bcrypt-pbkdf

Port of the OpenBSD bcrypt_pbkdf function to pure Javascript. npm-ified version of Devi Mandiri's port, with some minor performance improvements. The code is copied verbatim (and un-styled) from Devi's work.

This product includes software developed by Niels Provos.

API

bcrypt_pbkdf.pbkdf(pass, passlen, salt, saltlen, key, keylen, rounds)

Derive a cryptographic key of arbitrary length from a given password and salt, using the OpenBSD bcrypt_pbkdf function. This is a combination of Blowfish and SHA-512.

See this article for further information.

Parameters:

• pass, a Uint8Array of length passlen
• passlen, an integer Number
• salt, a Uint8Array of length saltlen
• saltlen, an integer Number
• key, a Uint8Array of length keylen, will be filled with output
• keylen, an integer Number
• rounds, an integer Number, number of rounds of the PBKDF to run

bcrypt_pbkdf.hash(sha2pass, sha2salt, out)

Calculate a Blowfish hash, given SHA2-512 output of a password and salt. Used as part of the inner round function in the PBKDF.

Parameters:

• sha2pass, a Uint8Array of length 64
• sha2salt, a Uint8Array of length 64
• out, a Uint8Array of length 32, will be filled with output

License

This source form is a 1:1 port from the OpenBSD blowfish.c and bcrypt_pbkdf.c. As a result, it retains the original copyright and license. The two files are under slightly different (but compatible) licenses, and are here combined in one file. For each of the full license texts see LICENSE.

Similar packages

Other packages similar to bcrypt-pbkdf

pbkdf2

The pbkdf2 package is a pure JavaScript implementation of PBKDF2 (Password-Based Key Derivation Function 2). It is similar to bcrypt-pbkdf in that it provides functionality for securely deriving keys from passwords. However, pbkdf2 does not use bcrypt as its pseudorandom function, which may make it less resistant to brute-force attacks compared to bcrypt-pbkdf.

argon2

Argon2 is another key derivation function that won the Password Hashing Competition and is considered one of the most secure options for password hashing and key derivation. Unlike bcrypt-pbkdf, which uses bcrypt in its PBKDF2 implementation, Argon2 has its own unique algorithm designed to be highly resistant against brute-force attacks. It offers configurable memory, CPU, and parallelism to make it difficult for attackers to optimize their attack.