spring-projects / spring-projects/spring-security
Consider using Bouncy Castle BCrypt implementation
Open
Nobody has claimed this yet.
for: team-attention
type: enhancement
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
BCryptPasswordEncoder currently uses an internal implementation of BCrypt.
We should consider removing the internal implementation and use Bouncy Castle's implementation instead.
NOTE: Argon2PasswordEncoder and SCryptPasswordEncoder already uses Bouncy Castle's implementation.
Related gh-16879
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with BCryptPasswordEncoder and compare its internal BCrypt implementation with the Bouncy Castle usage in Argon2PasswordEncoder and SCryptPasswordEncoder. Review related issue gh-16879, then determine whether the internal implementation can be removed while preserving BCrypt behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Refactor
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100