Comeonin Bcrypt does not support the 2y prefix?

[hariharasudhan94]

I have a set passwords which have $2y$ prefix. When i trying to check password using Comeonin.Bcrypt.checkpw("hard to guess", stored_hash) , I am getting error like Comeonin Bcrypt does not support the 2y prefix, how can i resolve this issue

[David Whitlock]

The $2y$ prefix is provided by another version of Bcrypt (not the OpenBSD version), and it's not supported. There's also no plan to support it.

[hariharasudhan94]

Is there any other option or libraries, i can try right now?

[David Whitlock]

I don't know anything in Elixir or Erlang that supports the $2y$ prefix.

[Hubert Łępicki]

@riverrun as far as I understand, $2y$ does not mark any incompatible algorithm. It is equal to $2a$.

PHP people had a bug in their implementation, and used special prefix $2x$ to mark hashes generated with broken implementation. Then, they decided that it's good idea to introcudce $2y$, to distinguish from possibly broken $2a$ they may have in database, and definitely broken $2x$.

So, in a nutshell, hashes with $2y$ could be treated as $2a$ and we should raise instead on prefix $2x$ that is indeed most likely wrong.

[David Whitlock]

The $2y$ prefix is part of the Openwall implementation, and according to their bcrypt page, it should be compatible with the $2b$ prefix from the OpenBSD version.

However, before I make any change, I obviously need to do a certain amount of research to decide how best to approach it. At the moment, I don't have the time to do that, but if there is a demand for $2y$ prefix support, I can make the time.

I hope that answers your questions.

[Hubert Łępicki]

I'm not sure if this should be supported to be fair.

Maybe we simply need better error message saying that this prefix is not supported, and you should replace it with compatible $2b$ one.

[David Whitlock]

I could look into improving the error message.

[Ryan Winchester]

@riverrun

For what it's worth, this works for me:

  Comeonin.Bcrypt.checkpw(password, fix_prefix(password_hash))

  defp fix_prefix("$2y" <> rest), do: "$2b" <> rest
  defp fix_prefix(password_hash), do: password_hash