Node.bcrypt.js: API: 'salt' parameter as a number for hash method?

[youngrrrr]

Hi there,

I was going through the documentation and I saw the following description for the salt parameter of the hash(data, salt, cb) method:

salt - [REQUIRED] - the salt to be used to hash the password. if specified as a number then a salt will be generated and used (see examples).

(note that there were no examples, afaik, for me to reference)

The description is unclear to me. Is it saying that if I pass in a number value, say numSaltRounds, in place of an actual salt, that a salt will be created based on numSaltRounds rounds?

That is to say that the following two function calls would have identical results:

Technique 1:

var bcrypt = require('bcrypt');
var numSaltRounds = 10;
bcrypt.genSalt(numSaltRounds, function(err, salt) {
    bcrypt.hash('someplaintextpassword', salt, function(err, hash) {
        // Store hash in your password DB.
    });
});

Technique 2:

var bcrypt = require('bcrypt');
var numSaltRounds = 10;
bcrypt.hash('someplaintextpassword', numSaltRounds, function(err, hash) {
        // Store hash in your password DB.
    });
});

If it is indeed the case that both the above techniques are the same, then:

1. I think the description for the salt parameter could be updated to be more descriptive... (I'd be happy to do this) and
2. as a follow up question, is there any disadvantage from/reason against using Technique 2 over Technique 1? I personally find Technique 2 much easier to read and implement.

Thanks for reading!

[johnmanko]

That's not my understanding of how hash works. genSalt will generate a random salt, and the numSaltRounds just tells the function how many times to generate a salt, which increases the "randomness" of the final salt that is passed to your function(err, salt) function. In order words, numSaltRounds is not the salt but an iteration count. The hash function accepts an actual salt, not an iteration count. So, you're first technique is the correct one.

[youngrrrr]

Hey @johnmanko, thanks for your reply! I hope we'll be able to figure this out together :)

I understand and am in agreement with what you described as the general use for the hash function. However, the core of my confusion revolves around the API documentation part that reads:

"if [the salt parameter is] specified as a number then a salt will be generated and used."

It seems this contradicts your statement that the hash function does not accept an "iteration count" (as per your words) since there is mention of a numeric value. A salt is clearly being generated and used somewhere. After all, the output of the function is a hashed password. It would make the most sense, then, for this numeric value of the salt-parameter to correspond to the iteration count (what other value could it possibly represent?).

However, I am unable to find evidence for this in either the documentation or the source code (I also don't know C++ so I might've missed it). Further, as per the docs/README, there is no explanation as to why a convoluted method (i.e. Technique 1) seems to be preferred over a much simpler one (i.e. Technique 2).

I'm trying to both:

1. confirm my suspicions and
2. get an answer for the difference(s) between the two techniques.

[johnmanko]

Here is the code the for the hash function:

module.exports.hash = function(data, salt, cb) {
    if (typeof data === 'function') {
        return process.nextTick(function() {
            data(new Error('data must be a string and salt must either be a salt string or a number of rounds'));
        });
    }

    if (typeof salt === 'function') {
        return process.nextTick(function() {
            salt(new Error('data must be a string and salt must either be a salt string or a number of rounds'));
        });
    }

    if (data == null || salt == null) {
        return process.nextTick(function() {
            cb(new Error('data and salt arguments required'));
        });
    }

    if (typeof data !== 'string' || (typeof salt !== 'string' && typeof salt !== 'number')) {
        return process.nextTick(function() {
            cb(new Error('data must be a string and salt must either be a salt string or a number of rounds'));
        });
    }

    if (!cb || typeof cb !== 'function') {
        return;
    }

    if (typeof salt === 'number') {
        return module.exports.genSalt(salt, function(err, salt) {
            return bindings.encrypt(data, salt, cb);
        });
    }

    return bindings.encrypt(data, salt, cb);
};

[defunctzombie]

Neither technique is preferred and you can use either one depending on your use case. I use technique 2 but we have technique 1 for backwards compatibility.

[youngrrrr]

@johnmanko The issue's been resolved but I'm just curious where you found that code?

Dear lord I've been looking in the /src folder this whole time without realizing the bcrypt.js file at the root. Whoops - my bad.