Hacker News Reader

Comment by kijin | Hacker News Reader

A note about combining SHA512 with bcrypt: Don't feed the raw binary output of SHA512 into bcrypt. Use the hexadecimal or base64-encoded form instead. (Dropbox probably does this already, since they mention base64 in passing.)

bcrypt is known to choke on null bytes. Each SHA512 hash has a 25% chance of containing a null byte if you use the raw binary format.

Using hex or base64, of course, decreases the amount of entropy that you can fit into bcrypt's 72-byte limit. But you can still fit 288 to 432 bits of entropy in that space, which is more than enough for the foreseeable future.

View on HN

And that's what Django does in this case, though it uses SHA256 as the first step https://github.com/django/django/blob/master/django/contrib/...

What a strange thing to do. Is this due to some C-style string handling? Why should any hashing function treat input as text?

Thanks for the reminder. You could encode with a "base255" algorithm that just excludes the null byte to retain more entropy within 72 bytes.

http://stromberg.dnsalias.org/svn/base255/trunk/

Even hex-encoding for 288 bits of entropy is plenty good enough.

Much faster than all of those multiplications that invertibly maps 64 bytes to 65 bytes without nulls: replace first null with 255. Every later null, replace with the index of the previous null. Make the final byte the index of the last null (or 255 if no nulls were replaced). In this way, you've replaced the nulls with a linked list of the locations where nulls used to be. To invert the transformation, just start at the final byte and walk the linked list backward until you hit a 255. (You'd never do the inversion in practice, but the existence of the inversion algorithm proves that no entropy was discarded.)

Use the time saved by not doing base 255 conversion to increase your iteration count.

Any time you spend or save on these kinds of transformations is going to pale in comparison to the bcrypt step. It might not even amount to a single iteration.

It sounds like they do:

> For ease of elucidation, in the figure and below we omit any mention of binary encoding (base64).

Reply on news.ycombinator.com