27/05/2015 - bcrypt

Clare

You might have noticed that you had to login to Lewd again, that is because I have changed the password hashing algorithm to the "more secure" bcrypt algorithm.

Logging in will convert your hash from the default algorithm to bcrypt.

Bcrypt is a lot slower than md5, thus making it a lot harder to bruteforce if our database ever happens to end up in the wrong hands.

If you find anything wrong with the system, please let me know.

Akame

Thanks senpai! ~

Yagmi

[size=x-large]Why not just use MD5.salt?[/size]

Because it calcuates fast as fuck compared to Bcrypt, modern systems can check 330MB of MD5 hashes every second.
Meanwhile our boss Bcrypt fat as fuck, slow as fuck.

Let's look at the two methods and how fast they generate hashes.

[size=small][font=Monaco, Consolas, Courier, monospace]MD5 ~ 0.008s[/font][/size]
[size=small][font=Monaco, Consolas, Courier, monospace]BCrypt ~ 0.012s // That's 1.5 times slower than MD5, which is good.[/font][/size]

This was calcuated with work factor of 9 which can be edited based on your server performance, so it can be even slower if you so decided to do so.

Why is slow good you might ask?
It means that when the cracker who obtained the hashes wants to crack your passwords.
They are basically going to try to recreate the hash with as many different inputs/passwords as possible (either brute force/mask or a dictionary attack).

Clare

Thanks Yagmi, that's a pretty good explanation.