问题描述
我正在处理带有 $2y 哈希的旧数据库.我对此进行了一些研究,还偶然发现了 堆栈溢出$2a 和 $2y 的区别.
I'm dealing with an old database with $2y hashes. I've dug into this a bit, also stumbled on the stack overflow on the difference between $2a and $2y.
我查看了 bcrypt 的节点模块这似乎只生成和比较 $2a 哈希.
- https://github.com/ncb000gt/node.bcrypt.js/issues/175
- https://github.com/ncb000gt/node.bcrypt.js/issues/349
- https://github.com/ncb000gt/node.bcrypt.js/issues/213
我找到了一个生成 $2y 哈希值的网站,因此我可以使用 bcrypt 对其进行测试.
I found a website that generates $2y hashes so I can test them with bcrypt.
- http://www.51sjk.com/Upload/Articles/1/0/332/332420_20221020161113542.html
这是字符串 helloworld 的 $2y 散列示例.
Here's an example of a $2y hash of the string helloworld.
helloworld:$2y$10$tRM7x9gGKhcAmpeqKEdhj.qRWCr4qoV1FU9se0Crx2hkMVNL2ktEW
似乎模块无法验证 $2y 哈希值.
Seems the module has no way of validating $2y hashes.
这是我的测试.
var Promise = require('bluebird') var bcrypt = require('bcrypt') var string = 'helloworld' Promise.promisifyAll(bcrypt) // bcrypt.genSalt(10, function(err, salt) { // bcrypt.hash(string, salt, function(err, hash) { // console.log(hash) // }) // }) var hashesGeneratedUsingBcryptModule = [ '$2a$10$6ppmIdlNEPwxWJskPaQ7l.d2fblh.GO6JomzrcpiD/hxGPOXA3Bsq', '$2a$10$YmpoYCDHzdAPMbd9B8l48.hkSnylnAPbOym367FKIEPa0ixY.o4b.', '$2a$10$Xfy3OPurrZEmbmmO0x1wGuFMdRTlmOgEMS0geg4wTj1vKcvXXjk06', '$2a$10$mYgwmdPZjiEncp7Yh5UB1uyPkoyavxrYcOIzzY4mzSniGpI9RbhL.', '$2a$10$dkBVTe2A2DAn24PUq1GZYe7AqL8WQqwOi8ZWBJAauOg60sk44DkOC' ] var hashesGeneratedUsingAspirineDotOrg = [ '$2y$10$MKgpAXLJkwx5tpijWX99Qek2gf/irwvp5iSfxuFoDswIjMIbj2.Ma', '$2y$10$tRM7x9gGKhcAmpeqKEdhj.qRWCr4qoV1FU9se0Crx2hkMVNL2ktEW' ] var hashesGeneratedUsingAspirineDotOrgSwippedYForA = [ '$2a$10$MKgpAXLJkwx5tpijWX99Qek2gf/irwvp5iSfxuFoDswIjMIbj2.Ma', '$2a$10$tRM7x9gGKhcAmpeqKEdhj.qRWCr4qoV1FU9se0Crx2hkMVNL2ktEW' ] hashesGeneratedUsingBcryptModule = hashesGeneratedUsingBcryptModule.map(hash => bcrypt.compareAsync(string, hash)) hashesGeneratedUsingAspirineDotOrg = hashesGeneratedUsingAspirineDotOrg.map(hash => bcrypt.compareAsync(string, hash)) hashesGeneratedUsingAspirineDotOrgSwippedYForA = hashesGeneratedUsingAspirineDotOrgSwippedYForA.map(hash => bcrypt.compareAsync(string, hash)) Promise.all(hashesGeneratedUsingBcryptModule) .tap(() => console.log('hashesGeneratedUsingBcryptModule')) .then(console.log) Promise.all(hashesGeneratedUsingAspirineDotOrg) .tap(() => console.log('hashesGeneratedUsingAspirineDotOrg')) .then(console.log) Promise.all(hashesGeneratedUsingAspirineDotOrgSwippedYForA) .tap(() => console.log('hashesGeneratedUsingAspirineDotOrgSwippedYForA')) .then(console.log)
结果如下:
// hashesGeneratedUsingAspirineDotOrg // [ false, false ] // hashesGeneratedUsingBcryptModule // [ true, true, true, true, true ] // hashesGeneratedUsingAspirineDotOrgSwippedYForA // [ false, false ]
我对如何比较节点中的 $2y 哈希感到困惑.
I'm stumped on how I can compare $2y hashes in node.
另一个 Stack Overflow 问题/答案说您可以更改 $2y到 $2a 但这对我来说仍然失败.
There's another Stack Overflow question / answer that says you can just change the $2y to $2a but that still fails for me.
更新!
我错误地使用了 生成器,因为它是一个 .htpasswd 密码生成器,您必须以这种格式输入用户名和密码.
I was using the generator incorrectly because it's a .htpasswd password generator you have to put in the username and password in this format.
reggi helloworld
并且输出对应这里:
reggi:$2y$10$iuC7GYH/h1Gl1aDmcpLFpeJXN9OZXZUYnaqD2NnGLQiVGQYBDtbtO
之前我只是放了
helloword
我假设散列一个空字符串.
Which I'm assuming hashed a empty string.
通过这些更改,将 y 更改为 a 可以在 bcrypt 中使用.twin-bcrypt 就可以了.
With these changes changing the y to an a works in bcrypt. And twin-bcrypt just works.
推荐答案
- 使用 bcrypt 时,将 y 更改为 a.
- 当使用 twin-bcrypt 时,哈希就可以工作.
- When using bcrypt change the y to an a.
- When using twin-bcrypt the hash just works.
使用 http://www.51sjk.com/Upload/Articles/1/0/332/332420_20221020161113542.html 时,请确保提供用户名和密码.
When using http://www.51sjk.com/Upload/Articles/1/0/332/332420_20221020161113542.html make sure that you provide a username and password.
reggi helloworld
然后:
reggi:$2y$10$Am0Nf/B6.S/Wkpr6IVdIZeuHWNa/fqoLyTNmlyrSg22AjRf2vS.T.
这是一个使用 bcrypt 和 twin-bcrypt 的工作示例.
Here's a working example with both bcrypt and twin-bcrypt.
var twinBcrypt = require('twin-bcrypt') var bcrypt = require('bcrypt') var string = 'helloworld' var bcryptAttempt = bcrypt.compareSync(string, "$2y$10$Am0Nf/B6.S/Wkpr6IVdIZeuHWNa/fqoLyTNmlyrSg22AjRf2vS.T.".replace(/^$2y/, "$2a")) console.log(bcryptAttempt) var twinBcryptAttempt = twinBcrypt.compareSync(string, "$2y$10$Am0Nf/B6.S/Wkpr6IVdIZeuHWNa/fqoLyTNmlyrSg22AjRf2vS.T.") console.log(twinBcryptAttempt)
输出:
true true