# SHA2 Issues **URL:** \ **Category:** Rails\ **Created:** [April 14, 2006, 6:47pm UTC](https://www.ruby-forum.com/t/sha2-issues/93931 "2006-04-14T18:47:58Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![flatekmonkey](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/e8c25b/32.png) [@flatekmonkey](https://www.ruby-forum.com/u/flatekmonkey)\ **Post date:** [April 14, 2006, 6:47pm UTC](https://www.ruby-forum.com/t/sha2-issues/93931/1 "2006-04-14T18:47:58Z")
Hello all, Thank you in advance for your help with this. I am trying to implement the user authentication method from Ruby Recipes which calls for the use of SHA 2. Here is the code for the password: def password=(pass) salt = [Array.new(6){rand(256).chr}.join].pack(“m”).chomp self.password\_salt, self.password\_hash = salt, Digest::SHA256.hexdigest(pass + salt) end I open a console and can create a user but when I try to add a password it says that the constant 256 is not initialized. I have changed the Digest::SHA256 to Digest::SHA2 to no avail. I am using (on Windows - development only trust me) Ruby 1.8.4 and Rails 1.1.2 with all the latest updates. Does anyone know what the correct code might be? Thanks again. Sincerely, Robert D. ---
**Author:** ![flatekmonkey](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/e8c25b/32.png) [@flatekmonkey](https://www.ruby-forum.com/u/flatekmonkey)\ **Post date:** [April 14, 2006, 10:18pm UTC](https://www.ruby-forum.com/t/sha2-issues/93931/2 "2006-04-14T22:18:54Z")
On 4/14/06, Robert D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > end > Robert D. > > – > Posted via [http://www.ruby-forum.com/](http://www.ruby-forum.com/). > > * * * > > Rails mailing list > removed\_email\_address@domain.invalid > [http://lists.rubyonrails.org/mailman/listinfo/rails](http://lists.rubyonrails.org/mailman/listinfo/rails) Did you: require ‘digest/sha2’ in either your environment.rb or the model where you are using this? pth ---
**Author:** ![flatekmonkey](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/e8c25b/32.png) [@flatekmonkey](https://www.ruby-forum.com/u/flatekmonkey)\ **Post date:** [April 14, 2006, 10:23pm UTC](https://www.ruby-forum.com/t/sha2-issues/93931/3 "2006-04-14T22:23:24Z")
> Did you: > > require ‘digest/sha2’ > > in either your environment.rb or the model where you are using this? > > pth No I didn’t. I will insert that and try again. Thank you. - Robert D. ---
**Author:** ![flatekmonkey](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/e8c25b/32.png) [@flatekmonkey](https://www.ruby-forum.com/u/flatekmonkey)\ **Post date:** [April 28, 2006, 4:00am UTC](https://www.ruby-forum.com/t/sha2-issues/93931/4 "2006-04-28T04:00:13Z")
I don’t see how adding some random salt makes the website any more secure. I enter my username and password into a signin\_form, and click signin. The server calls User.password\_is?(password+salt). If my password is n characters long, it should take on the average n/2 guesses to get it right by typing into the signin\_form, no matter what salt is. If I had the password\_hash(how would I get that?) and was trying to reverse engineer the password, yes–some unknown salt would make that harder. If I did have the password\_hash, why wouldn’t I have the salt, and anything else I wanted too? ---
**Author:** ![flatekmonkey](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/e8c25b/32.png) [@flatekmonkey](https://www.ruby-forum.com/u/flatekmonkey)\ **Post date:** [April 20, 2006, 5:08am UTC](https://www.ruby-forum.com/t/sha2-issues/93931/5 "2006-04-20T05:08:31Z")
On 4/14/06, Robert D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > Did you: > > > > require ‘digest/sha2’ > > > > in either your environment.rb or the model where you are using this? > > > > pth > > No I didn’t. I will insert that and try again. Thank you. Looks like this is indeed required on -some- Ruby installations. It seems to be hit or miss. The book has been updated to reflect it. Thanks, – Chad F. [http://chadfowler.com](http://chadfowler.com) [http://pragmaticprogrammer.com/titles/fr\_rr/](http://pragmaticprogrammer.com/titles/fr_rr/) (Rails Recipes - In Beta!) [http://pragmaticprogrammer.com/titles/mjwti/](http://pragmaticprogrammer.com/titles/mjwti/) (My Job Went to India, and All I Got Was This Lousy Book) [http://rubycentral.org](http://rubycentral.org) [http://rubygarden.org](http://rubygarden.org) [http://rubygems.rubyforge.org](http://rubygems.rubyforge.org) (over three million gems served!) ---
**Author:** ![flatekmonkey](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/e8c25b/32.png) [@flatekmonkey](https://www.ruby-forum.com/u/flatekmonkey)\ **Post date:** [April 28, 2006, 2:18pm UTC](https://www.ruby-forum.com/t/sha2-issues/93931/6 "2006-04-28T14:18:16Z")
Anonymous wrote: > I don’t see how adding some random salt makes the website any more > secure. I enter my username and password into a signin\_form, and click > signin. The server calls User.password\_is?(password+salt). If my > password is n characters long, it should take on the average n/2 guesses > to get it right by typing into the signin\_form, no matter what salt is. > If I had the password\_hash(how would I get that?) and was trying to > reverse engineer the password, yes–some unknown salt would make that > harder. If I did have the password\_hash, why wouldn’t I have the salt, > and anything else I wanted too? The salt is intended to add protection against dictonary attacks. With the salt added an attacker is forced to do the hash operation during an attack, as opposed to pre-constructing a dictionary of common password hashes.