Node.js 中的 $2y bcrypt 哈希

2022-01-10 00:00:00 node.js cryptography javascript bcrypt

我正在处理带有 $2y 哈希的旧数据库.我对此进行了一些研究，还偶然发现了 堆栈溢出$2a 和 $2y 的区别.

I'm dealing with an old database with $2y hashes. I've dug into this a bit, also stumbled on the stack overflow on the difference between $2a and $2y.

我查看了 bcrypt 的节点模块这似乎只生成和比较 $2a 哈希.

  • https://github.com/ncb000gt/node.bcrypt.js/issues/175
  • https://github.com/ncb000gt/node.bcrypt.js/issues/349
  • https://github.com/ncb000gt/node.bcrypt.js/issues/213

我找到了一个生成 $2y 哈希值的网站，因此我可以使用 bcrypt 对其进行测试.

I found a website that generates $2y hashes so I can test them with bcrypt.

  • http://aspirine.org/htpasswd_en.html

这是字符串 helloworld 的 $2y 散列示例.

Here's an example of a $2y hash of the string helloworld.

helloworld:$2y$10$tRM7x9gGKhcAmpeqKEdhj.qRWCr4qoV1FU9se0Crx2hkMVNL2ktEW

似乎模块无法验证 $2y 哈希值.

Seems the module has no way of validating $2y hashes.

这是我的测试.

var Promise = require('bluebird')
var bcrypt = require('bcrypt')

var string = 'helloworld'

Promise.promisifyAll(bcrypt)

// bcrypt.genSalt(10, function(err, salt) {
//   bcrypt.hash(string, salt, function(err, hash) {
//     console.log(hash)
//   })
// })

var hashesGeneratedUsingBcryptModule = [
  '$2a$10$6ppmIdlNEPwxWJskPaQ7l.d2fblh.GO6JomzrcpiD/hxGPOXA3Bsq',
  '$2a$10$YmpoYCDHzdAPMbd9B8l48.hkSnylnAPbOym367FKIEPa0ixY.o4b.',
  '$2a$10$Xfy3OPurrZEmbmmO0x1wGuFMdRTlmOgEMS0geg4wTj1vKcvXXjk06',
  '$2a$10$mYgwmdPZjiEncp7Yh5UB1uyPkoyavxrYcOIzzY4mzSniGpI9RbhL.',
  '$2a$10$dkBVTe2A2DAn24PUq1GZYe7AqL8WQqwOi8ZWBJAauOg60sk44DkOC'
]

var hashesGeneratedUsingAspirineDotOrg = [
  '$2y$10$MKgpAXLJkwx5tpijWX99Qek2gf/irwvp5iSfxuFoDswIjMIbj2.Ma',
  '$2y$10$tRM7x9gGKhcAmpeqKEdhj.qRWCr4qoV1FU9se0Crx2hkMVNL2ktEW'
]

var hashesGeneratedUsingAspirineDotOrgSwippedYForA = [
  '$2a$10$MKgpAXLJkwx5tpijWX99Qek2gf/irwvp5iSfxuFoDswIjMIbj2.Ma',
  '$2a$10$tRM7x9gGKhcAmpeqKEdhj.qRWCr4qoV1FU9se0Crx2hkMVNL2ktEW'
]

hashesGeneratedUsingBcryptModule = hashesGeneratedUsingBcryptModule.map(hash => bcrypt.compareAsync(string, hash))
hashesGeneratedUsingAspirineDotOrg = hashesGeneratedUsingAspirineDotOrg.map(hash => bcrypt.compareAsync(string, hash))
hashesGeneratedUsingAspirineDotOrgSwippedYForA = hashesGeneratedUsingAspirineDotOrgSwippedYForA.map(hash => bcrypt.compareAsync(string, hash))

Promise.all(hashesGeneratedUsingBcryptModule)
.tap(() => console.log('hashesGeneratedUsingBcryptModule'))
.then(console.log)

Promise.all(hashesGeneratedUsingAspirineDotOrg)
.tap(() => console.log('hashesGeneratedUsingAspirineDotOrg'))
.then(console.log)

Promise.all(hashesGeneratedUsingAspirineDotOrgSwippedYForA)
.tap(() => console.log('hashesGeneratedUsingAspirineDotOrgSwippedYForA'))
.then(console.log)

结果如下:

// hashesGeneratedUsingAspirineDotOrg
// [ false, false ]
// hashesGeneratedUsingBcryptModule
// [ true, true, true, true, true ]
// hashesGeneratedUsingAspirineDotOrgSwippedYForA
// [ false, false ]

我对如何比较节点中的 $2y 哈希感到困惑.

I'm stumped on how I can compare $2y hashes in node.

另一个 Stack Overflow 问题/答案说您可以更改 $2y到 $2a 但这对我来说仍然失败.

There's another Stack Overflow question / answer that says you can just change the $2y to $2a but that still fails for me.

更新！

我错误地使用了 生成器，因为它是一个 .htpasswd 密码生成器，您必须以这种格式输入用户名和密码.

I was using the generator incorrectly because it's a .htpasswd password generator you have to put in the username and password in this format.

reggi helloworld

并且输出对应这里:

reggi:$2y$10$iuC7GYH/h1Gl1aDmcpLFpeJXN9OZXZUYnaqD2NnGLQiVGQYBDtbtO

之前我只是放了

helloword

我假设散列一个空字符串.

Which I'm assuming hashed a empty string.

通过这些更改，将 y 更改为 a 可以在 bcrypt 中使用.twin-bcrypt 就可以了.

With these changes changing the y to an a works in bcrypt. And twin-bcrypt just works.

推荐答案

  • 使用 bcrypt 时，将 y 更改为 a.
  • 当使用 twin-bcrypt 时，哈希就可以工作.

    • When using bcrypt change the y to an a.
    • When using twin-bcrypt the hash just works.

      • 使用 http://aspirine.org/htpasswd_en.html 时，请确保提供用户名和密码.

      When using http://aspirine.org/htpasswd_en.html make sure that you provide a username and password.

      reggi helloworld

      然后:

      reggi:$2y$10$Am0Nf/B6.S/Wkpr6IVdIZeuHWNa/fqoLyTNmlyrSg22AjRf2vS.T.

      这是一个使用 bcrypt 和 twin-bcrypt 的工作示例.

      Here's a working example with both bcrypt and twin-bcrypt.

      var twinBcrypt = require('twin-bcrypt')
var bcrypt = require('bcrypt')

var string = 'helloworld'

var bcryptAttempt = bcrypt.compareSync(string, "$2y$10$Am0Nf/B6.S/Wkpr6IVdIZeuHWNa/fqoLyTNmlyrSg22AjRf2vS.T.".replace(/^$2y/, "$2a"))
console.log(bcryptAttempt)

var twinBcryptAttempt = twinBcrypt.compareSync(string, "$2y$10$Am0Nf/B6.S/Wkpr6IVdIZeuHWNa/fqoLyTNmlyrSg22AjRf2vS.T.")
console.log(twinBcryptAttempt)

      输出:

      true
true

相关文章