Question

What are the (1) hash algorithm identifier, (2) cost factor, (3) salt, and (4) hash value of the following given hashed password that is generated by bcrypt()?

$2y$16$.2Boh8Y80U.RaFr1sFdaKuP5/B2Z3I8OM7vUTUvPzD2UEG3VMcXra

Answer 1

Bcrypt is an adaptive hash function based on the Blowfish symmetric block cipher cryptographic algorithm. It uses a Key Factor (or Work Factor) which adjusts the cost of hashing, which is probably Bcrypt's most notable feature.

A bcrypt hash string is of the form:

$2b$[cost]$[22 character salt][31 character hash]

For example:

$2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy
\__/\/ \____________________/\_____________________________/
idn Cost      Salt                        Hash

Where:

    $2a$: The hash algorithm identifier (bcrypt)
    10: Cost factor (210 ==> 1,024 rounds)
    N9qo8uLOickgx2ZMRZoMye: 16-byte (128-bit) salt, base64 encoded to 22 characters
    IjZAgcfl7p92ldGxad68LJZdL17lhWy: 24-byte (192-bit) hash, base64 encoded to 31 characters

Lets get back to the original question

$2y$16$.2Boh8Y80U.RaFr1sFdaKuP5/B2Z3I8OM7vUTUvPzD2UEG3VMcXra

(1) hash algorithm identifier:- $2a$

(2) cost factor:- 16 (216 ==> 65536)

(3) salt:- .2Boh8Y80U.RaFr1sFdaKu

(4) hash value:- P5/B2Z3I8OM7vUTUvPzD2UEG3VMcXra

Happy Learning...