You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -10,13 +11,15 @@ You can read about [bcrypt in Wikipedia][bcryptwiki] as well as in the following
10
11
11
12
## If You Are Submitting Bugs or Issues
12
13
13
-
Verify that the node version you are using is a _stable_ version; it has an even major release number. Unstable versions are currently not supported and issues created while using an unstable version will be closed.
14
+
Please verify that the NodeJS version you are using is a _stable_ version; Unstable versions are currently not supported and issues created while using an unstable version will be closed.
14
15
15
-
If you are on a stable version of node, please provide a sufficient code snippet or log files for installation issues. The code snippet does not require you to include confidential information. However, it must provide enough information such that the problem can be replicable. Issues which are closed without resolution often lack required information for replication.
16
+
If you are on a stable version of NodeJS, please provide a sufficient code snippet or log files for installation issues. The code snippet does not require you to include confidential information. However, it must provide enough information so the problem can be replicable, or it may be closed without an explanation.
16
17
17
18
18
19
## Version Compatibility
19
20
21
+
_Please upgrade to atleast v5.0.0 to avoid security issues mentioned below._
22
+
20
23
| Node Version | Bcrypt Version |
21
24
| -------------- | ------------------|
22
25
| 0.4 | <= 0.4 |
@@ -37,13 +40,13 @@ gyp ERR! stack Error: "pre" versions of node cannot be installed, use the --node
37
40
38
41
> Per bcrypt implementation, only the first 72 bytes of a string are used. Any extra bytes are ignored when matching passwords. Note that this is not the first 72 *characters*. It is possible for a string to contain less than 72 characters, while taking up more than 72 bytes (e.g. a UTF-8 encoded string containing emojis).
39
42
40
-
As should be the case with any security tool, this library should be scrutinized by anyone using it. If you find or suspect an issue with the code, please bring it to my attention and I'll spend some time trying to make sure that this tool is as secure as possible.
43
+
As should be the case with any security tool, anyone using this library should scrutinise it. If you find or suspect an issue with the code, please bring it to the maintainers' attention. We will spend some time ensuring that this library is as secure as possible.
41
44
42
-
To make it easier for people using this tool to analyze what has been surveyed, here is a list of BCryptrelated security issues/concerns as they've come up.
45
+
Here is a list of BCrypt-related security issues/concerns that have come up over the years.
43
46
44
47
* An [issue with passwords][jtr] was found with a version of the Blowfish algorithm developed for John the Ripper. This is not present in the OpenBSD version and is thus not a problem for this module. HT [zooko][zooko].
45
48
* Versions `< 5.0.0` suffer from bcrypt wrap-around bug and _will truncate passwords >= 255 characters leading to severely weakened passwords_. Please upgrade at earliest. See [this wiki page][wrap-around-bug] for more details.
46
-
* Versions `< 5.0.0`_do not handle NUL characters inside passwords properly leading to all subsequent characters being dropped and thus resulting in severely weakened passwords_. Please upgrade at earliest. See [this wiki page][improper-nuls] for more details.
49
+
* Versions `< 5.0.0`_do not handle NUL characters inside passwords properly leading to all subsequent characters being dropped and thus resulting in severely weakened passwords_. Please upgrade at earliest. See [this wiki page][improper-nuls] for more details.
47
50
48
51
## Compatibility Note
49
52
@@ -63,7 +66,7 @@ Hashes generated in `v2.x.x` using the defaults parameters will not work in earl
63
66
*`node-gyp`
64
67
* Please check the dependencies for this tool at: https://github.com/nodejs/node-gyp
65
68
* Windows users will need the options for c# and c++ installed with their visual studio instance.
66
-
* Python 2.x
69
+
* Python 2.x/3.x
67
70
*`OpenSSL` - This is only required to build the `bcrypt` project if you are using versions <= 0.7.7. Otherwise, we're using the builtin node crypto bindings for seed data (which use the same OpenSSL code paths we were, but don't have the external dependency).
68
71
69
72
## Install via NPM
@@ -75,7 +78,9 @@ npm install bcrypt
75
78
76
79
_Pre-built binaries for various NodeJS versions are made available on a best-effort basis._
77
80
78
-
Only the current stable and supported LTS releases are actively tested against. Please note that there may be an interval between the release of the module and the availabilty of the compiled modules.
81
+
Only the current stable and supported LTS releases are actively tested against.
82
+
83
+
_There may be an interval between the release of the module and the availabilty of the compiled modules._
79
84
80
85
Currently, we have pre-built binaries that support the following platforms:
bcrypt uses whatever Promise implementation is available in `global.Promise`. NodeJS >= 0.12 has a native Promise implementation built in. However, this should work in any Promises/A+ compliant implementation.
148
+
bcrypt uses whatever `Promise` implementation is available in `global.Promise`. NodeJS >= 0.12 has a native `Promise` implementation built in. However, this should work in any Promises/A+ compliant implementation.
144
149
145
150
Async methods that accept a callback, return a `Promise` when callback is not specified if Promise support is available.
[A Note on Timing Attacks](#a-note-on-timing-attacks)
223
228
224
229
### Why is async mode recommended over sync mode?
225
-
If you are using bcrypt on a simple script, using the sync mode is perfectly fine. However, if you are using bcrypt on a server, the async mode is recommended. This is because the hashing done by bcrypt is CPU intensive, so the sync version will block the event loop and prevent your application from servicing any other inbound requests or events. The async version uses a thread pool which does not block the main event loop.
230
+
We recommend using async API if you use `bcrypt` on a server. Bcrypt hashing is CPU intensive which will cause the sync APIs to block the event loop and prevent your application from servicing any inbound requests or events. The async version uses a thread pool which does not block the main event loop.
226
231
227
232
## API
228
233
@@ -260,7 +265,7 @@ If you are using bcrypt on a simple script, using the sync mode is perfectly fin
260
265
261
266
## A Note on Rounds
262
267
263
-
A note about the cost. When you are hashing your data the module will go through a series of rounds to give you a secure hash. The value you submit there is not just the number of rounds that the module will go through to hash your data. The module will use the value you enter and go through `2^rounds`iterations of processing.
268
+
A note about the cost: when you are hashing your data, the module will go through a series of rounds to give you a secure hash. The value you submit is not just the number of rounds the module will go through to hash your data. The module will use the value you enter and go through `2^rounds`hashing iterations.
264
269
265
270
From @garthk, on a 2GHz core you can roughly expect:
266
271
@@ -278,15 +283,15 @@ From @garthk, on a 2GHz core you can roughly expect:
278
283
279
284
## A Note on Timing Attacks
280
285
281
-
Because it's come up multiple times in this project, and other bcrypt projects, it needs to be said. The bcrypt comparison function is not susceptible to timing attacks. From codahale/bcrypt-ruby#42:
286
+
Because it's come up multiple times in this project and other bcrypt projects, it needs to be said. The `bcrypt` library is not susceptible to timing attacks. From codahale/bcrypt-ruby#42:
282
287
283
288
> One of the desired properties of a cryptographic hash function is preimage attack resistance, which means there is no shortcut for generating a message which, when hashed, produces a specific digest.
284
289
285
290
A great thread on this, in much more detail can be found @ codahale/bcrypt-ruby#43
286
291
287
292
If you're unfamiliar with timing attacks and want to learn more you can find a great writeup @ [A Lesson In Timing Attacks][timingatk]
288
293
289
-
However, timing attacks are real. And, the comparison function is _not_ time safe. What that means is that it may exit the function early in the comparison process. This happens because of the above. We don't need to be careful that an attacker is going to learn anything, and our comparison function serves to provide a comparison of hashes, it is a utility to the overall purpose of the library. If you end up using it for something else we cannot guarantee the security of the comparator. Keep that in mind as you use the library.
294
+
However, timing attacks are real. And the comparison function is _not_ time safe. That means that it may exit the function early in the comparison process. Timing attacks happen because of the above. We don't need to be careful that an attacker will learn anything, and our comparison function provides a comparison of hashes. It is a utility to the overall purpose of the library. If you end up using it for something else, we cannot guarantee the security of the comparator. Keep that in mind as you use the library.
290
295
291
296
## Hash Info
292
297
@@ -348,7 +353,7 @@ The code for this comes from a few sources:
348
353
*[Nate Rajlich][tootallnate] - Bindings and build process.
349
354
*[Sean McArthur][seanmonstar] - Windows Support
350
355
*[Fanie Oosthuysen][weareu] - Windows Support
351
-
*[Amitosh Swain Mahapatra][agathver] - $2b$ hash support, ES6 Promise support
356
+
*[Amitosh Swain Mahapatra][recrsn] - $2b$ hash support, ES6 Promise support
352
357
*[Nicola Del Gobbo][NickNaso] - Initial implementation with N-API
353
358
354
359
## License
@@ -379,5 +384,5 @@ Unless stated elsewhere, file headers or otherwise, the license as stated in the
0 commit comments