Wondering what’s next for npm?Check out our public roadmap! »

    nan-bcrypt

    0.7.9 • Public • Published

    nan-bcrypt

    Build Status

    A nan-ification of node.bcrypt.js to make it compiles nicely on the latest (0.11.13) version of node. It uses nan from rvagg.

    While node.bcrypt.js is a lib to help you hash passwords. bcrypt on wikipedia

    Catalyst for node.bcrypt.js module: How To Safely Store A Password

    If you want to use node.bcrypt.js on stable releases of node please take a look at the original node.bcrypt.js version.

    Security Issues/Concerns

    As should be the case with any security tool, this library should be scrutinized by anyone using it. If you find or suspect an issue with the code- please bring it to my attention and I'll spend some time trying to make sure that this tool is as secure as possible.

    To make it easier for people using this tool to analyze what has been surveyed, here is a list of BCrypt related security issues/concerns as they've come up.

    • An issue with passwords was found with a version of the Blowfish algorithm developed for John the Ripper. This is not present in the OpenBSD version and is thus not a problem for this module. HT zooko.

    Dependencies

    • nodejs (0.11.13)
    • node-gyp
    • Please check the dependencies for this tool at: https://github.com/TooTallNate/node-gyp/
    • Windows users will need the options for c# and c++ installed with their visual studio instance.
    • Python 2.x
    • OpenSSL - This is only required to build the bcrypt project if you are using versions <= 0.7.7. Otherwise, we're using the builtin node crypto bindings for seed data (which use the same OpenSSL code paths we were, but don't have the external dependency).
    • nan - This is the magic layer to make node.bcrypt.js compiles on unstable node version (0.11.13)

    Install via npm

    npm install nan-bcrypt
    

    Note: OS X users using Xcode 4.3.1 or above may need to run the following command in their terminal prior to installing if errors occur regarding xcodebuild: sudo xcode-select -switch /Applications/Xcode.app/Contents/Developer

    Usage

    async (recommended)

    To hash a password:

    var bcrypt = require('bcrypt');
    bcrypt.genSalt(10, function(err, salt) {
        bcrypt.hash("B4c0/\/", salt, function(err, hash) {
            // Store hash in your password DB.
        });
    });

    To check a password:

    // Load hash from your password DB.
    bcrypt.compare("B4c0/\/", hash, function(err, res) {
        // res == true
    });
    bcrypt.compare("not_bacon", hash, function(err, res) {
        // res == false
    });

    Auto-gen a salt and hash:

    bcrypt.hash('bacon', 8, function(err, hash) {
    });

    sync

    To hash a password:

    var bcrypt = require('bcrypt');
    var salt = bcrypt.genSaltSync(10);
    var hash = bcrypt.hashSync("B4c0/\/", salt);
    // Store hash in your password DB.

    To check a password:

    // Load hash from your password DB.
    bcrypt.compareSync("B4c0/\/", hash); // true
    bcrypt.compareSync("not_bacon", hash); // false

    Auto-gen a salt and hash:

    var hash = bcrypt.hashSync('bacon', 8);

    API

    BCrypt.

    • genSaltSync(rounds)
      • rounds - [OPTIONAL] - the number of rounds to process the data for. (default - 10)
    • genSalt(rounds, cb)
      • rounds - [OPTIONAL] - the number of rounds to process the data for. (default - 10)
      • cb - [REQUIRED] - a callback to be fired once the salt has been generated. uses eio making it asynchronous.
        • err - First parameter to the callback detailing any errors.
        • salt - Second parameter to the callback providing the generated salt.
    • hashSync(data, salt)
      • data - [REQUIRED] - the data to be encrypted.
      • salt - [REQUIRED] - the salt to be used in encryption.
    • hash(data, salt, cb)
      • data - [REQUIRED] - the data to be encrypted.
      • salt - [REQUIRED] - the salt to be used to hash the password. if specified as a number then a salt will be generated and used (see examples).
      • cb - [REQUIRED] - a callback to be fired once the data has been encrypted. uses eio making it asynchronous.
        • err - First parameter to the callback detailing any errors.
        • encrypted - Second parameter to the callback providing the encrypted form.
    • compareSync(data, encrypted)
      • data - [REQUIRED] - data to compare.
      • encrypted - [REQUIRED] - data to be compared to.
    • compare(data, encrypted, cb)
      • data - [REQUIRED] - data to compare.
      • encrypted - [REQUIRED] - data to be compared to.
      • cb - [REQUIRED] - a callback to be fired once the data has been compared. uses eio making it asynchronous.
        • err - First parameter to the callback detailing any errors.
        • same - Second parameter to the callback providing whether the data and encrypted forms match [true | false].
    • getRounds(encrypted) - return the number of rounds used to encrypt a given hash
      • encrypted - [REQUIRED] - hash from which the number of rounds used should be extracted.

    Hash Info

    The characters that comprise the resultant hash are ./ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789$.

    Testing

    If you create a pull request, tests better pass :)

    npm install
    npm test
    

    Credits

    The code for this comes from a few sources:

    Contributors via the original node.bcrypt.js

    License

    Unless stated elsewhere, file headers or otherwise, the license as stated in the LICENSE file.

    Install

    npm i nan-bcrypt

    DownloadsWeekly Downloads

    1

    Version

    0.7.9

    License

    none

    Last publish

    Collaborators

    • avatar