In this question:
Can someone explain how BCrypt verifies a hash?
Ian Boyd writes at the end of his answer:
Armed with this knowledge, you can now verify a password correctbatteryhorsestapler against the saved hash:
$2a$12$mACnM5lzNigHMaf7O1py1OLCBgGL4tYUF0N/4rS9CwDsI7ytwL4D6
I am using the following Perl program to attempt to verify this hash:
use Crypt::Eksblowfish::Bcrypt qw(bcrypt);
my $password = "correctbatteryhorsestapler";
my $hash = '$2a$12$mACnM5lzNigHMaf7O1py1OLCBgGL4tYUF0N/4rS9CwDsI7ytwL4D6';
print "Verifying password $password<br>with hash $hash<BR><BR>";
my $new_hash = bcrypt($password,$hash);
print "<pre>Original hash: " . $hash . "<br>" . "New hash: " . $new_hash . "</pre><br>";
if ($hash ne $new_hash) {
print "No match.";
}
The output of my program is as follows:
Verifying password correctbatteryhorsestapler
with hash $2a$12$mACnM5lzNigHMaf7O1py1OLCBgGL4tYUF0N/4rS9CwDsI7ytwL4D6
Original hash: $2a$12$mACnM5lzNigHMaf7O1py1OLCBgGL4tYUF0N/4rS9CwDsI7ytwL4D6
New hash: $2a$12$mACnM5lzNigHMaf7O1py1O3vlf6.BA8k8x3IoJ.Tq3IB/2e7g61Km
No match.
I wonder if, based on the information above, anyone can tell me what I am doing wrong with my Perl script (why it doesn't correctly validate the password)? If I use the hash my system generates, I do get a match:
Verifying password correctbatteryhorsestapler
with hash $2a$12$mACnM5lzNigHMaf7O1py1O3vlf6.BA8k8x3IoJ.Tq3IB/2e7g61Km
Original hash: $2a$12$mACnM5lzNigHMaf7O1py1O3vlf6.BA8k8x3IoJ.Tq3IB/2e7g61Km
New hash: $2a$12$mACnM5lzNigHMaf7O1py1O3vlf6.BA8k8x3IoJ.Tq3IB/2e7g61Km
I get the same result on two different systems (one CentOS running eksblowfish 0.009 and the other Win7 64-bit running eksblowfish 0.007, both running Perl 5.8.8).
I learn by doing, so I am hoping to understand why this isn't working for me.
