Re: [Pharo-project] How to encrypt a password?
Hi Mariano, I've made a FFI library on Squeaksource that works on Linux. http://www.squeaksource.com/Cryptography/PasswordHashingFFI-PaulDeBruicker.8... You need to install the 32 bit versions of libcrypt and libxcrypt if you're using a 64 bit linux os. Using crypt can hash passwords using MD5, DES, SHA256, SHA512. Using libxcrypt can hash passwords using bcrypt. If its for a new installation use bcrypt or SHA512 to hash the passwords. bcrypt is better because its slower, and allegedly future proof. to get a hashed password use BCryptLinuxFFI bcrypt:'mypassword' to check it against a stored hash use: BCryptLinuxFFI check:'mypassword' against: storedHash
Thanks Paul. It looks interesting. On Mon, Oct 24, 2011 at 6:38 PM, Paul DeBruicker <pdebruic@gmail.com> wrote:
Hi Mariano,
I've made a FFI library on Squeaksource that works on Linux.
http://www.squeaksource.com/**Cryptography/**PasswordHashingFFI-** PaulDeBruicker.8.mcz<http://www.squeaksource.com/Cryptography/PasswordHashingFFI-PaulDeBruicker.8...>
You need to install the 32 bit versions of libcrypt and libxcrypt if you're using a 64 bit linux os.
Using crypt can hash passwords using MD5, DES, SHA256, SHA512.
Using libxcrypt can hash passwords using bcrypt.
If its for a new installation use bcrypt or SHA512 to hash the passwords. bcrypt is better because its slower, and allegedly future proof.
to get a hashed password use
BCryptLinuxFFI bcrypt:'mypassword'
to check it against a stored hash use:
BCryptLinuxFFI check:'mypassword' against: storedHash
-- Mariano http://marianopeck.wordpress.com
Hi Paul, I resume this old thread because it's not clear to me which package download to make BCryptLinuxFFI work In an other thread you point to: MCHttpRepository location: 'http://smalltalkhub.com/mc/Cryptography/Blowfish/main' user: '' password: '' but there is no BCryptLinuxFFI there. Can you help me please? Cheers Davide Paul DeBruicker wrote
Hi Mariano,
I've made a FFI library on Squeaksource that works on Linux.
http://www.squeaksource.com/Cryptography/PasswordHashingFFI-PaulDeBruicker.8...
You need to install the 32 bit versions of libcrypt and libxcrypt if you're using a 64 bit linux os.
Using crypt can hash passwords using MD5, DES, SHA256, SHA512.
Using libxcrypt can hash passwords using bcrypt.
If its for a new installation use bcrypt or SHA512 to hash the passwords. bcrypt is better because its slower, and allegedly future proof.
to get a hashed password use
BCryptLinuxFFI bcrypt:'mypassword'
to check it against a stored hash use:
BCryptLinuxFFI check:'mypassword' against: storedHash
-- View this message in context: http://forum.world.st/How-to-encrypt-a-password-tp3933585p4723920.html Sent from the Pharo Smalltalk Developers mailing list archive at Nabble.com.
Davide Varvello wrote
Hi Paul, I resume this old thread because it's not clear to me which package download to make BCryptLinuxFFI work
In an other thread you point to: MCHttpRepository location: 'http://smalltalkhub.com/mc/Cryptography/Blowfish/main' user: '' password: ''
but there is no BCryptLinuxFFI there. Can you help me please?
Cheers Davide
Hi Davide, You need to be on Linux and On pharo or squeak - have a 32bit version of libxcrypt installed. - use this mcz http://www.squeaksource.com/Cryptography/PasswordHashingFFI-PaulDeBruicker.1... or http://www.smalltalkhub.com/mc/Cryptography/Cryptography/main/PasswordHashin... (they're the same file) On GemStone - have a 64bit version of libxcrypt installed - use this mcz http://seaside.gemtalksystems.com/ss/Cryptography/PasswordHashingFFI-PaulDeB... The Blowfish stuff is an implementation of the cipher (https://en.wikipedia.org/wiki/Blowfish_%28cipher%29). BCrypt uses blowfish as its encryption mechanisim, calling it tens to hundreds of thousands of times. The PasswordHashingFFI package also includes support for accessing the crypt(3) library so you can use SHA512 password hashing too if you like (or other mechanisms it supports like DES, MD5, etc) Hope this helps Paul -- View this message in context: http://forum.world.st/How-to-encrypt-a-password-tp3933585p4724035.html Sent from the Pharo Smalltalk Developers mailing list archive at Nabble.com.
Hi Paul, and just to be sure I understand...none of them could work as a two-way encryption, right? The only one is your Pharo's version of Blowfish but that only works with 8 chars long. Is it like this? Or is there any other two-way encryption? Thanks! On Thu, Nov 21, 2013 at 1:35 PM, Paul DeBruicker <pdebruic@gmail.com> wrote:
Davide Varvello wrote
Hi Paul, I resume this old thread because it's not clear to me which package download to make BCryptLinuxFFI work
In an other thread you point to: MCHttpRepository location: 'http://smalltalkhub.com/mc/Cryptography/Blowfish/main ' user: '' password: ''
but there is no BCryptLinuxFFI there. Can you help me please?
Cheers Davide
Hi Davide,
You need to be on Linux and
On pharo or squeak - have a 32bit version of libxcrypt installed. - use this mcz
http://www.squeaksource.com/Cryptography/PasswordHashingFFI-PaulDeBruicker.1... or
http://www.smalltalkhub.com/mc/Cryptography/Cryptography/main/PasswordHashin... (they're the same file)
On GemStone - have a 64bit version of libxcrypt installed - use this mcz
http://seaside.gemtalksystems.com/ss/Cryptography/PasswordHashingFFI-PaulDeB...
The Blowfish stuff is an implementation of the cipher (https://en.wikipedia.org/wiki/Blowfish_%28cipher%29). BCrypt uses blowfish as its encryption mechanisim, calling it tens to hundreds of thousands of times.
The PasswordHashingFFI package also includes support for accessing the crypt(3) library so you can use SHA512 password hashing too if you like (or other mechanisms it supports like DES, MD5, etc)
Hope this helps
Paul
-- View this message in context: http://forum.world.st/How-to-encrypt-a-password-tp3933585p4724035.html Sent from the Pharo Smalltalk Developers mailing list archive at Nabble.com.
-- Mariano http://marianopeck.wordpress.com
Mariano Martinez Peck wrote
Hi Paul, and just to be sure I understand...none of them could work as a two-way encryption, right? The only one is your Pharo's version of Blowfish but that only works with 8 chars long. Is it like this? Or is there any other two-way encryption?
Thanks!
-- Mariano http://marianopeck.wordpress.com
Yes that's right. The PasswordHashingFFI stuff is all one way encryption. Blowfish is two way, and the current implementation only works for 8 byte chunks. I stopped working on it when the Smalltalk bcrypt implementation I wanted proved to be 5000x times slower than the FFI version. Someone needs to add the CBC part to Blowfish to encrypt longer strings. I do not know of another in image two way encryption scheme, but there may be something in the Cryptography repo. I'm not sure. -- View this message in context: http://forum.world.st/How-to-encrypt-a-password-tp3933585p4724078.html Sent from the Pharo Smalltalk Developers mailing list archive at Nabble.com.
Hi Mariano, Hash functions are one way (http://en.wikipedia.org/wiki/Cryptographic_hash_function) that's because usually you don't want someone can decrypt password. Cheers Davide Mariano Martinez Peck wrote
Hi Paul, and just to be sure I understand...none of them could work as a two-way encryption, right? The only one is your Pharo's version of Blowfish but that only works with 8 chars long. Is it like this? Or is there any other two-way encryption?
Thanks!
-- View this message in context: http://forum.world.st/How-to-encrypt-a-password-tp3933585p4724097.html Sent from the Pharo Smalltalk Developers mailing list archive at Nabble.com.
+1 you should definitively NOT encrypt Cupid Media hacked, 42 million passwords was stolen: http://www.facepunch.com/showthread.php?t=1327069 You're Probably Storing Passwords Incorrectly: http://www.codinghorror.com/blog/2007/09/youre-probably-storing-passwords-in... And now you mentioned it, Monticello actually sucks on this one On Nov 21, 2013, at 7:06 PM, Davide Varvello <varvello@yahoo.com> wrote:
Hi Mariano,
Hash functions are one way (http://en.wikipedia.org/wiki/Cryptographic_hash_function) that's because usually you don't want someone can decrypt password.
Cheers Davide
Mariano Martinez Peck wrote
Hi Paul, and just to be sure I understand...none of them could work as a two-way encryption, right? The only one is your Pharo's version of Blowfish but that only works with 8 chars long. Is it like this? Or is there any other two-way encryption?
Thanks!
-- View this message in context: http://forum.world.st/How-to-encrypt-a-password-tp3933585p4724097.html Sent from the Pharo Smalltalk Developers mailing list archive at Nabble.com.
Paul, I've already tried to load PasswordHashingFFI-PaulDeBruicker.16.mcz, but a warning shows: This package depends on the following classes: ExternalStructure You must resolve these dependencies before you will be able to load these definitions: BCryptLinuxFFI bcrypt: bcrypt:with: bcrypt:with:for: bcrypt:withSalt: checkPassword:against: defaultRounds ffiCrypt:with: generateBCryptIterations: generateBCryptSalt: generateRandomSalt iterationString: randomBCryptSaltData saltDataLength saltOutputLength CryptLinuxFFI checkPassword:against: des: des:with: ffiCrypt:with: md5: md5:with: prepareSalt: randomSalt randomSalt: saltDataLength sha256: sha256:with: sha512: sha512:with: Select Proceed to continue, or close this window to cancel the operation. Cheers Davide Paul DeBruicker wrote
Hi Davide,
You need to be on Linux and
On pharo or squeak - have a 32bit version of libxcrypt installed. - use this mcz
http://www.squeaksource.com/Cryptography/PasswordHashingFFI-PaulDeBruicker.1... or
http://www.smalltalkhub.com/mc/Cryptography/Cryptography/main/PasswordHashin... (they're the same file)
On GemStone - have a 64bit version of libxcrypt installed - use this mcz http://seaside.gemtalksystems.com/ss/Cryptography/PasswordHashingFFI-PaulDeB...
The Blowfish stuff is an implementation of the cipher (https://en.wikipedia.org/wiki/Blowfish_%28cipher%29). BCrypt uses blowfish as its encryption mechanisim, calling it tens to hundreds of thousands of times.
The PasswordHashingFFI package also includes support for accessing the crypt(3) library so you can use SHA512 password hashing too if you like (or other mechanisms it supports like DES, MD5, etc)
Hope this helps
Paul
-- View this message in context: http://forum.world.st/How-to-encrypt-a-password-tp3933585p4724096.html Sent from the Pharo Smalltalk Developers mailing list archive at Nabble.com.
Davide Varvello wrote
Paul,
I've already tried to load PasswordHashingFFI-PaulDeBruicker.16.mcz, but a warning shows:
This package depends on the following classes: ExternalStructure You must resolve these dependencies before you will be able to load these definitions: BCryptLinuxFFI bcrypt: bcrypt:with:
Have you loaded FFI into your image prior to loading the PasswordHashinFFI package? I've only used/tested these things on Pharo 1.1 - 2 and Squeak 4.3 & 4.4. What platform are you using? -- View this message in context: http://forum.world.st/How-to-encrypt-a-password-tp3933585p4724123.html Sent from the Pharo Smalltalk Developers mailing list archive at Nabble.com.
Paul DeBruicker wrote
Have you loaded FFI into your image prior to loading the PasswordHashingFFI package? I've only used/tested these things on Pharo 1.1 - 2 and Squeak 4.3 & 4.4. What platform are you using?
Oops, I didn't load FFI. Now, after evaluatingâ¦: Gofer new squeaksource: 'MetacelloRepository'; package: 'ConfigurationOfFFI'; load. (Smalltalk at: #ConfigurationOfFFI) project lastVersion load â¦PasswordHashingFFI is loading. Thanks Davide -- View this message in context: http://forum.world.st/How-to-encrypt-a-password-tp3933585p4724176.html Sent from the Pharo Smalltalk Developers mailing list archive at Nabble.com.
participants (4)
-
Davide Varvello -
Mariano Martinez Peck -
Paul DeBruicker -
Sebastian Sastre