Bouncy Castle Provider 1.77 · org.bouncycastle.crypto.generators.BCrypt

Core of password hashing scheme Bcrypt, designed by Niels Provos and David Mazières, corresponds to the C reference implementation.

This implementation does not correspondent to the 1999 published paper "A Future-Adaptable Password Scheme" of Niels Provos and David Mazières, see: https://www.usenix.org/legacy/events/usenix99/provos/provos_html/node1.html. In contrast to the paper, the order of key setup and salt setup is reversed: state <- ExpandKey(state, 0, key) state <- ExpandKey(state, 0, salt) This corresponds to the OpenBSD reference implementation of Bcrypt.

Note

There is no successful cryptanalysis (status 2015), but the amount of memory and the band width of Bcrypt may be insufficient to effectively prevent attacks with custom hardware like FPGAs, ASICs

This implementation uses some parts of Bouncy Castle's BlowfishEngine.

Field Summary

Modifier and Type	Field and Description
private static final int[]	KP
private static final int[]	KS0
private static final int[]	KS1
private static final int[]	KS2
private static final int[]	KS3
private static final int[]	MAGIC_STRING
pack-priv static final int	MAGIC_STRING_LENGTH
pack-priv static final int	MAX_COST Maximum value of cost parameter (31 == 2,147,483,648)
pack-priv static final int	MAX_PASSWORD_BYTES Maximum size of password == max (unrestricted) size of Blowfish key
pack-priv static final int	MIN_COST Minimum value of cost parameter, equal to log2(bytes of salt)
private final int[]	P
private static final int	P_SZ
private static final int	ROUNDS
private final int[]	S
pack-priv static final int	SALT_SIZE_BYTES Size of the salt parameter in bytes
private static final int	SBOX_SK
private static final int	SBOX_SK2
private static final int	SBOX_SK3

Constructor Summary

Access	Constructor and Description
private	BCrypt()

Method Summary

Modifier and Type	Method and Description
private final void	cyclicXorKey(byte[] key)
private final byte[]	Returns: a 192 bit key deriveRawKey(int the cost factor, treated as an exponent of 2 cost, byte[] a 16 byte salt salt, byte[] the password psw) Derives a raw 192 bit Bcrypt key
private byte[]	encryptMagicString()
private int	F(int x)
public static byte[]	Returns: the output of the raw bcrypt operation: a 192 bit (24 byte) hash. generate(byte[] the password bytes (up to 72 bytes) to use for this invocation. pwInput, byte[] the 128 bit salt to use for this invocation. salt, int the bcrypt cost parameter. The cost of the bcrypt function grows as `2^cost`. Legal values are 4..31 inclusive. cost) Calculates the bcrypt hash of an input - note for processing general passwords you want to make sure the password is terminated in a manner similar to what is done by passwordToByteArray().
private void	initState()
public static byte[]	Returns: a byte representation of the password in UTF8 + trailing zero. passwordToByteArray(char[] the password to be encoded. password) Converts a character password to bytes incorporating the required trailing zero byte.
private void	processTable(int xl, int xr, int[] table)
private void	processTableWithSalt(int[] table, int[] salt32Bit, int iv1, int iv2)

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Field Detail

KP	back to summary
private static final int[] KP

KS0	back to summary
private static final int[] KS0

KS1	back to summary
private static final int[] KS1

KS2	back to summary
private static final int[] KS2

KS3	back to summary
private static final int[] KS3

MAGIC_STRING	back to summary
private static final int[] MAGIC_STRING

MAGIC_STRING_LENGTH	back to summary
pack-priv static final int MAGIC_STRING_LENGTH

MAX_COST	back to summary
pack-priv static final int MAX_COST Maximum value of cost parameter (31 == 2,147,483,648)

MAX_PASSWORD_BYTES	back to summary
pack-priv static final int MAX_PASSWORD_BYTES Maximum size of password == max (unrestricted) size of Blowfish key

MIN_COST	back to summary
pack-priv static final int MIN_COST Minimum value of cost parameter, equal to log2(bytes of salt)

P	back to summary
private final int[] P

P_SZ	back to summary
private static final int P_SZ

ROUNDS	back to summary
private static final int ROUNDS

S	back to summary
private final int[] S

SALT_SIZE_BYTES	back to summary
pack-priv static final int SALT_SIZE_BYTES Size of the salt parameter in bytes

SBOX_SK	back to summary
private static final int SBOX_SK

SBOX_SK2	back to summary
private static final int SBOX_SK2

SBOX_SK3	back to summary
private static final int SBOX_SK3

Constructor Detail

BCrypt	back to summary
private BCrypt()

Method Detail

cyclicXorKey	back to summary
private final void cyclicXorKey(byte[] key)

deriveRawKey	back to summary
private final byte[] deriveRawKey(int cost, byte[] salt, byte[] psw) Derives a raw 192 bit Bcrypt key Parameters cost:int the cost factor, treated as an exponent of 2 salt:byte[] a 16 byte salt psw:byte[] the password Returns:byte[] a 192 bit key

deriveRawKey

back to summary

private final byte[] deriveRawKey(int cost, byte[] salt, byte[] psw)

Derives a raw 192 bit Bcrypt key

Parameters

cost:int: the cost factor, treated as an exponent of 2
salt:byte[]: a 16 byte salt
psw:byte[]: the password

Returns:byte[]

a 192 bit key

encryptMagicString	back to summary
private byte[] encryptMagicString()

F	back to summary
private int F(int x)

generate back to summary

generate	back to summary
public static byte[] generate(byte[] pwInput, byte[] salt, int cost) Calculates the bcrypt hash of an input - note for processing general passwords you want to make sure the password is terminated in a manner similar to what is done by passwordToByteArray(). This implements the raw bcrypt function as defined in the bcrypt specification, not the crypt encoded version implemented in OpenBSD. Parameters pwInput:byte[] the password bytes (up to 72 bytes) to use for this invocation. salt:byte[] the 128 bit salt to use for this invocation. cost:int the bcrypt cost parameter. The cost of the bcrypt function grows as `2^cost`. Legal values are 4..31 inclusive. Returns:byte[] the output of the raw bcrypt operation: a 192 bit (24 byte) hash.

public static byte[] generate(byte[] pwInput, byte[] salt, int cost)

Calculates the bcrypt hash of an input - note for processing general passwords you want to make sure the password is terminated in a manner similar to what is done by passwordToByteArray().

This implements the raw bcrypt function as defined in the bcrypt specification, not the crypt encoded version implemented in OpenBSD.

Parameters

pwInput:byte[]: the password bytes (up to 72 bytes) to use for this invocation.
salt:byte[]: the 128 bit salt to use for this invocation.
cost:int: the bcrypt cost parameter. The cost of the bcrypt function grows as 2^cost. Legal values are 4..31 inclusive.

Returns:byte[]

the output of the raw bcrypt operation: a 192 bit (24 byte) hash.

initState	back to summary
private void initState()

passwordToByteArray	back to summary
public static byte[] passwordToByteArray(char[] password) Converts a character password to bytes incorporating the required trailing zero byte. Parameters password:char[] the password to be encoded. Returns:byte[] a byte representation of the password in UTF8 + trailing zero.

passwordToByteArray

back to summary

public static byte[] passwordToByteArray(char[] password)

Converts a character password to bytes incorporating the required trailing zero byte.

Parameters

password:char[]: the password to be encoded.

Returns:byte[]

a byte representation of the password in UTF8 + trailing zero.

processTable	back to summary
private void processTable(int xl, int xr, int[] table)

processTableWithSalt	back to summary
private void processTableWithSalt(int[] table, int[] salt32Bit, int iv1, int iv2)

public final Class BCrypt

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail