S
S
Sergey Beresnev2014-02-11 11:09:54
PHP
Sergey Beresnev, 2014-02-11 11:09:54

Compatibility of blowfish hashes 2a and 2y

Hashes are created in PHP and need to be checked in erlang.
The problem is that password_hash generates a password and notes that the $2y$algorithm was used.
While https://github.com/smarkets/erlang-bcrypt makes hashes only $2a$.
Apparently, 2y was introduced for compatibility when an erroneous implementation of this algorithm was discovered: seclists.org/oss-sec/2011/q2/632 .
I checked that if you replace $2y$ with $2a$ in a hash, then the hash is verified in erlang, but I'm not sure if this will work for all hashes.
Is the implementation of the blowfish algorithm in erlang-bcrypt correct, or how can I find out or check it?

Answer the question

In order to leave comments, you need to log in

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question