Created
August 22, 2015 18:57
-
-
Save paulohrpinheiro/b6e2f8e9bc60b9fc2889 to your computer and use it in GitHub Desktop.
Módulo Perl para resolver meu problema.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
package Util::Password; | |
use strict; | |
use warnings; | |
use Crypt::Eksblowfish::Bcrypt; | |
use Crypt::Random; | |
sub Encrypt { | |
my $password = shift; | |
# Generate a random salt if not passed | |
my $salt = shift || Crypt::Eksblowfish::Bcrypt::en_base64(Crypt::Random::makerandom_octet(Length=>16));; | |
# Set the cost to 13 and append a NUL | |
my $settings = '$2a$13$'.$salt; | |
# Encrypt it | |
return Crypt::Eksblowfish::Bcrypt::bcrypt($password, $settings); | |
} | |
sub Check { | |
my $plain_password = shift; | |
my $hashed_password = shift; | |
# Regex to extract the salt | |
if ($hashed_password =~ m!^\$2a\$\d{2}\$([A-Za-z0-9+\\./]{22})!) { | |
# Use a letter by letter match rather than a complete string match to avoid timing attacks | |
my $match = Encrypt($plain_password, $1); | |
my $bad = 0; | |
for (my $n=0; $n < length $match; $n++) { | |
$bad++ if substr($match, $n, 1) ne substr($hashed_password, $n, 1); | |
} | |
return $bad == 0; | |
} else { | |
return 0; | |
} | |
} | |
1; |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment