In this question:
Can someone explain how BCrypt verifies a hash?
Ian Boyd writes at the end of his answer:
Armed with this knowledge, you can now verify a password correctbatteryhorsestapler against the saved hash:
$2a$12$mACnM5lzNigHMaf7O1py1OLCBgGL4tYUF0N/4rS9CwDsI7ytwL4D6
I am using the following Perl program to attempt to verify this hash:
use Crypt::Eksblowfish::Bcrypt qw(bcrypt);
my $password = "correctbatteryhorsestapler";
my $hash = '$2a$12$mACnM5lzNigHMaf7O1py1OLCBgGL4tYUF0N/4rS9CwDsI7ytwL4D6';
print "Verifying password $password<br>with hash $hash<BR><BR>";
my $new_hash = bcrypt($password,$hash);
print "<pre>Original hash: " . $hash . "<br>" . "New hash: " . $new_hash . "</pre><br>";
if ($hash ne $new_hash) {
print "No match.";
}
The output of my program is as follows:
Verifying password correctbatteryhorsestapler
with hash $2a$12$mACnM5lzNigHMaf7O1py1OLCBgGL4tYUF0N/4rS9CwDsI7ytwL4D6
Original hash: $2a$12$mACnM5lzNigHMaf7O1py1OLCBgGL4tYUF0N/4rS9CwDsI7ytwL4D6
New hash: $2a$12$mACnM5lzNigHMaf7O1py1O3vlf6.BA8k8x3IoJ.Tq3IB/2e7g61Km
No match.
I wonder if, based on the information above, anyone can tell me what I am doing wrong with my Perl script (why it doesn’t correctly validate the password)? If I use the hash my system generates, I do get a match:
Verifying password correctbatteryhorsestapler
with hash $2a$12$mACnM5lzNigHMaf7O1py1O3vlf6.BA8k8x3IoJ.Tq3IB/2e7g61Km
Original hash: $2a$12$mACnM5lzNigHMaf7O1py1O3vlf6.BA8k8x3IoJ.Tq3IB/2e7g61Km
New hash: $2a$12$mACnM5lzNigHMaf7O1py1O3vlf6.BA8k8x3IoJ.Tq3IB/2e7g61Km
I get the same result on two different systems (one CentOS running eksblowfish 0.009 and the other Win7 64-bit running eksblowfish 0.007, both running Perl 5.8.8).
I learn by doing, so I am hoping to understand why this isn’t working for me.
The answer is that it’s my fault. i gave you the wrong hash in the question for
correctbatteryhorsestapler.i picked a real hash; but not wanting to give away the password i changed it to a reference to XKCD.
i should have taken the extra moments to generate an actual hash for
correctbatteryhorsestapler:My fault for the confusion. In the original question i meant it as now you are ready to go out into the world, it wasn’t meant to be an actual test vector.
You might want to look at some actual known test vectors:
There are also tests that make sure that it doesn’t fail on Unicode characters. There was a bug in an implementation somewhere that crashed when given UTF-8:
ππππππππGreek Small Letter Pi (U+03C0), eight repetitionsFor which an actual hash is: