bcrypt missing number of passes

[kotky]

Hi, I noticed that there is no way to configure number of passes when you use bcrypt hashing, from checking the code I noticed that default is 12, but it would be good to be able to adjust this from security perspective.

[ngjaying]

Duplicate to emqx/emqx-passwd#1

[ngjaying]

Hi Josip,
The "number of passes" is contained on the salt. For example, salt "$2a$06$eHX8EKlD8G.A/4/hqnN8Du", the second $06 means the "number of passes" is 6.
Emqx does not generate the salt for you. It is created by the user so that the user can configure the preferred "number of passes". To provide the salt when using emqx-auth-redis, please set the salt for your mqtt users in Redis. Emqx will just read the salt info from redis.

HMSET mqtt_user:<username> password "hashedPassword" salt "salt"

[turtleDeng]

Thank you for your participation, we will close this issue.