Skip to content
Snippets Groups Projects

Document a limitation in user-provided BCrypt salts

1 file
+ 1
0
Compare changes
  • Side-by-side
  • Inline
@@ -104,6 +104,7 @@ Bcrypt hashes have the format :samp:`$2a${rounds}${salt}{checksum}`, where:
* :samp:`{rounds}` is a cost parameter, encoded as 2 zero-padded decimal digits,
which determines the number of iterations used via :samp:`{iterations}=2**{rounds}` (rounds is 12 in the example).
* :samp:`{salt}` is a 22 character salt string, using the characters in the regexp range ``[./A-Za-z0-9]`` (``GhvMmNVjRW29ulnudl.Lbu`` in the example).
The last character should only be one of ``.Oeu``, to avoid warnings from BCrypt "Padding Bits" limitation.
* :samp:`{checksum}` is a 31 character checksum, using the same characters as the salt (``AnUtN/LRfe1JsBm1Xu6LE3059z5Tr8m`` in the example).
While BCrypt's basic algorithm is described in its design document [#f1]_,
Loading