How to decrypt a hash stored in bcrypt

Question

I have this script that encrypts a password, but I don’t know how to cancel and decrypt it. This may be a very simple answer, but I don’t understand how to do it.

#!/usr/bin/perl use Crypt::Eksblowfish::Bcrypt; use Crypt::Random; $password = 'bigtest'; $encrypted = encrypt_password($password); print "$password is encrypted as $encrypted\n"; print "Yes the password is $password\n" if check_password($password, $encrypted); print "No the password is not smalltest\n" if !check_password('smalltest', $encrypted); # Encrypt a password sub encrypt_password { my $password = shift; # Generate a salt if one is not passed my $salt = shift || salt(); # Set the cost to 8 and append a NUL my $settings = '$2a$08$'.$salt; # Encrypt it return Crypt::Eksblowfish::Bcrypt::bcrypt($password, $settings); } # Check if the passwords match sub check_password { my ($plain_password, $hashed_password) = @_; # Regex to extract the salt if ($hashed_password =~ m!^\$2a\$\d{2}\$([A-Za-z0-9+\\.]{22})!) { return encrypt_password($plain_password, $1) eq $hashed_password; } else { return 0; } } # Return a random salt sub salt { return Crypt::Eksblowfish::Bcrypt::en_base64(Crypt::Random::makerandom_octet(Length=>16)); } 

Answer 1

YOU WANT, NOT USUALLY!

What's the difference?

The difference is that hashing is a one-way function, where encryption is a two-way function.

So how do you know that the password is right?

Therefore, when a user submits a password, you do not decrypt your stored hash; instead, you perform the same bcrypt operation at the user input and compare the hashes. If they are identical, you accept authentication.

Should you use or encrypt passwords?

What you are doing now - password hashing - is correct. If you simply encrypt passwords, a breach of security in your application may allow an attacker to trivially learn all user passwords. If you use a hash (or better, salt and hash ), the user must crack passwords (which is expensive to calculate on bcrypt ) to get this knowledge.

Since your users are likely to use their passwords in several places, this will help protect them.