How can bcrypt have built-in salts?

前端 未结 4 717
终归单人心
终归单人心 2020-11-22 10:12

Coda Hale\'s article "How To Safely Store a Password" claims that:

bcrypt has salts built-in to prevent rainbow table attacks.

4条回答
  •  庸人自扰
    2020-11-22 11:00

    This is from PasswordEncoder interface documentation from Spring Security,

     * @param rawPassword the raw password to encode and match
     * @param encodedPassword the encoded password from storage to compare with
     * @return true if the raw password, after encoding, matches the encoded password from
     * storage
     */
    boolean matches(CharSequence rawPassword, String encodedPassword);
    

    Which means, one will need to match rawPassword that user will enter again upon next login and matches it with Bcrypt encoded password that's stores in database during previous login/registration.

提交回复
热议问题