SA-MP Forums Archive
[Plugin] Bcrypt - Printable Version

+- SA-MP Forums Archive (https://sampforum.blast.hk)
+-- Forum: SA-MP Scripting and Plugins (https://sampforum.blast.hk/forumdisplay.php?fid=8)
+--- Forum: Plugin Development (https://sampforum.blast.hk/forumdisplay.php?fid=18)
+--- Thread: [Plugin] Bcrypt (/showthread.php?tid=453544)

Pages: 1 2

Re: Bcrypt - Johnson_boy - 06.08.2013

Support for Windows added, precompiled binary (dll) is now available.

Respuesta: Bcrypt - GutierrezDeVelasco - 25.01.2014

I need some help with this, i cant seem to find the plugin file but there is a c++ file named plugin and what do i do with all those c++ files i have no idea.
please help

Respuesta: Bcrypt - GutierrezDeVelasco - 25.01.2014

lol nevermind i downloaded the wrong file :P

Re: Bcrypt - Kaperstone - 20.07.2014

I have a few questions

Re: Bcrypt - Johnson_boy - 21.07.2014

Quote:
Originally Posted by xkirill
View Post
I have a few questions
  • Does it work with CentOS ?
  • And how do I know what is the maximum cost I can put in ?
  • If I change the cost someday with already a few accounts hashed with the previous cost, will their password still work after I change the cost ?
1. I'm not quite sure whether or not the plugin will compile on CentOS. The plugin requires C++11 or C++0x, which are present on most modern OSes, but I've never used CentOS, so I can't speak for it.

2. The minimum cost is 4 and the maximum cost is 31. However, you should find a cost that takes about 100-300 ms to calculate on the specific server in question. You can do this for instance by measuring the time using GetTickCount() and trying a couple of different costs. Usually costs 10-12 are suitable.

3. You can freely change the cost on the fly, and the old hashes will still work. Bcrypt_check will work regardless of the cost of the hash (which is identified automatically).

If you're ever planning to change the cost, it is recommended to update the old hashes as well when a player signs in. You can use function bcrypt_needs_rehash to check if the password needs to be rehashed and updated in the database. I could add an example of this to the repository.

Re: Bcrypt - maddinat0r - 21.07.2014

The highest compiler version on CentOS 6 is gcc 4.4, which supports almost none of the C++11 features. Only CentOS 7 (gcc 4.7.x) has proper support for C++11. So only CentOS 7 can run this plugin and I also encourage every server owner to upgrade to CentOS 7 (if you are using CentOS 6 ofc), because not using C++11 features really sucks if you are a plugin developer.

Re: Bcrypt - Sonical - 28.07.2014

Nice working

Re: Bcrypt - Kaperstone - 28.08.2014

In the example
pawn Code:
bcrypt_check(playerid, BCRYPT_LOGIN, inputtext, hash);
I believe it should be
pawn Code:
bcrypt_check(inputtext, hash, "OnPasswordChecked", "d",playerid);


Re: Bcrypt - Kaperstone - 18.11.2014

I am running the plugin on Debian 7.7, gcc version 4.7.2-5
The plugin loads and everything looks fine on the server log, but the callbacks are never called.
I put a print function in, to indicate when the callback is being called but it never prints it nor updates the password.
Quote:

[03:18:06] plugin.bcrypt: The plugin is up-to-date.
[03:18:05] Loading plugin: bcrypt-samp.so
[03:18:05] plugin.bcrypt v2.2.2 was loaded.
[03:18:05] plugin.bcrypt: 5 cores detected, 4 threads will be used.
[03:18:05] Loaded.
On my localhost - Win7 64bit it loads and works fine.

Re: Bcrypt - Johnson_boy - 20.11.2014

Quote:
Originally Posted by xkirill
View Post
I am running the plugin on Debian 7.7, gcc version 4.7.2-5
The plugin loads and everything looks fine on the server log, but the callbacks are never called.
I put a print function in, to indicate when the callback is being called but it never prints it nor updates the password.

On my localhost - Win7 64bit it loads and works fine.
Are you using bcrypt-samp-v2.2.2-debian_7.tar.gz from the Releases page on GitHub?

Re: Bcrypt - Kaperstone - 21.11.2014

Quote:
Originally Posted by Johnson_boy
View Post
Are you using bcrypt-samp-v2.2.2-debian_7.tar.gz from the Releases page on GitHub?
Yes. (just not compressed tar)

bcrypt-samp.so -> plugins
bcrypt.inc -> includes

Re : Bcrypt - Maxime_Creteur - 25.11.2014

Hello,
You have define password_hash for PHP but not connecting to panel for password bcrypt?

Re : Bcrypt - Nealll - 28.11.2014

Hello,
I am currently developing a panel samp and I use this plugin but I have trouble with the transition pawn - php ( password_verify (), password_hash ()).
A little help please , thank you

(sorry for my english , I'm french x))

Re: Re : Bcrypt - Johnson_boy - 28.11.2014

Quote:
Originally Posted by Nealll
View Post
Hello,
I am currently developing a panel samp and I use this plugin but I have trouble with the transition pawn - php ( password_verify (), password_hash ()).
A little help please , thank you

(sorry for my english , I'm french x))
Simply fetch the password hash from the database and use password_verify($password , $hash) to check if the password given by the user matches the hash fetched from the database.

Re : Bcrypt - Nealll - 29.11.2014

I have given the hash password and compare it to that of the database?
Thank

Re: Bcrypt - Kaperstone - 01.12.2014

Quote:

[13:01:48] plugin.bcrypt v2.2.3 was loaded.
[13:01:48] plugin.bcrypt: 5 cores detected, 4 threads will be used.
[13:01:48] Loaded.
[13:01:49] plugin.bcrypt: A new revision is available:
[13:01:49] plugin.bcrypt: Current version: 2.2.2
[13:01:49] plugin.bcrypt: Latest version: 2.2.3
[13:01:49] plugin.bcrypt: Download: http://api.ls-rcr.com/bcrypt/?upgrade
[13:01:49] plugin.bcrypt: Upgrading is recommended.
Downloaded v2.2.3 and updated the files.
it continues to say that there is a new version although it say above that it loaded version 2.2.3
Quote:
Originally Posted by Nealll
View Post
I have given the hash password and compare it to that of the database?
Thank
Yes with password_verify($input, $hashed_password_from_db);

Re : Bcrypt - Nealll - 01.12.2014

It's impossible because even if you enter exactly the same caracrtere chain, bcrypt hash of another ways ...

Show me a code example ^^

Re: Bcrypt - Johnson_boy - 01.12.2014

Quote:
Originally Posted by xkirill
View Post
Downloaded v2.2.3 and updated the files.
it continues to say that there is a new version although it say above that it loaded version 2.2.3

Yes with password_verify($input, $hashed_password_from_db);
Did you remember to update bcrypt.inc and recompile the script? It seems to work fine for me

Quote:
Originally Posted by Nealll
View Post
It's impossible because even if you enter exactly the same caracrtere chain, bcrypt hash of another ways ...

Show me a code example ^^
This is the basic idea:
PHP Code:
<?php
$password = 'Hello World!';
$hash = '$2y$12$D62QnfKU1bYMTode2W7UVeMb7maqY.Y7TCdWgQzj44HuOBK47Ej1Wl';
if(password_verify($password, $hash))
{
    // Match
}
else
{
    // No match
}
And something like this might resemble the actual use case:

PHP Code:
<?php
/**
 * Attempt to login using the given username and password. (simple example)
 * @param  string $username The username given by the user
 * @param  string $password The password given give the user
 * @return boolean            True if the login was successful, otherwise false
 */
public function login($username, $password)
{
    $success = false;
    $get_password_q = "SELECT `id`, `password` FROM `users` WHERE `username` = ?";
    if($stmt = $db->prepare($get_password_q))
    {
        $stmt->bind_param("s", $username);
        $stmt->execute();
        $stmt->store_result();
        $stmt->bind_result($id, $hash);
        if($stmt->num_rows)
        {
            if(password_verify($password, $hash))
            {
                // Correct password
                $success = true;
            }
            else
            {
                // Wrong password
            }
        }
        else
        {
            // The user does not exist
        }
        $stmt->close();
    }
    return $success;
}


Re: Bcrypt - ProKillerpa - 01.12.2014

Nice

Re : Bcrypt - Nealll - 02.12.2014

Ok. Thanks you.