Interoperability issue with PHP implementation (and others) when truncating long password

Hello,

Interoperability is quite important for us, since we have 4 different software developed in different languages (Java, C#, C++, PHP) using the same database.

We have detected a very serious interoperability issue with this library when dealing with long password (and truncating strategy).

If we generate a hash like this:

String hash = BCrypt.with(BCrypt.Version.VERSION_2Y, new SecureRandom(), LongPasswordStrategies.truncate()).hashToString(12, password.toCharArray());

With password =

password_longer_than_72_bytes_abcdefghijklmnopqrstuvwxyz0123456789_abcdefghijklmnopqrstuvwxyz0123456789

We obtain hash = $2y$12$BhmM4lJ91dMTHQoh3XgxY.QZg2j1EfH6DpiwmgufAAHImqCSvA/b.

If we take this hash and try to verify it using PHP (using password_verify()), the check will fail.

You can quickly try it using this handy online tool: https://bcrypt-generator.com

---

After looking into the code, we though that the issue could come from the truncating strategy. We tried overriding the MAX_PW_LENGTH_BYTE:

public static final int MAX_PW_LENGTH_BYTE = 72;

The new hash generated was $2y$12$wHUr.PTUQPb7.CsK/0jHq.G4m6uIiHinBDBsWf2/cnwwwANZceQYm

And this one works:

[Indigo744]

Thank you! I’ll look into it.

If you can wait a bit, we have some more tests coming in tomorrow.

[patrickfav]

#28 is merged