# Confused with bcrypt and Authlogic

**URL:** <https://www.ruby-forum.com/t/confused-with-bcrypt-and-authlogic/195491>\
**Category:** Rails\
**Created:** [September 23, 2010, 8:13pm UTC](https://www.ruby-forum.com/t/confused-with-bcrypt-and-authlogic/195491 "2010-09-23T20:13:58Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![CVCVCV](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c5a1d2/32.png) [@CVCVCV](https://www.ruby-forum.com/u/CVCVCV)\
**Post date:** [September 23, 2010, 8:13pm UTC](https://www.ruby-forum.com/t/confused-with-bcrypt-and-authlogic/195491/1 "2010-09-23T20:13:58Z")

</div>

I’m in the progress of migrating my website from using Authlogic to my  
own authentication solution for one reason or another and I’ve hit a  
little problem - I’ve set Authlogic to use bcrypt-ruby for passwords,  
and now I’m confused as to how I’m supposed to work with the library  
and authenticate existing users in my database.

For example, I registered a new user on my website with the password  
“test”. Here’s the hash and salt stored in the database:

ruby-1.9.2-p0 \> u.crypted\_password  
=\> “$2a$10$71.OHo9IrbKve9Mu7m.FNO6QRedkmGuue3/y/StdhlksBnvlL6GBS”  
ruby-1.9.2-p0 \> u.password\_salt  
=\> “Hki1ozSQrkmvGzddNJq”

One would assume that I would do something like this to check the  
password using the bcrypt library:

ruby-1.9.2-p0 \> BCrypt::Password.new("$2a  
$10$71.OHo9IrbKve9Mu7m.FNO6QRedkmGuue3/y/StdhlksBnvlL6GBS") == “hello”

…but the result is “false”. Do we need to work the salt in? And if  
yes, how? Trying to pass it as a constructor argument or trying the  
“salt” setter doesn’t work.

---

<div class="post-metadata">

**Author:** ![CVCVCV](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c5a1d2/32.png) [@CVCVCV](https://www.ruby-forum.com/u/CVCVCV)\
**Post date:** [September 23, 2010, 8:37pm UTC](https://www.ruby-forum.com/t/confused-with-bcrypt-and-authlogic/195491/2 "2010-09-23T20:37:40Z")

</div>

CV wrote:

> …but the result is “false”. Do we need to work the salt in? And if  
> yes, how? Trying to pass it as a constructor argument or trying the  
> “salt” setter doesn’t work.

You’re saving the crypted\_password and the salt that was used to create  
it, so the validation of a newly submitted password is to pass it  
through the same function and compare the end results…

Does Bcrypt of “newly submitted password” and u.password\_salt ==  
u.crypted\_password

---

<div class="post-metadata">

**Author:** ![CVCVCV](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c5a1d2/32.png) [@CVCVCV](https://www.ruby-forum.com/u/CVCVCV)\
**Post date:** [September 23, 2010, 8:46pm UTC](https://www.ruby-forum.com/t/confused-with-bcrypt-and-authlogic/195491/3 "2010-09-23T20:46:55Z")

</div>

Should you be using something like:

if BCrypt::Engine.hash\_secret(password, u.salt) == u.crypted\_password  
valid = true  
end

---

<div class="post-metadata">

**Author:** ![CVCVCV](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c5a1d2/32.png) [@CVCVCV](https://www.ruby-forum.com/u/CVCVCV)\
**Post date:** [September 23, 2010, 9:16pm UTC](https://www.ruby-forum.com/t/confused-with-bcrypt-and-authlogic/195491/4 "2010-09-23T21:16:37Z")

</div>

Well, I didn’t realize that there was a lower-level part to the  
library too! But unfortunately we’re not there yet:

ruby-1.9.2-p0 \> BCrypt::Engine.hash\_secret(“test”,  
“Hki1ozSQrkmvGzddNJq”)  
BCrypt::Errors::InvalidSalt: invalid salt

---

<div class="post-metadata">

**Author:** ![CVCVCV](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c5a1d2/32.png) [@CVCVCV](https://www.ruby-forum.com/u/CVCVCV)\
**Post date:** [September 23, 2010, 10:10pm UTC](https://www.ruby-forum.com/t/confused-with-bcrypt-and-authlogic/195491/5 "2010-09-23T22:10:55Z")

</div>

CV wrote:

> Well, I didn’t realize that there was a lower-level part to the  
> library too! But unfortunately we’re not there yet:
> 
> ruby-1.9.2-p0 \> BCrypt::Engine.hash\_secret(“test”,  
> “Hki1ozSQrkmvGzddNJq”)  
> BCrypt::Errors::InvalidSalt: invalid salt

I wonder if Authlogic overrode any of the default settings for BCrypt?

What do you get using irb for @version, @cost, @salt, @hash after:

@version, @cost, @salt, @hash = BCrypt::Password.new(u.crypted\_password)

on your test user? Source docs indicate Password.new returns a  
quadruple:

```
 # File lib/bcrypt.rb, line 161

```

161: def initialize(raw\_hash)  
162: if valid\_hash?(raw\_hash)  
163: self.replace(raw\_hash)  
164: @version, @cost, @salt, @hash = split\_hash(self)  
165: else  
166: raise Errors::InvalidHash.new(“invalid hash”)  
167: end  
168: end