Skip to content

Cost limiting not enforced in C extensions. #27

Description

@postmodern

I noticed that using a very large cost with BCrypt::Password.create would not increase the runtime on MRI. When I tested this under JRuby, the Java Extensions would raise a "bad number of rounds" ArgumentError if the cost was over 31. The C extensions should have the same behavior as the Java Extensions.

Steps to Reproduce

require 'bcrypt'
require 'benchmark'

# base
puts Benchmark.measure { BCrypt::Password.create("hello", :cost => 10) }

# midpoint
puts Benchmark.measure { BCrypt::Password.create("hello", :cost => 32) }

# extreme
puts Benchmark.measure { BCrypt::Password.create("hello", :cost => (2 ** 30)) }

Actual Results

MRI

Base:
0.090000 0.000000 0.090000 ( 0.094195)

Midpoint:
+5 minutes

Extreme:
0.000000 0.000000 0.000000 ( 0.001570)

JRuby

Base:
0.295000 0.000000 0.295000 ( 0.296000)

Midpoint:
NativeException: java.lang.IllegalArgumentException: Bad number of rounds

Extreme:
NativeException: java.lang.IllegalArgumentException: Missing salt rounds

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions