Class: Authlogic::CryptoProviders::Bcrypt

Inherits:
Object
  • Object
show all
Defined in:
lib/authlogic/crypto_providers/bcrypt.rb

Overview

Bcrypt

For most apps Sha512 is plenty secure, but if you are building an app that stores the nuclear launch codes you might want to consier BCrypt. This is an extremely secure hashing algorithm, mainly because it is slow. A brute force attack on a BCrypt encrypted password would take much longer than a brute force attack on a password encrypted with a Sha algorithm. Keep in mind you are sacrificing performance by using this, generating a password takes exponentially longer than any of the Sha algorithms. I did some benchmarking to save you some time with your decision:

require "bcrypt"
require "digest"
require "benchmark"

Benchmark.bm do |x|
  x.report("BCrypt:") { BCrypt::Password.create("mypass") }
  x.report("Sha512:") { Digest::SHA512.hexdigest("mypass") }
end

          user     system      total        real
BCrypt:  0.110000   0.000000   0.110000 (  0.113493)
Sha512:  0.010000   0.000000   0.010000 (  0.000554)

Decided BCrypt is for you? Just insall the bcrypt gem:

gem install bcrypt-ruby

Class Attribute Summary collapse

Class Method Summary collapse

Class Attribute Details

.cost ⇒ Object 



33
34
35
 
# File 'lib/authlogic/crypto_providers/bcrypt.rb', line 33

def cost
  @cost ||= 10
end

Class Method Details

.decrypt(crypted_pass) ⇒ Object

This does not actually decrypt the password, BCrypt is not reversible. The way the bcrypt library is set up requires us to do it this way.



43
44
45
 
# File 'lib/authlogic/crypto_providers/bcrypt.rb', line 43

def decrypt(crypted_pass)
  BCrypt::Password.create(crypted_pass)
end

.encrypt(pass) ⇒ Object 



38
39
40
 
# File 'lib/authlogic/crypto_providers/bcrypt.rb', line 38

def encrypt(pass)
  BCrypt::Password.create(pass, :cost => cost)
end