search

gchq / CyberChef

The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis
https://gchq.github.io/CyberChef
Apache License 2.0
29.3k stars 3.28k forks source link

Bug report: bcrypt version old #1853

Open jonycoo opened 4 months ago

jonycoo commented 4 months ago

Describe the bug The bcrypt library used in the code and on the website are incompatible with the new version of bcrypt. hashes generated from Cypershef begin with '$2a' they work, because bcrypt is backwards compatibel. the used bcrypt library has no update for the new version, hashes begin: '$2b' and can't generate or validate hashes generated with the new version.

To Reproduce Steps to reproduce the behaviour or a link to the recipe / input used to cause the bug:

  1. Go to https://bcrypthashgenerator.tool-kit.dev/
  2. Enter a word (I used 'Hello')
  3. Click on 'wrench symbol' to generate the Hash (mine was '$2b$10$Du/WNkqlbIG.g4mgzbjHDuDf3v3JvMnDKzBAK3rI1TyyB5BxGqZYq' but yours will be different.
  4. Go to CyberChef
  5. Add 'Bcrypt compare' to a new/empty Recipe
  6. Enter your hash from the previouse generator tool in the Hash field of the Ingredient
  7. Enter the word used to generate the hash into the input field
  8. Bake
  9. It will output 'No match'

Expected behaviour going throu the same steps as before should result in a positive match

Additional context The used library of ChyberChef: 'bcryptjs' has not recived updates in the last seven years. The best alternative, which is also activly maintained is bcrypt

I'm not familiar with the structure of this project (haven't found a package.json) so i rather leave the implementation to someone else.

shivansh84ya commented 4 months ago

hi @jonycoo could you assign this issue to me?

shivansh84ya commented 4 months ago

PR #1857

jonycoo commented 4 months ago

Thanks, sorry, I do not have the abitily to assign Issues.