Answer the question
In order to leave comments, you need to log in
Compatibility of blowfish hashes 2a and 2y
Hashes are created in PHP and need to be checked in erlang.
The problem is that password_hash generates a password and notes that the $2y$
algorithm was used.
While https://github.com/smarkets/erlang-bcrypt makes hashes only $2a$
.
Apparently, 2y was introduced for compatibility when an erroneous implementation of this algorithm was discovered: seclists.org/oss-sec/2011/q2/632 .
I checked that if you replace $2y$ with $2a$ in a hash, then the hash is verified in erlang, but I'm not sure if this will work for all hashes.
Is the implementation of the blowfish algorithm in erlang-bcrypt correct, or how can I find out or check it?
Answer the question
In order to leave comments, you need to log in
Didn't find what you were looking for?
Ask your questionAsk a Question
731 491 924 answers to any question