Is jBCrypt 0.3 threadsafe?

Question

Question says it all really. Code can be found at the following link -> http://www.mindrot.org/projects/jBCrypt/

Answer 1

First, it's not documented as thread-safe, so for all intents and purposes, it's not. And, on further investigation, it's definitely not: An instance of BCrypt has mutable private fields P[] and S[] that represent the present keys, which are touched by multiple methods. It turns out that, while there are some instance fields, there is no instance of BCrypt exposed; it tries to do everything through static methods. It may not thread safe. It's small enough that, assuming you care and the author would accept, you could offer a patch to trivially convert it to provide separate, safe instances (edit to add: I have scrubbed it carefully and prepared a cleaner version, which I will send to the author...)

Second, in what manner do you want to use this in a multithreaded environment? It's not clear to me what you'd want to do in separate threads.

Answer 2

Jbcrpyt has a really poorly designed API, IMO. Everything done using static methods? You've got to be kidding!

In the light of the quality of the API design, I would be surprised if the author bothered to make the implementation thread-safe.