I was testing my authorization implementation. I'm using bcrypt for some login information. While testing I shortened the key (just to try out a different key) and to my suprise, it validated as a working key. This doesn't seem to be the case with shorter keys (like "hello" and "hell").
I was wondering if this is an expected behaviour or if this is a bug with the library. I suspect that this isn't the expected behaviour. The library I'm using is this one, and here is this same question as an issue.
"Shorter key" should "not work with bcrypt" in {
val key = "b5c805cf4f1ccd534ad36c4480c835c57caf487dec1953568d486e0af70147f1872b2592c2491dde0eb7ebf8efd27bd3bd9db3dc2e33c0ac94144a1a40bac65a95fcf5ae2b3298c478da86346b6f1e1a57cba70a97ade3d3df821faf646f2d4cb4506bd98d1239b215bb590edbed7c8b6a957a1898889e5d49d53546f71100cf0a2a0880f9625a8d17e2efe0d45c99d9906a6a06a5baee710918e37361574e56bff5ded7fc98c73f20b0cf9e42e59106683e9e60f372b4263ba2ae3dce1f19fb5ba17141f01575c4d7eb7754485fb7eb0353c47a48ca0cc53ce725ff15cf96caa86bf0680edb4414cfc1e4f5c86a8d03d1436abbc72e0c0bc7c33866c19b778520974f279b0c6b1a0f6d5e5544581cc0d85a514b1f4953668c854ec644bf29c7cc669f95ffcba3bdc12382bbaa6df3c3667d1e119c26f502f30b5538003971b8c69cdb175ab41406dcd73977d2290706c4c2bd0eedebcab3c7ba4e0a8f1fb1752963ff375d2598c14a2c412ecfd5e51d9a52625adb67c97117cbb28caca75b70eec1e549fee56d80a92216b2c371206e9e8055419577b0e2fed123fe293e70bce784d111e668b86b51d526462ada227b2216092ecd19002ecfd1a4a7ad7bd2be6009c3ab7e58dedf19d06238619524e7b8fc49cfaa2ae891b40cb54b04834af2a784fc744386ff3d821d8c5a998c742dad8b93ec7338c6583a70ab9222e57192"
val shorterKey = "b5c805cf4f1ccd534ad36c4480c835c57caf487dec1953568d486e0af70147f1872b2592c2491dde0eb7ebf8efd27bd3bd9db3dc2e33c0ac94144a1a40bac65a95fcf5ae2b3298c478da86346b6f1e1a57cba70a97ade3d3df821faf646f2d4cb4506bd98d1239b215bb590edbed7c8b6a957a1898889e5d49d53546f71100cf0a2a0880f9625a8d17e2efe0d45c99d9906a6a06a5baee710918e37361574e56bff5ded7fc98c73f20b0cf9e42e59106683e9e60f372b4263ba2ae3dce1f19fb5ba17141f01575c4d7eb7754485fb7eb0353c47a48ca0cc53ce725ff15cf96caa86bf0680edb4414cfc1e4f5c86a8d03d1436abbc72e0c0bc7c33866c19b778520974f279b0c6b1a0f6d5e5544581cc0d85a514b1f4953668c854ec644bf29c7cc669f95ffcba3bdc12382bbaa6df3c3667d1e119c26f502f30b5538003971b8c69cdb175ab41406dcd73977d2290706c4c2bd0eedebcab3c7ba4e0a8f1fb1752963ff375d2598c14a2c412ecfd5e51d9a52625adb67c97117cbb28caca75b70eec1e549fee56d80a92216b2c371206e9e8055419577b0e2fed123fe293e70bce784d111e668b86b51d526462ada227b2216092ecd19002ecfd1a4a7ad7bd2be6009c3ab7e58dedf19d06238619524e7b8fc49"
val evenShorterKey = "b5c805cf4f1ccd534ad36c4480c835c57caf487dec1953568d486e0af70147f1872b2592c2491dde0eb7ebf8efd27bd3bd9db3dc2e33c0ac94144a1a40bac65a95fcf5ae2b3298c478da86346b6f1e1a57cba70a97ade3d3df821faf646f2d4cb4506bd98d1239b215bb590edbed7c8b6a957a1898889e5d49d53546f71100cf0a2a0880f9625a8d17e2efe0d45c99d9906a6a06a5baee710918e37361574e56bff5ded7fc98c73f20b0cf9e42e59106683e9e60f372b4263ba2ae3dce1f19fb5ba17141f01575c4d7eb7754485fb7eb0353c47a48ca0cc53ce725ff15cf96caa86bf0680edb4414cfc1e4f5c86a8d03d1436abbc72e0c0bc7c33866c19b778520974f279b0c6b1a0f6d5e5544581cc0d85a514b1f4953668c854ec644bf29c7cc669f95ffcba3bdc12382bbaa6df3c3667d1e119c26f502f30b5538003971b8c69cdb175ab41406dcd73977d2290706c4c2bd0eedebcab3c7ba4e0a8f1fb1752963ff375d2598c14a2c412ecfd5e51d9a52625adb67c97117cbb28caca75b70eec1e549fee56d80a92216b2c371206e9e8055419577b0e2f"
val bcryptedKey = "$2a$12$gF8jgmfUpYPvjX0FsVadhugiwuiEpt1.jdOg3GCQB1aqFGdt1Kr5G"
key.isBcryptedSafe(bcryptedKey) should be(Success(true))
shorterKey.isBcryptedSafe(bcryptedKey) should be(Success(false))
evenShorterKey.isBcryptedSafe(bcryptedKey) should be(Success(false))
}
Looking forward for your answer. For now I'll be adding a hashing step in between and hoping that works.