英文:
Failing to verify existing password hashes with ruby BCrypt
问题
我目前遇到的问题是尝试在Ruby on Rails上针对现有数据库中的现有密码哈希实现身份验证。我确实有几个现有的明文密码可用,因此我知道一些明文/哈希对以验证该过程。
密码存储为$2a$12$xxxxyyyy
,因此我会假设它们是使用BCrypt算法进行哈希处理的(我可以安全地假设吗?)。当我尝试运行以下代码时:
password = ::BCrypt::Password.new("$2a$12$xxxxyyyy")
verify = password == "known_plaintext_password"
我总是得到验证的结果为false
。当我尝试使用相同的盐与原始密码手动生成哈希时,如下所示:
bcrypt = ::BCrypt::Password.new("$2a$12$xxxxyyyy")
::BCrypt::Engine.hash_secret("known_plaintext_password", bcrypt.salt)
结果实际上与原始哈希不同,尽管我期望哈希函数在使用相同的输入密码和盐时返回相同的哈希(再次,我可以安全地做出这种假设吗?)。
我不知道用于实现原始哈希处理的平台是什么,但我强烈怀疑它是在.NET中实现的。
在尝试验证密码时,我是否做错了什么?我个人期望在生成哈希之前对原始密码使用"pepper",我可以安全地做出这种假设吗,或者可能还有其他情况?不同的BCrypt算法实现之间是否存在可能的不兼容性?
英文:
I'm currently running into an issue trying to implement an authentication on Ruby on Rails against an existing database with existing password hashes. I do have a couple of existing plaintext passwords readily available, so I know a few plaintext/hash pairs to verify the process.
Passwords are stored as $2a$12$xxxxyyyy
, so I would assume that they are hashed using the BCrypt algorithm (can I really safely assume that?). When I now try to run
password = ::BCrypt::Password.new("$2a$12$xxxxyyyy")
verify = password == "known_plaintext_password"
I always end up getting false
for the verification. When I try to manually generate a hash using the same salt with the original password using
bcrypt = ::BCrypt::Password.new("$2a$12$xxxxyyyy")
::BCrypt::Engine.hash_secret("known_plaintext_password", bcrypt.salt)
the result actually differs from the original hash, though I would expect the hash function to return the same hash when called with the same input password and salt (again, can I safely make this assumption?).
I do not know which platform was used to implement the original hashing process, but I strongly suspect it to be implemented in .NET.
Am I doing something wrong here when trying to verify the password? I personaly would expect a pepper to be used on the original password before generating the hash, can I safely take this assumption, or might there be anything else going on? Are there possible incompatibilities between different implementations of the BCrypt algorith?
答案1
得分: 0
由于这里没有真正的答案,而我在此期间找到了解决方案,因此我将添加自己的答案供参考,如果其他人遇到相同的问题...
的确,密码是使用“pepper”(或您喜欢的“秘密盐”)进行哈希处理的。幸运的是,我能够获取到使用的秘密,将其添加为设备模型身份验证的参数后,可以对遗留数据进行身份验证。
英文:
Since there has been no real answer here, and I figured out the solution in the meantime I will add my own answer for reference if anyone else encounters the same problem...
It was indeed the case that the passwords were hashed using a pepper (or secret salt, if you prefer that terminology). Fortunately I was able to get the secret used, and after adding it as a parameter in the devise model authentication against the legacy data was working.
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库,让每个人都能够通过互相帮助和分享经验来进步。
评论