I am new to crypto and c# and am doing a personal project on learning about password hashing. I wasn't quite sure if I should use the NuGet package BCrypt.Net-Next v3.1.3 or BCrypt.Net official v0.1.109 as it is from 2013 but seems to work fine.



Having looked at the documentation, bcrypt.net-next seems to be a port from BCrypt.Net, with some sensible improvements.

Maybe the most important improvement is compatibility with other platforms, e.g. PHP with its $2y signature. The BCrypt.Net source code doesn't seem to support this signature.

The advantage from pre hashing of long passwords is somewhat theoretical, passwords longer than 72 characters are more than strong enough to be truncated, on the other side, pre hashing could make your hashes less compatible. As I understand it, the pre hashing is only done when using BCrypt.EnhancedHashPassword() instead of BCrypt.HashPassword(), which seems to be backwards compatible.

bcrypt.net-next is built with Dotnet Standard, so it should run cross platform.

So I would go for bcrypt.net-next then, I cannot see any disadvantages.

  • Thanks for the great info! Out of curiosity, while the bcrypt.net-next is better, is there any downside/vulnerabilities from still using the old version?
    – Aszuria
    Jun 6 '19 at 23:37
  • @Aszuria - The security comes from the algorithm, not from the implementation. So as long as the salt is generated correctly, it should not matter which library you use, even more you can switch between them any time. Jun 7 '19 at 6:47

BCrypt.Net-Next's github readme says:

Porting of bcrypt.codeplex.com with enhanced security, missing fixes, features and better .net support.

Which is your other option. So I would go for the enhanced version if I were you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.