Does anyone know of a good impl of bcrypt, I know this question has been asked before but it got very little response. Im a bit unsure of just picking an impl that turns up in google and am thinking that I may be better off using sha256 impl in the System.Security.Cryptography namespace, at least then I know it's supported! What are you thoughts?
+6
A:
It sounds like you are looking for BCrypt.net:
BCrypt.net is an implementation of OpenBSD's Blowfish-based password hashing code, described in "A Future-Adaptable Password Scheme" by Niels Provos and David Mazières. It is a direct port of jBCrypt by Damien Miller, and is thus released under the same BSD-style license. The code is fully managed and should work with any little-endian CLI implementation -- it has been tested with Microsoft .NET and Mono.
amdfan
2009-05-16 22:02:12
Yes, that was the one I found with Google also. Do you use it, or do you know if it's widely used?
Gareth
2009-05-17 06:54:55
Haven't used BCrypt, but judging from references from other internet sites, it looks like this implementation is really good. However, unless you have a pressing need to use BCrypt specifically, why not just go with the built-in SHA256 or SHA512?
amdfan
2009-05-17 19:35:19
The reason I thought about using BCrypt was because of this article http://www.matasano.com/log/958/enough-with-the-rainbow-tables-what-you-need-to-know-about-secure-password-schemes/ and it claimed BCrypt is the way to go.
Gareth
2009-05-19 09:11:54
Roger that. That article is the same reason I gooogled bcrypt for .NET and came to this question on stackoverflow. Specifically, from the article, you shouldn't use SHA256 or SHA512 because those are both optimized for SPEED, and a password generating hash should be SLOW, or TAKE A LONG TIME.
Adam Nofsinger
2009-06-13 16:02:22
Just wanted to add a note that if you are using BCrypt.net on Windows Server 2008 you'll need to name it something other than BCrypt.dll or it will conflict with the new Windows API in Vista that calls functions in a 'bcrypt.dll', so if you have Bcrypt.net as Bcrypt.dll in your web app bin/ directory Windows won't be able to find the correct dll and you will get some cryptic errors.
thelsdj
2010-04-03 17:47:02