search

smarkets / erlang-bcrypt

Erlang wrapper for OpenBSD's Blowfish password hashing code
Other
86 stars 47 forks source link

Use crypto:strong_rand_bytes/1 instead of crypto:rand_bytes/1 #19

Open benjamin-bergia opened 7 years ago

benjamin-bergia commented 7 years ago

crypto:rand_bytes/1 has been deprecated in newer versions of erlang. This PR replace the calls to crypto:rand_bytes/1 with crypto:strong_rand_bytes/1.

This will probably break the compatibility with older versions of Erlang. If needed I can update this PR to favor crypto:strong_rand_bytes/1 and, if not available, fallback on crypto:rand_bytes/1.

Also from the doc, crypto:strong_rand_bytes/1 can throw a low_entropy exception. I have far from an expert in this field, so if you have any comment or recommendation, please let me know.

lafka commented 7 years ago

I have a patch which checks for erlang version at https://github.com/lafka/erlang-bcrypt/tree/lafka-erlang19-rand-bytes if interesting

ddeboer commented 7 years ago

Merged into https://github.com/erlangpack/bcrypt and published to Hex.pm as bcrypt 1.0.0.