即使密码不同，JBCrypt Checkpw即使返回True

Question

我非常确定我必须做些完全错误的事情，但是为什么这次测试失败了最后两个断言？

两个相对较相似，但尽管如此，不同的字符串（基本上是JWT）与另一个的哈希测试？

@Test
public void testMoreHashing() {
    String longToken =  "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJhdWQiOiJCTFVCQl9BVURJRU5DRSIsInN1YiI6IkNZOXJ6VVloMDNQSzNrNkRKaWUwOWc9PSIsIm5iZiI6MTUxMzI4NzAzNCwiaXNzIjoiSVNTVUVSIiwiZXhwIjoxNTE4NDcxMDM0LCJpYXQiOjE1MTMyODcwMzQsImVtYWlsIjoiYUBiLmNvbSJ9.IYMKztYEIJxzYgHpUDhCHcG22h28OQAsMg7TEMBVYELSczeniwv8IKxgrSBub9Q0X14UT6LnQUu4yeeTofRYH2jRSwW42gfaW5uK8NJQVdluNdZwUsWHVG05gbaSM7ZeS4tH3-SVbUOO3uJ-N2sVcBF5AFLaIAu0GD9CzPU1CjYYc9JiAArztAS5j7pK-xGNTRCKvcoGLa9iG9nhvssTZkPH6kPOJj9RHFo30mgSnPIGSc6040h7n8X7LCUC4qfUe1sOknHomN_RKTQk4Q5FBL1snTyCTxcaErVwvjv__YK9FQ40pDfOboEsSk81CYW6SbqDIdVlyr09VrDzIwJpPA";
    String shortToken = "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJhdWQiOiJCTFVCQl9BVURJRU5DRSIsInN1YiI6IlU3bFFoV09TUDBmMDdOZ1BWTkd3d0E9PSIsIm5iZiI6MTUxMzI4NzAzNSwiaXNzIjoiSVNTVUVSIiwiZXhwIjoxNTE4NDcxMDM1LCJpYXQiOjE1MTMyODcwMzUsImVtYWlsIjoiYUBiLmNvbSJ9.";
    String longTokenHash = BCrypt.hashpw(longToken, BCrypt.gensalt(13));
    assertTrue(BCrypt.checkpw(longToken, longTokenHash));
    String shortTokenHash = BCrypt.hashpw(shortToken, BCrypt.gensalt(13));
    assertTrue(BCrypt.checkpw(shortToken, shortTokenHash));
    assertFalse(longToken.equalsIgnoreCase(shortToken));
    assertFalse(longTokenHash.equalsIgnoreCase(shortTokenHash));
    assertFalse(longToken.contains(shortToken));
    assertFalse(BCrypt.checkpw(longToken, shortTokenHash));
    assertFalse(BCrypt.checkpw(shortToken, longTokenHash));
}

从我的pom.xml复制的JBCrypt的使用版本是

<dependency>
    <groupId>de.svenkubiak</groupId>
    <artifactId>jBCrypt</artifactId>
    <version>0.4</version>
</dependency>

Junit是版本4.12

感谢您的帮助：）

Answer 1

正如@tadman指出的那样，用过的Blowfish算法将密码截断为72个字符，而使用的密码的差异仅在79开始。另请参见https://security.stackexchange.com/questions/39849/does-bcrypt-have-a-maximum-password-password-length