Skip to content

Instantly share code, notes, and snippets.

@paulohrpinheiro
Created August 22, 2015 18:57
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save paulohrpinheiro/b6e2f8e9bc60b9fc2889 to your computer and use it in GitHub Desktop.
Save paulohrpinheiro/b6e2f8e9bc60b9fc2889 to your computer and use it in GitHub Desktop.
Módulo Perl para resolver meu problema.
package Util::Password;
use strict;
use warnings;
use Crypt::Eksblowfish::Bcrypt;
use Crypt::Random;
sub Encrypt {
my $password = shift;
# Generate a random salt if not passed
my $salt = shift || Crypt::Eksblowfish::Bcrypt::en_base64(Crypt::Random::makerandom_octet(Length=>16));;
# Set the cost to 13 and append a NUL
my $settings = '$2a$13$'.$salt;
# Encrypt it
return Crypt::Eksblowfish::Bcrypt::bcrypt($password, $settings);
}
sub Check {
my $plain_password = shift;
my $hashed_password = shift;
# Regex to extract the salt
if ($hashed_password =~ m!^\$2a\$\d{2}\$([A-Za-z0-9+\\./]{22})!) {
# Use a letter by letter match rather than a complete string match to avoid timing attacks
my $match = Encrypt($plain_password, $1);
my $bad = 0;
for (my $n=0; $n < length $match; $n++) {
$bad++ if substr($match, $n, 1) ne substr($hashed_password, $n, 1);
}
return $bad == 0;
} else {
return 0;
}
}
1;
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment