Botan 3.3.0
Crypto and TLS for C&
bcrypt.cpp
Go to the documentation of this file.
1/*
2* Bcrypt Password Hashing
3* (C) 2010,2018,2020 Jack Lloyd
4*
5* Botan is released under the Simplified BSD License (see license.txt)
6*/
7
8#include <botan/bcrypt.h>
9
10#include <botan/base64.h>
11#include <botan/rng.h>
12#include <botan/internal/blowfish.h>
13#include <botan/internal/ct_utils.h>
14#include <botan/internal/fmt.h>
15#include <botan/internal/parsing.h>
16
17namespace Botan {
18
19namespace {
20
21// Bcrypt uses a non-standard base64 alphabet
22uint8_t base64_to_bcrypt_encoding(uint8_t c) {
23 const auto is_ab = CT::Mask<uint8_t>::is_within_range(c, 'a', 'b');
24 const auto is_cz = CT::Mask<uint8_t>::is_within_range(c, 'c', 'z');
25 const auto is_CZ = CT::Mask<uint8_t>::is_within_range(c, 'C', 'Z');
26
27 const auto is_01 = CT::Mask<uint8_t>::is_within_range(c, '0', '1');
28 const auto is_29 = CT::Mask<uint8_t>::is_within_range(c, '2', '9');
29
30 const auto is_A = CT::Mask<uint8_t>::is_equal(c, 'A');
31 const auto is_B = CT::Mask<uint8_t>::is_equal(c, 'B');
32 const auto is_plus = CT::Mask<uint8_t>::is_equal(c, '+');
33 const auto is_slash = CT::Mask<uint8_t>::is_equal(c, '/');
34
35 uint8_t ret = 0x80;
36 ret = is_ab.select(c - 'a' + 'Y', ret);
37 ret = is_cz.select(c - 2, ret);
38 ret = is_CZ.select(c - 2, ret);
39 ret = is_01.select(c - '0' + 'y', ret);
40 ret = is_29.select(c - '2' + '0', ret);
41 ret = is_A.select('.', ret);
42 ret = is_B.select('/', ret);
43 ret = is_plus.select('8', ret);
44 ret = is_slash.select('9', ret);
45
46 return ret;
47}
48
49uint8_t bcrypt_encoding_to_base64(uint8_t c) {
50 const auto is_ax = CT::Mask<uint8_t>::is_within_range(c, 'a', 'x');
51 const auto is_yz = CT::Mask<uint8_t>::is_within_range(c, 'y', 'z');
52
53 const auto is_AX = CT::Mask<uint8_t>::is_within_range(c, 'A', 'X');
54 const auto is_YZ = CT::Mask<uint8_t>::is_within_range(c, 'Y', 'Z');
55 const auto is_07 = CT::Mask<uint8_t>::is_within_range(c, '0', '7');
56
57 const auto is_8 = CT::Mask<uint8_t>::is_equal(c, '8');
58 const auto is_9 = CT::Mask<uint8_t>::is_equal(c, '9');
59 const auto is_dot = CT::Mask<uint8_t>::is_equal(c, '.');
60 const auto is_slash = CT::Mask<uint8_t>::is_equal(c, '/');
61
62 uint8_t ret = 0x80;
63 ret = is_ax.select(c - 'a' + 'c', ret);
64 ret = is_yz.select(c - 'y' + '0', ret);
65 ret = is_AX.select(c - 'A' + 'C', ret);
66 ret = is_YZ.select(c - 'Y' + 'a', ret);
67 ret = is_07.select(c - '0' + '2', ret);
68 ret = is_8.select('+', ret);
69 ret = is_9.select('/', ret);
70 ret = is_dot.select('A', ret);
71 ret = is_slash.select('B', ret);
72
73 return ret;
74}
75
76std::string bcrypt_base64_encode(const uint8_t input[], size_t length) {
77 std::string b64 = base64_encode(input, length);
78
79 while(!b64.empty() && b64[b64.size() - 1] == '=') {
80 b64 = b64.substr(0, b64.size() - 1);
81 }
82
83 for(size_t i = 0; i != b64.size(); ++i) {
84 b64[i] = static_cast<char>(base64_to_bcrypt_encoding(static_cast<uint8_t>(b64[i])));
85 }
86
87 return b64;
88}
89
90std::vector<uint8_t> bcrypt_base64_decode(std::string_view input) {
91 std::string translated;
92 for(size_t i = 0; i != input.size(); ++i) {
93 char c = bcrypt_encoding_to_base64(static_cast<uint8_t>(input[i]));
94 translated.push_back(c);
95 }
96
97 return unlock(base64_decode(translated));
98}
99
100std::string make_bcrypt(std::string_view pass, const std::vector<uint8_t>& salt, uint16_t work_factor, char version) {
101 /*
102 * On a 4 GHz Skylake, workfactor == 18 takes about 15 seconds to
103 * hash a password. This seems like a reasonable upper bound for the
104 * time being.
105 * Bcrypt allows up to work factor 31 (2^31 iterations)
106 */
107 BOTAN_ARG_CHECK(work_factor >= 4 && work_factor <= 18, "Invalid bcrypt work factor");
108
109 alignas(64) static const uint8_t BCRYPT_MAGIC[8 * 3] = {0x4F, 0x72, 0x70, 0x68, 0x65, 0x61, 0x6E, 0x42,
110 0x65, 0x68, 0x6F, 0x6C, 0x64, 0x65, 0x72, 0x53,
111 0x63, 0x72, 0x79, 0x44, 0x6F, 0x75, 0x62, 0x74};
112
113 Blowfish blowfish;
114
115 secure_vector<uint8_t> pass_with_trailing_null(pass.size() + 1);
116 copy_mem(pass_with_trailing_null.data(), cast_char_ptr_to_uint8(pass.data()), pass.length());
117
118 // Include the trailing NULL byte, so we need c_str() not data()
119 blowfish.salted_set_key(
120 pass_with_trailing_null.data(), pass_with_trailing_null.size(), salt.data(), salt.size(), work_factor);
121
122 std::vector<uint8_t> ctext(BCRYPT_MAGIC, BCRYPT_MAGIC + 8 * 3);
123
124 for(size_t i = 0; i != 64; ++i) {
125 blowfish.encrypt_n(ctext.data(), ctext.data(), 3);
126 }
127
128 std::string salt_b64 = bcrypt_base64_encode(salt.data(), salt.size());
129
130 std::string work_factor_str = std::to_string(work_factor);
131 if(work_factor_str.length() == 1) {
132 work_factor_str = "0" + work_factor_str;
133 }
134
135 return fmt("$2{}${}${}{}",
136 version,
137 work_factor_str,
138 salt_b64.substr(0, 22),
139 bcrypt_base64_encode(ctext.data(), ctext.size() - 1));
140}
141
142} // namespace
143
144std::string generate_bcrypt(std::string_view pass, RandomNumberGenerator& rng, uint16_t work_factor, char version) {
145 /*
146 2a, 2b and 2y are identical for our purposes because our implementation of 2a
147 never had the truncation or signed char bugs in the first place.
148 */
149
150 if(version != 'a' && version != 'b' && version != 'y') {
151 throw Invalid_Argument("Unknown bcrypt version '" + std::string(1, version) + "'");
152 }
153
154 std::vector<uint8_t> salt;
155 rng.random_vec(salt, 16);
156 return make_bcrypt(pass, salt, work_factor, version);
157}
158
159bool check_bcrypt(std::string_view pass, std::string_view hash) {
160 if(hash.size() != 60 || hash[0] != '$' || hash[1] != '2' || hash[3] != '$' || hash[6] != '$') {
161 return false;
162 }
163
164 const char bcrypt_version = hash[2];
165
166 if(bcrypt_version != 'a' && bcrypt_version != 'b' && bcrypt_version != 'y') {
167 return false;
168 }
169
170 const uint16_t workfactor = to_uint16(hash.substr(4, 2));
171
172 const std::vector<uint8_t> salt = bcrypt_base64_decode(hash.substr(7, 22));
173 if(salt.size() != 16) {
174 return false;
175 }
176
177 const std::string compare = make_bcrypt(pass, salt, workfactor, bcrypt_version);
178
179 return CT::is_equal(cast_char_ptr_to_uint8(hash.data()), cast_char_ptr_to_uint8(compare.data()), compare.size())
180 .as_bool();
181}
182
183} // namespace Botan
#define BOTAN_ARG_CHECK(expr, msg)
Definition assert.h:29
static Mask< T > is_equal(T x, T y)
Definition ct_utils.h:128
static Mask< T > is_within_range(T v, T l, T u)
Definition ct_utils.h:150
void random_vec(std::span< uint8_t > v)
Definition rng.h:179
CT::Mask< T > is_equal(const T x[], const T y[], size_t len)
Definition ct_utils.h:339
uint16_t to_uint16(std::string_view str)
Definition parsing.cpp:22
std::string fmt(std::string_view format, const T &... args)
Definition fmt.h:53
std::string generate_bcrypt(std::string_view pass, RandomNumberGenerator &rng, uint16_t work_factor, char version)
Definition bcrypt.cpp:144
size_t base64_encode(char out[], const uint8_t in[], size_t input_length, size_t &input_consumed, bool final_inputs)
Definition base64.cpp:146
size_t base64_decode(uint8_t out[], const char in[], size_t input_length, size_t &input_consumed, bool final_inputs, bool ignore_ws)
Definition base64.cpp:154
std::vector< T > unlock(const secure_vector< T > &in)
Definition secmem.h:75
constexpr void copy_mem(T *out, const T *in, size_t n)
Definition mem_ops.h:146
const uint8_t * cast_char_ptr_to_uint8(const char *s)
Definition mem_ops.h:272
bool check_bcrypt(std::string_view pass, std::string_view hash)
Definition bcrypt.cpp:159