問題描述

我正在處理帶有 $2y 哈希的舊數據庫.我對此進行了一些研究，還偶然發現了 堆棧溢出$2a 和 $2y 的區別.

I'm dealing with an old database with $2y hashes. I've dug into this a bit, also stumbled on the stack overflow on the difference between $2a and $2y.

我查看了 bcrypt 的節點模塊這似乎只生成和比較 $2a 哈希.

• https://github.com/ncb000gt/node.bcrypt.js/issues/175
• https://github.com/ncb000gt/node.bcrypt.js/issues/349
• https://github.com/ncb000gt/node.bcrypt.js/issues/213

我找到了一個生成 $2y 哈希值的網站，因此我可以使用 bcrypt 對其進行測試.

I found a website that generates $2y hashes so I can test them with bcrypt.

• http://aspirine.org/htpasswd_en.html

這是字符串 helloworld 的 $2y 散列示例.

Here's an example of a $2y hash of the string helloworld.

helloworld:$2y$10$tRM7x9gGKhcAmpeqKEdhj.qRWCr4qoV1FU9se0Crx2hkMVNL2ktEW

似乎模塊無法驗證 $2y 哈希值.

Seems the module has no way of validating $2y hashes.

這是我的測試.

var Promise = require('bluebird')
var bcrypt = require('bcrypt')

var string = 'helloworld'

Promise.promisifyAll(bcrypt)

// bcrypt.genSalt(10, function(err, salt) {
//   bcrypt.hash(string, salt, function(err, hash) {
//     console.log(hash)
//   })
// })

var hashesGeneratedUsingBcryptModule = [
  '$2a$10$6ppmIdlNEPwxWJskPaQ7l.d2fblh.GO6JomzrcpiD/hxGPOXA3Bsq',
  '$2a$10$YmpoYCDHzdAPMbd9B8l48.hkSnylnAPbOym367FKIEPa0ixY.o4b.',
  '$2a$10$Xfy3OPurrZEmbmmO0x1wGuFMdRTlmOgEMS0geg4wTj1vKcvXXjk06',
  '$2a$10$mYgwmdPZjiEncp7Yh5UB1uyPkoyavxrYcOIzzY4mzSniGpI9RbhL.',
  '$2a$10$dkBVTe2A2DAn24PUq1GZYe7AqL8WQqwOi8ZWBJAauOg60sk44DkOC'
]

var hashesGeneratedUsingAspirineDotOrg = [
  '$2y$10$MKgpAXLJkwx5tpijWX99Qek2gf/irwvp5iSfxuFoDswIjMIbj2.Ma',
  '$2y$10$tRM7x9gGKhcAmpeqKEdhj.qRWCr4qoV1FU9se0Crx2hkMVNL2ktEW'
]

var hashesGeneratedUsingAspirineDotOrgSwippedYForA = [
  '$2a$10$MKgpAXLJkwx5tpijWX99Qek2gf/irwvp5iSfxuFoDswIjMIbj2.Ma',
  '$2a$10$tRM7x9gGKhcAmpeqKEdhj.qRWCr4qoV1FU9se0Crx2hkMVNL2ktEW'
]

hashesGeneratedUsingBcryptModule = hashesGeneratedUsingBcryptModule.map(hash => bcrypt.compareAsync(string, hash))
hashesGeneratedUsingAspirineDotOrg = hashesGeneratedUsingAspirineDotOrg.map(hash => bcrypt.compareAsync(string, hash))
hashesGeneratedUsingAspirineDotOrgSwippedYForA = hashesGeneratedUsingAspirineDotOrgSwippedYForA.map(hash => bcrypt.compareAsync(string, hash))

Promise.all(hashesGeneratedUsingBcryptModule)
.tap(() => console.log('hashesGeneratedUsingBcryptModule'))
.then(console.log)

Promise.all(hashesGeneratedUsingAspirineDotOrg)
.tap(() => console.log('hashesGeneratedUsingAspirineDotOrg'))
.then(console.log)

Promise.all(hashesGeneratedUsingAspirineDotOrgSwippedYForA)
.tap(() => console.log('hashesGeneratedUsingAspirineDotOrgSwippedYForA'))
.then(console.log)

結果如下:

// hashesGeneratedUsingAspirineDotOrg
// [ false, false ]
// hashesGeneratedUsingBcryptModule
// [ true, true, true, true, true ]
// hashesGeneratedUsingAspirineDotOrgSwippedYForA
// [ false, false ]

我對如何比較節點中的 $2y 哈希感到困惑.

I'm stumped on how I can compare $2y hashes in node.

另一個 Stack Overflow 問題/答案說您可以更改 $2y到 $2a 但這對我來說仍然失敗.

There's another Stack Overflow question / answer that says you can just change the $2y to $2a but that still fails for me.

更新！

我錯誤地使用了 生成器，因為它是一個 .htpasswd 密碼生成器，您必須以這種格式輸入用戶名和密碼.

I was using the generator incorrectly because it's a .htpasswd password generator you have to put in the username and password in this format.

reggi helloworld

并且輸出對應這里:

reggi:$2y$10$iuC7GYH/h1Gl1aDmcpLFpeJXN9OZXZUYnaqD2NnGLQiVGQYBDtbtO

之前我只是放了

helloword

我假設散列一個空字符串.

Which I'm assuming hashed a empty string.

通過這些更改，將 y 更改為 a 可以在 bcrypt 中使用.twin-bcrypt 就可以了.

With these changes changing the y to an a works in bcrypt. And twin-bcrypt just works.

推薦答案

• 使用 bcrypt 時，將 y 更改為 a.
• 當使用 twin-bcrypt 時，哈希就可以工作.
• When using bcrypt change the y to an a.
• When using twin-bcrypt the hash just works.

使用 http://aspirine.org/htpasswd_en.html 時，請確保提供用戶名和密碼.

When using http://aspirine.org/htpasswd_en.html make sure that you provide a username and password.

reggi helloworld

然后:

reggi:$2y$10$Am0Nf/B6.S/Wkpr6IVdIZeuHWNa/fqoLyTNmlyrSg22AjRf2vS.T.

這是一個使用 bcrypt 和 twin-bcrypt 的工作示例.

Here's a working example with both bcrypt and twin-bcrypt.

var twinBcrypt = require('twin-bcrypt')
var bcrypt = require('bcrypt')

var string = 'helloworld'

var bcryptAttempt = bcrypt.compareSync(string, "$2y$10$Am0Nf/B6.S/Wkpr6IVdIZeuHWNa/fqoLyTNmlyrSg22AjRf2vS.T.".replace(/^$2y/, "$2a"))
console.log(bcryptAttempt)

var twinBcryptAttempt = twinBcrypt.compareSync(string, "$2y$10$Am0Nf/B6.S/Wkpr6IVdIZeuHWNa/fqoLyTNmlyrSg22AjRf2vS.T.")
console.log(twinBcryptAttempt)

輸出:

true
true

這篇關于Node.js 中的 $2y bcrypt 哈希的文章就介紹到這了，希望我們推薦的答案對大家有所幫助，也希望大家多多支持html5模板網！

【網站聲明】本站部分內容來源于互聯網,旨在幫助大家更快的解決問題，如果有圖片或者內容侵犯了您的權益，請聯系我們刪除處理，感謝您的支持！