Hacker News Reader

bcrypt has a maximum input length of 72 bytes:

https://www.usenix.org/legacy/events/usenix99/provos/provos_...

I suppose one could split the input into 72 byte chunks, hash each chunk and then combine again. Either store that, or rinse-and-repeat until you end up with one final hash.

> I suppose one could split the input into 72 byte chunks, hash each chunk and then combine again

This sounds like a recipe for screwing something up and opening yourself up to some kind of weird attack. I'm not enough of a crypto expert to know what the downside of this would be but it's more mucking around with crypto that I would be comfortable with.

You should first SHA-512 the password (to get a uniformly-64-byte string) and then apply bcrypt to that.

Reply on news.ycombinator.com