/function.password-hash.php PHP 5.5.x password_hash uses the bcrypt algorithm as default]
	*[http://www.openwall.com/phpass/ The Portable PHP password hashing framework contains an implementation of bcrypt for PHP]
	* [https://github.com/Erly/dbcrypt dBCrypt - a bcrypt implementation for Dart based on code from jBCrypt]

	~~[[Category:Cryptography]]~~
	~~[[Category:Cryptographic software]]~~
	~~[[Category:Computer access control protocols]]~~
	~~[[Category:Key derivation functions]~~]

94.4.91.249 at 23:24, 22 October 2011

2011-10-22T23:24:10Z

New page

{{multiple issues|
{{lead too long|date=October 2013}}
{{external links|date=August 2013}}
{{ref improve|date=August 2013}}}}
{{lowercase|title=bcrypt}}

'''bcrypt''' is a [[key derivation function]] for [[password]]s designed by [[Niels Provos]] and [[David Mazières]], based on the [[Blowfish (cipher)|Blowfish]] cipher, and presented at [[USENIX]] in 1999.<ref>{{cite journal | url = http://www.usenix.org/events/usenix99/provos/provos_html/node1.html | title = A Future-Adaptable Password Scheme | first = Niels | last = Provos | coauthors = Mazières, David | year = 1999 | coauthors = Talan Jason Sutton 2012 | journal = Proceedings of 1999 USENIX Annual Technical Conference | pages = 81–92}}</ref> Besides incorporating a [[Salt (cryptography)|salt]] to protect against [[rainbow table]] attacks, bcrypt is an adaptive function: over time, the iteration count can be increased to make it slower, so it remains resistant to [[brute-force search]] attacks even with increasing computation power.

Blowfish is notable among block ciphers for its expensive key setup phase. It starts off with subkeys in a standard state, then uses this state to perform a block encryption using part of the key, and uses the result of that encryption (which is more accurately a hashing) to replace some of the subkeys. Then it uses this modified state to encrypt another part of the key, and uses the result to replace more of the subkeys. It proceeds in this fashion, using a progressively modified state to hash the key and replace bits of state, until all subkeys have been set.

Provos and Mazières took advantage of this, and took it further. They developed a new key setup algorithm for Blowfish, dubbing the resulting cipher "Eksblowfish" ("expensive key schedule Blowfish"). The key setup begins with a modified form of the standard Blowfish key setup, in which both the salt and password are used to set all subkeys. There are then a number of rounds in which the standard Blowfish keying algorithm is applied, using alternately the salt and the password as the key, each round starting with the subkey state from the previous round. Cryptotheoretically, this is no stronger than the standard Blowfish key schedule, but the number of rekeying rounds is configurable; this process can therefore be made arbitrarily slow, which helps deter brute-force attacks upon the hash or salt.

The iteration count is a power of two, which is an input to the algorithm. The number is encoded in the textual result.

There are implementations of bcrypt for Ruby, Python, C, C#, Perl, PHP, Java and other languages.

==Algorithm==
The bcrypt algorithm depends heavily on its "Eksblowfish" key setup algorithm, which runs as follows:
EksBlowfishSetup(''cost'', ''salt'', ''key'')
''state'' <math>\gets</math> InitState()
''state'' <math>\gets</math> ExpandKey(''state'', ''salt'', ''key'')
'''repeat''' (2''cost'')
''state'' <math>\gets</math> ExpandKey(state, 0, key)
''state'' <math>\gets</math> ExpandKey(state, 0, salt)
'''return''' ''state''

InitState works as in the original Blowfish algorithm, populating the P-array and S-box entries with the fractional part of <math>\pi</math> in hexadecimal.

The ExpandKey function does the following:
ExpandKey(''state'', ''salt'', ''key'')
for(''n'' = 1..18)
Pn <math>\gets</math> ''key''[32(n-1)..32n-1] <math>\oplus</math> Pn //treat the key as cyclic
''ctext'' <math>\gets</math> Encrypt(''salt''[0..63])
P1 <math>\gets</math> ''ctext''[0..31]
P2 <math>\gets</math> ''ctext''[32..63]
for(''n'' = 2..9)
''ctext'' <math>\gets</math> Encrypt(''ctext'' <math>\oplus</math> ''salt''[64(n-1)..64n-1]) //encrypt using the current key schedule and treat the salt as cyclic
P2n-1) <math>\gets</math> ''ctext''[0..31]
P2n <math>\gets</math> ''ctext''[32..63]
for(''i'' = 1..4)
for(''n'' = 0..127)
''ctext'' <math>\gets</math> Encrypt(''ctext'' <math>\oplus</math> ''salt''[64(n-1)..64n-1]) //as above
Si[2n] <math>\gets</math> ''ctext''[0..31]
Si[2n+1] <math>\gets</math> ''ctext''[32..63]
'''return''' ''state''

Hence, <code>ExpandKey(''state'', 0, ''key'')</code> is the same as regular Blowfish key schedule since all XORs with the all-zero salt value are ineffectual. <code>ExpandKey(''state'', 0, ''salt'')</code> is similar, but uses the salt as a 128-bit key.

The full bcrypt algorithm utilizes these functions to compute a hash from a given input derived from the password, as follows:
bcrypt(''cost'', ''salt'', ''input'')
''state'' <math>\gets</math> EksBlowfishSetup(''cost'', ''salt'', ''input'')
''ctext'' <math>\gets</math> "OrpheanBeholderScryDoubt" //three 64-bit blocks
'''repeat''' (64)
''ctext'' <math>\gets</math> EncryptECB(''state'', ''ctext'') //encrypt using standard Blowfish in ECB mode
'''return''' Concatenate(''cost'', ''salt'', ''ctext'')

Mapping of password to input is unspecified in the original revision of bcrypt. Implementations have varied, including sometime reducing the strength of passwords containing special characters. See e.g. [http://www.mindrot.org/files/jBCrypt/internat.adv Feb 1, 2010 jBCrypt security advisory] or [http://php.net/security/crypt_blowfish.php Changes in CRYPT_BLOWFISH in PHP 5.3.7].

==See also==
{{Portal box|Cryptography|Free software}}
*[[Crypt_(C)#Blowfish-based_scheme|crypt - password storage and verification scheme - Blowfish]]
*[[scrypt]]
*[[Key stretching]]
*[[PBKDF2|PBKDF2 (Password-Based Key Derivation Function 2)]]

==References==
{{Reflist}}

==External links==
*[http://openwall.com/crypt/ Openwall C implementation]
*[http://www.mindrot.org/projects/jBCrypt/ jBCrypt - bcrypt implementation for Java]
*[http://static.springsource.org/spring-security/site/downloads.html Spring Security (3.1.x) implements bcrypt in Java based on code from jBCrypt]
*[https://code.google.com/p/go/source/browse/bcrypt/bcrypt.go?repo=crypto bcrypt.go - bcrypt implementation for Go]
*[http://code.google.com/p/py-bcrypt/ py-bcrypt - bcrypt implementation for Python]
*[http://bcrypt.codeplex.com/ BCrypt.Net- bcrypt implementation in C# for .NET]
*[http://www.zer7.com/software.php?page=cryptsharp CryptSharp - bcrypt and other crypt algorithms for .NET]
*[http://www.jayfuerstenberg.com/blog/bcrypt-in-objective-c JFBCrypt - bcrypt implementation for Objective C]
*[http://bcrypt-ruby.rubyforge.org/ bcrypt-ruby - bcrypt implementation for Ruby]
*[https://metacpan.org/module/Crypt::Eksblowfish::Bcrypt Crypt::Eksblowfish::Bcrypt - bcrypt implementation for Perl]
*[https://github.com/ncb000gt/node.bcrypt.js/ bcrypt.js - a bcrypt implementation for node.js]
*[http://code.google.com/p/javascript-bcrypt/ jsBCrypt - a bcrypt implementation for JavaScript]
*[http://bcrypt.sourceforge.net bcrypt file encryption program homepage] - '''bcrypt''' is also the name of a cross-[[Platform (computing)|platform]] file [[encryption]] utility implementing the [[Blowfish (cipher)|Blowfish]] [[cipher]], developed in 2002.
*[http://php.net/manual/en/function.password-hash.php PHP 5.5.x password_hash uses the bcrypt algorithm as default]
*[http://www.openwall.com/phpass/ The Portable PHP password hashing framework contains an implementation of bcrypt for PHP]
* [https://github.com/Erly/dbcrypt dBCrypt - a bcrypt implementation for Dart based on code from jBCrypt]

[[Category:Cryptography]]
[[Category:Cryptographic software]]
[[Category:Computer access control protocols]]
[[Category:Key derivation functions]]