A Lua wrapper for OpenBSD's bcrypt.

Requirements

lua >= 5.1

Installation

$ luarocks install bcrypt

Usage

localbcrypt=require("lua-bcrypt")
-- Bigger numbers here will make your digest exponentially harder to computelocallog_rounds=9localdigest=bcrypt.digest("password", log_rounds)
assert(bcrypt.verify("password", digest))

require("bcrypt") vs require("lua-bcrypt")

Before lua-bcrypt 2.3-2 you had to use require("bcrypt"). I will never drop support for this so you don't need to modify existing software unless you also want it to run on Windows.

Windows has a system DLL called bcrypt.dll and the name clash makes require("bcrypt") not work. If you want your software to run on Windows you must use require("lua-bcrypt")

Security concerns

Lua will keep plaintext passwords around in memory as part of its string interning mechanism. As far as I'm aware, there's nothing I can do about this.

Tuning

If you would like to automatically tune the number of rounds to your hardware, you can include a function like:

functionbcrypt.tune(t)
localSAMPLES=10localrounds=5whiletruedolocaltotal=0fori=1, SAMPLESdolocalstart=os.clock()
bcrypt.digest("asdf", rounds)
localdelta=os.clock() -starttotal=total+deltaendif (total/SAMPLES) *1000>=tthenreturnrounds-1endrounds=rounds+1endend

This function returns the largest load factor such that bcrypt.digest(str, work) takes less than t milliseconds.