MAC, KDF & password hashingAcceptable
bcrypt
Password hashing
How it works
bcrypt, published in 1999, is built on an expensive key setup derived from the Blowfish cipher. A cost factor sets the work as a power of two, so it can be raised as hardware gets faster. The salt and cost are stored inside the resulting hash string.
Sizes: Configurable cost factor; 128-bit salt; input limited to 72 bytes
Status: Still sound for password storage; Argon2id is preferred for new systems.
Strengths
- Adjustable cost and built-in salt
- Long track record and support in most web frameworks
- Uses more memory per guess than PBKDF2, which slows GPU attacks somewhat
Weaknesses and known attacks
- Only the first 72 bytes of the password are used; longer inputs are silently truncated by many implementations.
- Not memory-hard in the way scrypt and Argon2 are.
- Not FIPS-approved.
Use it for
- Web application password storage, especially in existing systems
Don't use it for
- Deriving encryption keys
- Passwords that may exceed 72 bytes without pre-processing
Exam tip
bcrypt is a password hashing (key stretching) algorithm, not an encryption algorithm, despite being based on Blowfish.