Re: [PROPOSED] password_hash RFC - Implementing simplified password hashing functions

2012/7/12 Nikita Popov <nikita.ppv@gmail.com>: > On Thu, Jul 12, 2012 at 7:24 PM, Alex Aulbach <alex.aulbach@gmail.com> wrote: >> 1. The resulting string should have a version information. For example >> the first char. the example hash will look like >> "1$2y$07$usesomesillystringfore2uDLvp1Ii2e./U9C8sBjqp8I90dH6hi", >> instead of "$2y$07$usesomesillystringfore2uDLvp1Ii2e./U9C8sBjqp8I90dH6hi" > > See that 2y in the string? That's the version information. If a > different algorithm is used, a different string will be in there. This > also applies to changes to the algorithm itself. E.g. the 2y prefix is > already a modified version of the original bcrypt algorithm. > > Nikita Cool. "y" is the algorithm? I just ask to be sure. :) How do I know which version I'm using? Think about checking if I'm able to handle this version-hashes. Or other things like "generate a hash for version 1 instead of version 2, because I know what I'm doing". I mean: We can just fail with verify, but it would be sometimes great to know, why it fails. :) -- Alex Aulbach