Compare two password hashes -- nodejs

Question

I am using a crypto https://nodejs.org/api/crypto.html for password encryption and authentication. I am working on the change password page and is having problem determining whether the password provided by the user has the same hash as the existing password. Below is my code.

var createSalt = function createSalt() {
    return crypto.randomBytes(128).toString('base64');
};

var hashPwd = function hashPwd(salt, pwd) {
    var hmac = crypto.createHmac('sha256', salt);
    return hmac.update(pwd).digest('hex');
};

//use password , create salt, hash and compare with the existing
var salt = createSalt();
var passHash = hashPwd(salt,data.Password);
console.log('the password is', user.PassHash === passHash);

I am expecting if the console message above to print true where existing user password match. However, the two hashes does not seem to match at all. Please what am i missing ? How do achieve this? I want to make sure users password match his existing password before he can change a new one. Any help would be appreciated.

score 17 · Accepted Answer · edited May 23 '17 at 12:24

I think your problem is in the salt. Usually you have to store the salt you used to hash the first time and reuse it the second time around. The reason for the salt is to make sure that the hash doesn't map to the original pass if some hacker would retrieve it from a compromised system (using a rainbow table attack). See Why do we use the "salt" to secure our passwords?

If you would try

var salt = crypto.randomBytes(128).toString('base64');

var hashPwd = function hashPwd(salt, pwd) {
    var hmac = crypto.createHmac('sha256', salt);
    return hmac.update(pwd).digest('hex');
};

//use password , create salt, hash and compare with the existing
var passHash = hashPwd(salt,data.Password);
console.log('the password is', user.PassHash === passHash);

It would work as long as you don't restart the server (assuming you store the salt var outside scope of the function invoked to respond to the http request).

A better solution (imo) is what bcrypt is doing. There you generate a salt per password, but to verify that a password is correct you use compare, which uses the salt stored in the hash. This way you can use different salts with each password, meaning you don't have to worry as much about a salt being compromised.

npm install bcrypt

…

var bcrypt = require('bcrypt');
var hash = bcrypt.hashSync("my password");

bcrypt.compareSync("my password", hash); // true
bcrypt.compareSync("not my password", hash); // false

There is also compareAsync and other async variants. See also: https://www.npmjs.com/package/bcrypt-nodejs

Oh thanks iwein, so i should use the same salt right. I mean instead of creating new salt i should use the one from the existing password. ? — Nuru Salihu, May 17 '16 at 15:07
@NuruSalihu yep, that's how I understand it. If your salt gets stolen, you have to reset all passwords and regenerate the salt. Often crypto libs allow you to compare a pass without passing a salt again (they store the salt inside the hashed pass). bcrypt does this for example http://stackoverflow.com/questions/6832445/how-can-bcrypt-have-built-in-salts — iwein, May 17 '16 at 15:52
@iwein this link tells the opposite: https://crackstation.net/hashing-security.htm Its not a good practice to reuse the salt. In the 4th section it explains why. This reading seems right to you? I'm brand new to this whole thing, but thought it may would be helpful. — Guilherme L. Moraes, Sep 14 '19 at 02:25
You shouldn't compare hashes with `===` which is sensitive to timing attacks.. use `crypto.timingSafeEqual` — Tofandel, Feb 12 '20 at 23:34

score 0 · Answer 2 · answered Sep 19 '17 at 21:07

 UserSchema.pre('save', function (next) {
  if (this.password) {
    const salt = bcrypt.genSaltSync(10);//or your salt constant
    this.password = bcrypt.hashSync(this.password, salt);
  }
  next();
});

in your controller

  const result = bcrypt.compareSync(req.body.password, your_hash_password);
      if (result){
        return res.json(message: "success");
      } else {
        return res.status(400).json("Bad request. Password don't match ");
      }

Compare two password hashes -- nodejs

2 Answers2