Cryptography April 2011

cryptography@lists.squeakfoundation.org

3 participants
3 discussions

Blowfish & Bcrypt in Smalltalk + accessing crypt(3) through FFI.
by Paul DeBruicker 04 May '11

04 May '11

Hi - I've made a working implementation of the Blowfish algorithm in Pharo, a partially broken implementation of Bcrypt in Pharo, and a reliable way to access the linux crypt library using FFI in Pharo on linux. At the moment it takes about 25 seconds to hash a password using my Bcrypt implementation in Pharo, which is about 50x too long. So I'm going to try to get a FFI version put together or just use SHA512 from the linux crypt library. I have learned a lot but don't expect to fix the improper hashing as I don't think the fix would cause a massive speed up. I think the hashing error is probably an off-by-one error in an array index in the BCrypt class. Ruby, Python, Lisp, PHP all access a C or Java library for bcrypt which probably should have told me something. I could either make a SqueakSource repository for all this or put it in the Cryptography package. Or I can email anyone the mcz files off list that would like them. Let me know how to proceed when you get a chance. Thanks Paul

3 5

Re: [Cryptography Team] bcrypt password hashing
by Paul DeBruicker 23 Apr '11

23 Apr '11

> Germán Arduino garduino at gmail.com > Fri Apr 22 20:11:18 UTC 2011 > Previous message: [Cryptography Team] bcrypt password hashing > Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] > > Really a coincidence because just TODAY I started implementing > Blowfish in Squeak (Is on my > todo list from years). I'm only starting and deciding somethings about > implementation, but > if all go well I will relese it as MIT. > > My sources of examples and info are: > > - The examples in other languages in the site of Bruce Schneier; > - The visual works implementation and > - A PHP implementation I found in snipplr. > > My idea, in addition to implementing, is develop (just for > training/fun) some UI to play with it. > > Let me know if I can help. > > Cheers. > Oh yes I'm sure you can definitely help. I'll send you what I have now off-list. Or maybe it'd be better to put it up on squeaksource. As you are already an admin on the Cryptography pacakge how about I send you what I have and we go from there? What I have does not work. But in the past 30 minutes I just learned about modular addition and WordArrays so maybe things are looking up. Also I'm not sure but I've been looking at the reference version (in Java) from Schneier's website and I think that there are some differences between it and the OpenBSD version I linked to earlier. Thanks and I'm glad for the coincidence. Paul

2 1

bcrypt password hashing
by Paul DeBruicker 22 Apr '11

22 Apr '11

Hi - I've never implemented any cryptographic algorithms before but I'm trying to make an implementation of the bcrypt password hashing algorithm [1] in Pharo. I'm using the OpenBSD C implementation [2] as a reference. To make it work I need a port of the Blowfish algorithm and am also using the OpenBSD C blowfish implementation [3] as a reference. With what I have so far my "blowfish" can accurately encrypt and decrypt a string using a key. But the encrypted string does not match any of the reference implementations. I can take '0123456789' and encrypt it with the key 'AAAAA' and decrypt the result and get '0123456789' but my encrypted string is different than the C or Java encrypted string. So I believe I've done something wrong. I think my Feistel Network method is wrong because it eventually starts returning increasingly large 5 byte integers rather than the 4 bytes integers it should. At least that's my current guess about the problem. Is there an open source version of Blowfish in Smalltalk I could look at to see where I may be going wrong? Thanks Paul [1] http://www.usenix.org/events/usenix99/provos.html & http://codahale.com/how-to-safely-store-a-password/ [2] http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/crypt/bcrypt.c [3] http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/crypt/blowfish.c

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Cryptography April 2011