bcrypt

const bcrypt = require('bcrypt');

// Configuration recommandée 2024
const SALT_ROUNDS = 12; // Minimum sécurisé

async function hashPassword(plainPassword) {
  try {
    // Hash avec salt automatique
    const hash = await bcrypt.hash(plainPassword, SALT_ROUNDS);
    return hash;
    // Exemple sortie: $2b$12$LQv3c1yqBWVHxkd0LHAkCO...
  } catch (error) {
    throw new Error('Erreur hachage: ' + error.message);
  }
}

async function verifyPassword(plainPassword, hashedPassword) {
  try {
    // Vérification sécurisée temps constant
    const isMatch = await bcrypt.compare(plainPassword, hashedPassword);
    return isMatch;
  } catch (error) {
    throw new Error('Erreur vérification: ' + error.message);
  }
}

// Usage pratique
(async () => {
  const password = 'MonMotDePasseSecurise123!';
  
  // Hash
  const hash = await hashPassword(password);
  console.log('Hash:', hash);
  
  // Vérification
  const isValid = await verifyPassword(password, hash);
  console.log('Valide:', isValid); // true
  
  // Mauvais mot de passe
  const isInvalid = await verifyPassword('BadPassword', hash);
  console.log('Invalide:', isInvalid); // false
})();

import bcrypt
import time

# Configuration sécurisée
SALT_ROUNDS = 12

def hash_password(plain_password: str) -> str:
    """Hash sécurisé d'un mot de passe"""
    # Conversion en bytes
    password_bytes = plain_password.encode('utf-8')
    
    # Génération salt + hash
    salt = bcrypt.gensalt(rounds=SALT_ROUNDS)
    hash_bytes = bcrypt.hashpw(password_bytes, salt)
    
    # Retour en string
    return hash_bytes.decode('utf-8')

def verify_password(plain_password: str, hashed_password: str) -> bool:
    """Vérification sécurisée mot de passe"""
    password_bytes = plain_password.encode('utf-8')
    hash_bytes = hashed_password.encode('utf-8')
    
    # Vérification temps constant
    return bcrypt.checkpw(password_bytes, hash_bytes)

def benchmark_cost_factor():
    """Benchmark pour choisir le cost factor optimal"""
    password = "TestPassword123!"
    
    for rounds in range(10, 16):
        start_time = time.time()
        hash_password_with_rounds(password, rounds)
        duration = time.time() - start_time
        print(f"Rounds {rounds}: {duration:.3f}s")

def hash_password_with_rounds(password: str, rounds: int) -> str:
    password_bytes = password.encode('utf-8')
    salt = bcrypt.gensalt(rounds=rounds)
    return bcrypt.hashpw(password_bytes, salt).decode('utf-8')

# Exemple d'utilisation
if __name__ == "__main__":
    password = "MonMotDePasseSecurise123!"
    
    # Hash
    hashed = hash_password(password)
    print(f"Hash: {hashed}")
    
    # Vérification
    is_valid = verify_password(password, hashed)
    print(f"Valide: {is_valid}")
    
    # Test échec
    is_invalid = verify_password("BadPassword", hashed)
    print(f"Invalide: {is_invalid}")

// Exemple d'intégration sécurisée complète

class PasswordManager {
  constructor() {
    this.SALT_ROUNDS = 12;
    this.MAX_PASSWORD_LENGTH = 72; // Limite bcrypt
    this.MIN_PASSWORD_LENGTH = 8;
  }

  validatePassword(password) {
    if (password.length < this.MIN_PASSWORD_LENGTH) {
      throw new Error('Mot de passe trop court');
    }
    if (password.length > this.MAX_PASSWORD_LENGTH) {
      throw new Error('Mot de passe trop long (max 72 chars)');
    }
    // Autres validations...
  }

  async hashPassword(password) {
    this.validatePassword(password);
    
    // Mesure du temps (pour monitoring)
    const start = Date.now();
    const hash = await bcrypt.hash(password, this.SALT_ROUNDS);
    const duration = Date.now() - start;
    
    // Log pour monitoring performance
    console.log(`Password hashed in ${duration}ms`);
    
    return hash;
  }

  async verifyPassword(password, hash) {
    // Protection contre timing attacks
    const start = Date.now();
    
    try {
      const result = await bcrypt.compare(password, hash);
      return result;
    } finally {
      // Temps minimum pour éviter timing attacks
      const elapsed = Date.now() - start;
      if (elapsed < 100) {
        await new Promise(resolve => 
          setTimeout(resolve, 100 - elapsed)
        );
      }
    }
  }

  // Mise à jour du cost factor si nécessaire
  async upgradeHashIfNeeded(password, currentHash) {
    const rounds = this.extractRounds(currentHash);
    
    if (rounds < this.SALT_ROUNDS) {
      console.log('Upgrading hash cost factor');
      return await this.hashPassword(password);
    }
    
    return currentHash;
  }

  extractRounds(hash) {
    const parts = hash.split('$');
    return parseInt(parts[2]);
  }
}