What is the pool of characters used in a BCRYPT hash

user_3536236 0
Viewed 26

I was looking for answers on BCRYPT specific resources but found the anwser within PHP's documentation for crypt.

I have an issue whereby I need to do some REGEX to clean a BCRYPT hash (generated by PHP password_hash function using PASSWORD_BCRYPT). I want to be able to know the characters that could theoretically appear in the BCRYPT hash so that REGEX can remove all other characters from a string.

I have read all about various bits of BCrypt, it's history and its development but I have not come across anywhere that states for canon what a BCRYPT hash can contain.

Current understanding is:

*, 0-9, a-z, A-Z, $, . \

Does BCRYPT contain any ascii character? (edit: no) I see it contains many but going through the many BCRYPT hashes I can find is not a good methodology for being sure. For example, BCRYPT hash does NOT seem to contain = or ¬ or a few other characters that, -for want of a better description- have small UTF-8 definitions.

This is using a PHP interface if that changes how BCRYPT outputs hashes.

bcrypt php
1 Answers

I found the answer on the PHP Crypt Function page:

CRYPT_BLOWFISH - Blowfish hashing with a salt as follows: "$2a$", "$2x$" or "$2y$", a two digit cost parameter, "$", and 22 characters from the alphabet "./0-9A-Za-z". Using characters outside of this range in the salt will cause crypt() to return a zero-length string

So this PHP/BCRYPT Hash will use characters from:

$,./0-9A-Za-z range.

user_35362360
Related