RPR
RPR

Reputation: 1

Bcrypt Password Truncation issue solution or Hashing Long Passwords with Bcrypt in Java?

In scenarios where passwords exceed the 72-byte limit of Bcrypt hashing, it becomes necessary to devise alternative approaches to ensure all input data is hashed without loss. One viable solution involves utilising the SHA-512 algorithm to initially hash the raw input, resulting in a hexadecimal string. This string is then converted to ASCII to truncate the input to less than 72 bytes, preserving data integrity. Subsequently, Bcrypt hashing can be applied to the truncated input to generate the desired hash value. Is this feasible in java. Whether this is correct approach or any other approach available.

MessageDigest sha512MD = null;
        sha512MD = MessageDigest.getInstance("SHA-512");
        String md512Output = DatatypeConverter.printHexBinary(sha512MD.digest(password.getBytes()));

        // ASCII conversion
        StringBuilder asciiOutput = new StringBuilder(70);
        for (int i = 0; i < md512Output.length(); i += 2) {
            String str = md512Output.substring(i, i + 2);
            asciiOutput.append((char) Integer.parseInt(str, 16));
        }
        String asciiString = asciiOutput.toString();
        String hash = BCrypt.hashpw(asciiString, BCrypt.gensalt(bcryptLogRounds));```

Upvotes: 0

Views: 276

Answers (0)

Related Questions