CyberChef Bcrypt & Scrypt

Category: Encryption/Encoding Operations: Bcrypt, Scrypt
Password Hashing Bcrypt Scrypt Key Derivation Security

What is Password Hashing?

Password hashing is a one-way cryptographic process that converts a password into a fixed-length string of characters. Unlike encryption, hashing cannot be reversed - you can't get the original password back from the hash. This makes hashing ideal for storing passwords securely, as even if an attacker gains access to the hashed passwords, they cannot directly retrieve the originals.

When a user logs in, their entered password is hashed using the same algorithm and compared with the stored hash. If the hashes match, the password is correct. This means the system never needs to store actual passwords, significantly improving security.

Key Principle: Modern password hashing functions like bcrypt and scrypt are intentionally slow and resource-intensive. This makes them resistant to brute-force attacks where attackers try millions of password combinations, as each attempt takes significant time and computational power.

Bcrypt Overview

Bcrypt is a password hashing function designed by Niels Provos and David Mazières in 1999, based on the Blowfish cipher. It was presented at USENIX and has become one of the most widely adopted password hashing algorithms in modern applications.

How Bcrypt Works

Bcrypt uses a technique called key stretching, which makes the hashing process computationally expensive. The algorithm incorporates a work factor (also called cost factor) that determines how many iterations the hashing process performs. As computers get faster, you can increase this work factor to maintain security.

🔐
Adaptive Hashing
The cost factor can be increased over time as hardware improves, maintaining security against future threats.
🧂
Built-in Salt
Bcrypt automatically generates and includes a random salt, preventing rainbow table attacks.
⏱️
Intentionally Slow
Designed to be slow enough to thwart brute-force attacks but fast enough for normal authentication.
✅
Battle-Tested
Used for over 20 years with no significant vulnerabilities discovered, proven in production environments.

Bcrypt Hash Format

A bcrypt hash has a specific structure that encodes all necessary information for verification:

Example Bcrypt Hash:
$2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy
Structure Breakdown:
$2a$ - Algorithm identifier (bcrypt variant) 10 - Cost factor (2^10 = 1,024 iterations) $N9qo8uLOickgx2ZMRZoMye - Salt (22 characters) IjZAgcfl7p92ldGxad68LJZdL17lhWy - Hash (31 characters)

Cost Factor Explained

The cost factor is a logarithmic value. A cost of 10 means 2^10 (1,024) iterations, while a cost of 12 means 2^12 (4,096) iterations. Each increment doubles the computation time:

Cost Factor Iterations Approximate Time Use Case
8 256 ~40ms Too fast - not recommended
10 1,024 ~150ms Minimum recommended
12 4,096 ~600ms Good balance for most applications
14 16,384 ~2.5s High security applications
16 65,536 ~10s Very high security (may impact UX)
Performance Consideration: Higher cost factors provide better security but increase server load and authentication time. Choose a cost factor that provides adequate security without degrading user experience. Most applications use cost factors between 10-12.

Using Bcrypt in CyberChef

CyberChef's Bcrypt operation allows you to generate bcrypt hashes for passwords. This is useful for testing, understanding hash formats, and creating hashes for development purposes.

Steps to Hash with Bcrypt:

  1. Open CyberChef and search for "Bcrypt" operation
  2. Enter your password in the input pane
  3. Configure the cost factor (rounds) - typically 10-12
  4. Optionally specify a salt (or let it generate one)
  5. View the bcrypt hash in the output
Bcrypt Hashing Example
Password:
MySecurePassword123!
Settings:
Cost Factor: 12 Salt: (auto-generated)
Resulting Bcrypt Hash:
$2b$12$KIXxRH6j1yPnEuVG3dJ2OeKmQqhLw8R5vP9X4t8L2mN6oP5qR7sT.

Note: Each time you hash the same password, you'll get a different output due to the random salt. This is intentional and doesn't affect password verification.

Scrypt Overview

Scrypt is a password-based key derivation function (PBKDF) created by Colin Percival in 2009. While bcrypt is CPU-intensive, scrypt is also memory-intensive, making it even more resistant to hardware-based attacks using GPUs or custom ASICs.

Why Scrypt Was Created

As graphics processing units (GPUs) and specialized hardware became more powerful and affordable, attackers could use them to perform millions of bcrypt hashes in parallel. Scrypt addresses this by requiring significant amounts of memory, making parallel attacks much more expensive.

💾
Memory-Hard
Requires substantial memory to compute, making GPU and ASIC attacks economically infeasible.
⚙️
Configurable Parameters
Adjustable CPU cost, memory cost, and parallelization factors for fine-tuned security.
🛡️
ASIC-Resistant
The memory requirement makes custom hardware attacks significantly more expensive.
🔑
Key Derivation
Originally designed for deriving encryption keys from passwords, not just password storage.

Scrypt Parameters

Scrypt has three main parameters that control its computational cost and memory usage:

Parameter Symbol Description Typical Values
CPU/Memory Cost N Determines memory usage and iterations (must be power of 2) 16384, 32768, 65536
Block Size r Fine-tunes memory access patterns 8
Parallelization p Allows parallel computation (higher = more cores can help) 1
Key Length dkLen Length of derived key in bytes 32, 64

Memory Usage Formula

The approximate memory required by scrypt is: 128 × N × r × p bytes

Example with common parameters (N=16384, r=8, p=1): Memory = 128 × 16384 × 8 × 1 = 16,777,216 bytes = 16 MB Example with higher security (N=32768, r=8, p=1): Memory = 128 × 32768 × 8 × 1 = 33,554,432 bytes = 32 MB

Using Scrypt in CyberChef

CyberChef's Scrypt operation allows you to derive keys or hash passwords using the scrypt algorithm. It's commonly used for both password storage and key derivation for encryption.

Steps to Use Scrypt:

  1. Open CyberChef and search for "Scrypt" operation
  2. Enter your password or passphrase in the input
  3. Configure the salt (can be a specific value or random)
  4. Set the cost parameters (N, r, p)
  5. Specify the desired key length
  6. View the derived key in the output
Scrypt Key Derivation Example
Password:
MySecurePassword123!
Settings:
Salt: random_salt_16_bytes N (CPU/Memory cost): 16384 r (Block size): 8 p (Parallelization): 1 Key Length: 32 bytes
Resulting Scrypt Output (Hex):
4d5e1c8f3a2b9e7d6c5b4a3f2e1d0c9b8a7f6e5d4c3b2a1f0e9d8c7b6a5f4e3d

Note: The same password with the same salt and parameters will always produce the same output. In password storage, use unique random salts for each password.

Bcrypt vs Scrypt: Comparison

Bcrypt

  • Year: 1999
  • Basis: Blowfish cipher
  • Primary Defense: CPU-intensive iterations
  • Memory Usage: Low (4 KB)
  • Parameters: Single cost factor
  • Best For: Password storage in web applications
  • Performance: Faster than scrypt
  • GPU Resistance: Moderate
  • Adoption: Very widely supported

Scrypt

  • Year: 2009
  • Basis: Memory-hard function
  • Primary Defense: Memory-intensive operations
  • Memory Usage: Configurable (16+ MB typical)
  • Parameters: Multiple (N, r, p, length)
  • Best For: High-value targets, key derivation
  • Performance: Slower, more resource-intensive
  • GPU Resistance: Very high
  • Adoption: Growing, used in cryptocurrencies
Which Should You Use? For most web applications, bcrypt is sufficient and has broader support. Use scrypt when you need maximum security against hardware-accelerated attacks or when deriving encryption keys from passwords. Both are vastly superior to outdated options like MD5 or SHA-1.

Common Use Cases

1. User Password Storage

When users register or change passwords, hash them with bcrypt or scrypt before storing in the database. Never store plaintext passwords.

2. API Key Derivation

Use scrypt to derive API keys from master passwords, ensuring the keys are computationally expensive to brute-force.

3. Password Verification

During login, hash the provided password and compare it with the stored hash to verify credentials without knowing the original password.

4. Encryption Key Generation

Use scrypt to derive encryption keys from user passwords, making encrypted data secure even with relatively weak passwords.

5. Security Auditing

Test password strength by attempting to crack hashes with known password lists, demonstrating the importance of strong passwords.

6. Migration Projects

When migrating from weaker hash algorithms (MD5, SHA-1), re-hash passwords with bcrypt or scrypt during user login.

Security Best Practices

Always Use Salt

Both bcrypt and scrypt require salts to prevent rainbow table attacks. Bcrypt generates salts automatically. For scrypt, ensure you generate unique random salts for each password.

Choose Appropriate Cost Factors

Don't Implement Your Own

Use well-tested libraries and implementations. Cryptographic code is notoriously difficult to implement correctly, and small mistakes can create major vulnerabilities.

Consider Peppering

Add a secret application-wide key (pepper) to passwords before hashing. Store this separately from the database to add an extra layer of security.

Modern Alternatives: Consider Argon2, the winner of the Password Hashing Competition (2015), which combines the best features of both bcrypt and scrypt. However, bcrypt and scrypt remain excellent choices with widespread support and proven security.

Common Mistakes to Avoid

DON'T:
  • Use MD5, SHA-1, or plain SHA-256 for password hashing - they're too fast
  • Implement your own hashing algorithm
  • Use the same salt for all passwords
  • Store passwords in plaintext "temporarily" during development
  • Hash passwords client-side only (still hash again on server)
  • Use cost factors that are too low to save computing resources
  • Log or display hashed passwords unnecessarily
  • Forget to hash passwords before comparing during authentication

CyberChef Recipe Ideas

Here are some useful recipe combinations involving bcrypt and scrypt:

Real-World Examples

Example: User Registration

User enters: "MyPassword123" ↓ Server receives password ↓ Hash with Bcrypt (cost=12) ↓ Store in database: "$2b$12$KIXxRH6j1yPnEuVG3dJ2Oe..." ↓ Original password is discarded

Example: User Login

User enters: "MyPassword123" ↓ Server receives password ↓ Retrieve stored hash from database ↓ Hash entered password with same algorithm ↓ Compare: entered hash === stored hash? ↓ If match: Authentication successful If no match: Authentication failed

Example: Key Derivation with Scrypt

User password: "StrongPassword456" Salt: "user123_unique_salt" ↓ Scrypt(password, salt, N=16384, r=8, p=1, dkLen=32) ↓ Derived key: 256-bit encryption key ↓ Use key for AES-256 encryption ↓ Encrypted data stored, key discarded
← Back to Operations Guide