CODEWITHSUNDEEP
pythonencryptionplayframeworkpasswordssecuresocial
ivanvlopes
ivanvlopes

Reputation: 75

What encryption is used by default SecureSocial for SecureSocialPasswordHasher?

I've got a passwords on a datastore that were hashed using the method SecureSocialPasswordHasher.passwordHash from the package securesocial.utils.SecureSocialPasswordHasher of SecureSocial, and I have to validate them through Python.

Therefore, the use of SecureSocial (or the whole Play Framework) is out of the question. The question is: What does it use for hashing when calling that method? From the documentation it seems it is Bcrypt, but it wasn't clear enough for me to be sure.

---------EDIT---------

I've been told on SecureSocial forums that indeed it uses Bcrypt with work factor 10 default. However it doens't reflect what I see on the datastore.

There are 2 columns there, one for salt, and another one fro the hashed password. Neither of them have the Bcrypt header (such as $2a$10$). Also, the salt size is only 11 characters long, and the hashed password is only 22 characters long (and no signs of having the salt inside the string).

Upvotes: 2

Views: 78

Answers (1)

ivanvlopes
ivanvlopes

Reputation: 75

Found out the default for hashing passwords on SecureSocial is indeed Bcrypt.

The default implementation for it's hash method is:

  def hash(plainPassword: String): PasswordInfo = {
        PasswordInfo(id, BCrypt.hashpw(plainPassword, BCrypt.gensalt(logRounds)))
  }

This applies to the latest version of SecureSocial.

On my specific problem, the main issue was that I was not communicated that the code I was dealing with was using an older version of SecureSocial, and that the has method was overriden.

Upvotes: 1

Related Questions