Bcrypt Hash & Verify — Ruby source

# bcrypt — Blowfish-based password hashing, from scratch.
#
# Language: Ruby (3.x, standard library only — securerandom for the salt;
#           the algorithm itself is plain Ruby, no gems, no OpenSSL)
# Source:   CosmoDev polyglot showcase port of the bcrypt tool, ported from
#           src/lib/bcrypt.ts (the canonical TypeScript implementation).
# License:  display source — part of CosmoDev's polyglot tool pages.
#
# Implements the full algorithm from the Provos-Mazieres paper (USENIX '99):
# EksBlowfish key setup, the 64-fold encryption of "OrpheanBeholderScryDoubt",
# and OpenBSD's $2b$ hash format. Produces hashes that interoperate with bcrypt
# implementations everywhere (the same OpenBSD/Go reference vectors the TS
# suite pins).
#
# The Blowfish P-array (18 words) and S-boxes (4 x 256 words) are the first
# 8336 hex digits of the fractional part of pi, stored below as hex strings and
# parsed once into integer arrays at load time.
#
# Ruby integers are arbitrary-precision, so every 32-bit operation is masked
# with MASK explicitly — the counterpart to TypeScript's `>>> 0`.

require 'securerandom'

module Bcrypt
  # bcrypt's non-standard Base64 alphabet ('.' + '/' first, then alphanumeric).
  B64_CHARS = './ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'.freeze

  B64_INDEX = begin
    table = Array.new(128, -1)
    B64_CHARS.each_char.with_index { |ch, i| table[ch.ord] = i }
    table.freeze
  end

  # 32-bit wrap-around mask (TypeScript gets this from `>>> 0`).
  MASK = 0xFFFF_FFFF

  # The Blowfish P-array: first 18 words of pi's hex expansion.
  P_HEX = '243f6a8885a308d313198a2e03707344a4093822299f31d0082efa98ec4e6c89452821e6' \
          '38d01377be5466cf34e90c6cc0ac29b7c97c50dd3f84d5b5b54709179216d5d98979fb1b'

  # The four Blowfish S-boxes: the following 1024 words of pi's hex expansion.
  S_HEX = 'd1310ba698dfb5ac2ffd72dbd01adfb7b8e1afed6a267e96ba7c9045f12c7f9924a19947' \
          'b3916cf70801f2e2858efc16636920d871574e69a458fea3f4933d7e0d95748f728eb658' \
          '718bcd5882154aee7b54a41dc25a59b59c30d5392af26013c5d1b023286085f0ca417918' \
          'b8db38ef8e79dcb0603a180e6c9e0e8bb01e8a3ed71577c1bd314b2778af2fda55605c60' \
          'e65525f3aa55ab945748986263e8144055ca396a2aab10b6b4cc5c341141e8cea15486af' \
          '7c72e993b3ee1411636fbc2a2ba9c55d741831f6ce5c3e169b87931eafd6ba336c24cf5c' \
          '7a325381289586773b8f48986b4bb9afc4bfe81b6628219361d809ccfb21a991487cac60' \
          '5dec8032ef845d5de98575b1dc262302eb651b8823893e81d396acc50f6d6ff383f44239' \
          '2e0b4482a484200469c8f04a9e1f9b5e21c66842f6e96c9a670c9c61abd388f06a51a0d2' \
          'd8542f68960fa728ab5133a36eef0b6c137a3be4ba3bf0507efb2a98a1f1651d39af0176' \
          '66ca593e82430e888cee8619456f9fb47d84a5c33b8b5ebee06f75d885c12073401a449f' \
          '56c16aa64ed3aa62363f77061bfedf72429b023d37d0d724d00a1248db0fead349f1c09b' \
          '075372c980991b7b25d479d8f6e8def7e3fe501ab6794c3b976ce0bd04c006bac1a94fb6' \
          '409f60c45e5c9ec2196a246368fb6faf3e6c53b51339b2eb3b52ec6f6dfc511f9b30952c' \
          'cc814544af5ebd09bee3d004de334afd660f2807192e4bb3c0cba85745c8740fd20b5f39' \
          'b9d3fbdb5579c0bd1a60320ad6a100c6402c7279679f25fefb1fa3cc8ea5e9f8db3222f8' \
          '3c7516dffd616b152f501ec8ad0552ab323db5fafd23876053317b483e00df829e5c57bb' \
          'ca6f8ca01a87562edf1769dbd542a8f6287effc3ac6732c68c4f5573695b27b0bbca58c8' \
          'e1ffa35db8f011a010fa3d98fd2183b84afcb56c2dd1d35b9a53e479b6f84565d28e49bc' \
          '4bfb9790e1ddf2daa4cb7e3362fb1341cee4c6e8ef20cada36774c01d07e9efe2bf11fb4' \
          '95dbda4dae909198eaad8e716b93d5a0d08ed1d0afc725e08e3c5b2f8e7594b78ff6e2fb' \
          'f2122b648888b812900df01c4fad5ea0688fc31cd1cff191b3a8c1ad2f2f2218be0e1777' \
          'ea752dfe8b021fa1e5a0cc0fb56f74e818acf3d6ce89e299b4a84fe0fd13e0b77cc43b81' \
          'd2ada8d9165fa2668095770593cc7314211a1477e6ad206577b5fa86c75442f5fb9d35cf' \
          'ebcdaf0c7b3e89a0d6411bd3ae1e7e4900250e2d2071b35e226800bb57b8e0af2464369b' \
          'f009b91e5563911d59dfa6aa78c14389d95a537f207d5ba202e5b9c5832603766295cfa9' \
          '11c819684e734a41b3472dca7b14a94a1b5100529a532915d60f573fbc9bc6e42b60a476' \
          '81e6740008ba6fb5571be91ff296ec6b2a0dd915b6636521e7b9f9b6ff34052ec5855664' \
          '53b02d5da99f8fa108ba47996e85076a4b7a70e9b5b32944db75092ec4192623ad6ea6b0' \
          '49a7df7d9cee60b88fedb266ecaa8c71699a17ff5664526cc2b19ee1193602a575094c29' \
          'a0591340e4183a3e3f54989a5b429d656b8fe4d699f73fd6a1d29c07efe830f54d2d38e6' \
          'f0255dc14cdd20868470eb266382e9c6021ecc5e09686b3f3ebaefc93c9718146b6a70a1' \
          '687f358452a0e286b79c5305aa5007373e07841c7fdeae5c8e7d44ec5716f2b8b03ada37' \
          'f0500c0df01c1f040200b3ffae0cf51a3cb574b225837a58dc0921bdd19113f97ca92ff6' \
          '9432477322f547013ae5e58137c2dadcc8b576349af3dda7a94461460fd0030eecc8c73e' \
          'a4751e41e238cd993bea0e2f3280bba1183eb3314e548b384f6db9086f420d03f60a04bf' \
          '2cb8129024977c795679b072bcaf89afde9a771fd9930810b38bae12dccf3f2e5512721f' \
          '2e6b7124501adde69f84cd877a5847187408da17bc9f9abce94b7d8cec7aec3adb851dfa' \
          '63094366c464c3d2ef1c18473215d908dd433b3724c2ba1612a14d432a65c45150940002' \
          '133ae4dd71dff89e10314e5581ac77d65f11199b043556f1d7a3c76b3c11183b5924a509' \
          'f28fe6ed97f1fbfa9ebabf2c1e153c6e86e34570eae96fb1860e5e0a5a3e2ab3771fe71c' \
          '4e3d06fa2965dcb999e71d0f803e89d65266c8252e4cc9789c10b36ac6150eba94e2ea78' \
          'a5fc3c531e0a2df4f2f74ea7361d2b3d1939260f19c279605223a708f71312b6ebadfe6e' \
          'eac31f66e3bc4595a67bc883b17f37d1018cff28c332ddefbe6c5aa56558218568ab9802' \
          'eecea50fdb2f953b2aef7dad5b6e2f841521b62829076170ecdd4775619f151013cca830' \
          'eb61bd960334fe1eaa0363cfb5735c904c70a239d59e9e0bcbaade14eecc86bc60622ca7' \
          '9cab5cabb2f3846e648b1eaf19bdf0caa02369b9655abb5040685a323c2ab4b3319ee9d5' \
          'c021b8f79b540b19875fa09995f7997e623d7da8f837889a97e32d7711ed935f16681281' \
          '0e358829c7e61fd696dedfa17858ba9957f584a51b2272639b83c3ff1ac24696cdb30aeb' \
          '532e30548fd948e46dbc312858ebf2ef34c6ffeafe28ed61ee7c3c735d4a14d9e864b7e3' \
          '42105d14203e13e045eee2b6a3aaabeadb6c4f15facb4fd0c742f442ef6abbb5654f3b1d' \
          '41cd2105d81e799e86854dc7e44b476a3d816250cf62a1f25b8d2646fc8883a0c1c7b6a3' \
          '7f1524c369cb749247848a0b5692b285095bbf00ad19489d1462b17423820e0058428d2a' \
          '0c55f5ea1dadf43e233f70613372f0928d937e41d65fecf16c223bdb7cde3759cbee7460' \
          '4085f2a7ce77326ea607808419f8509ee8efd85561d99735a969a7aac50c06c25a04abfc' \
          '800bcadc9e447a2ec3453484fdd567050e1e9ec9db73dbd3105588cd675fda79e3674340' \
          'c5c43465713e38d83d28f89ef16dff20153e21e78fb03d4ae6e39f2bdb83adf7e93d5a68' \
          '948140f7f64c261c94692934411520f77602d4f7bcf46b2ed4a20068d40824713320f46a' \
          '43b7d4b7500061af1e39f62e9724454614214f74bf8b88404d95fc1d96b591af70f4ddd3' \
          '66a02f45bfbc09ec03bd97857fac6dd031cb850496eb27b355fd3941da2547e6abca0a9a' \
          '28507825530429f40a2c86dae9b66dfb68dc1462d7486900680ec0a427a18dee4f3ffea2' \
          'e887ad8cb58ce0067af4d6b6aace1e7cd3375fecce78a399406b2a4220fe9e35d9f385b9' \
          'ee39d7ab3b124e8b1dc9faf74b6d185626a36631eae397b23a6efa74dd5b43326841e7f7' \
          'ca7820fbfb0af54ed8feb397454056acba48952755533a3a20838d87fe6ba9b7d096954b' \
          '55a867bca1159a58cca9296399e1db33a62a4a563f3125f95ef47e1c9029317cfdf8e802' \
          '04272f7080bb155c05282ce395c11548e4c66d2248c1133fc70f86dc07f9c9ee41041f0f' \
          '404779a45d886e17325f51ebd59bc0d1f2bcc18f41113564257b7834602a9c60dff8e8a3' \
          '1f636c1b0e12b4c202e1329eaf664fd1cad181156b2395e0333e92e13b240b62eebeb922' \
          '85b2a20ee6ba0d99de720c8c2da2f728d012784595b794fd647d0862e7ccf5f05449a36f' \
          '877d48fac39dfd27f33e8d1e0a476341992eff743a6f6eabf4f8fd37a812dc60a1ebddf8' \
          '991be14cdb6e6b0dc67b55106d672c372765d43bdcd0e804f1290dc7cc00ffa3b5390f92' \
          '690fed0b667b9ffbcedb7d9ca091cf0bd9155ea3bb132f88515bad247b9479bf763bd6eb' \
          '37392eb3cc1159798026e297f42e312d6842ada7c66a2b3b12754ccc782ef11c6a124237' \
          'b79251e706a1bbe64bfb63501a6b101811caedfa3d25bdd8e2e1c3c9444216590a121386' \
          'd90cec6ed5abea2a64af674eda86a85fbebfe98864e4c3fe9dbc8057f0f7c08660787bf8' \
          '6003604dd1fd8346f6381fb07745ae04d736fccc83426b33f01eab71b08041873c005e5f' \
          '77a057bebde8ae2455464299bf582e614e58f48ff2ddfda2f474ef388789bdc25366f9c3' \
          'c8b38e74b475f25546fcd9b97aeb26618b1ddf84846a0e79915f95e2466e598e20b45770' \
          '8cd55591c902de4cb90bace1bb8205d011a862487574a99eb77f19b6e0a9dc09662d09a1' \
          'c4324633e85a1f0209f0be8c4a99a0251d6efe101ab93d1d0ba5a4dfa186f20f2868f169' \
          'dcb7da83573906fea1e2ce9b4fcd7f5250115e01a70683faa002b5c40de6d0279af88c27' \
          '773f8641c3604c0661a806b5f0177a28c0f586e0006058aa30dc7d6211e69ed72338ea63' \
          '53c2dd94c2c21634bbcbee5690bcb6deebfc7da1ce591d766f05e4094b7c018839720a3d' \
          '7c927c2486e3725f724d9db91ac15bb4d39eb8fced54557808fca5b5d83d7cd34dad0fc4' \
          '1e50ef5eb161e6f8a28514d96c51133c6fd5c7e756e14ec4362abfceddc6c837d79a3234' \
          '92638212670efa8e406000e03a39ce37d3faf5cfabc277375ac52d1b5cb0679e4fa33742' \
          'd382274099bc9bbed5118e9dbf0f7315d62d1c7ec700c47bb78c1b6b21a19045b26eb1be' \
          '6a366eb45748ab2fbc946e79c6a376d26549c2c8530ff8ee468dde7dd5730a1d4cd04dc6' \
          '2939bbdba9ba4650ac9526e8be5ee304a1fad5f06a2d519a63ef8ce29a86ee22c089c2b8' \
          '43242ef6a51e03aa9cf2d0a483c061ba9be96a4d8fe51550ba645bd62826a2f9a73a3ae1' \
          '4ba99586ef5562e9c72fefd3f752f7da3f046f6977fa0a5980e4a91587b086019b09e6ad' \
          '3b3ee593e990fd5a9e34d7972cf0b7d9022b8b5196d5ac3a017da67dd1cf3ed67c7d2d28' \
          '1f9f25cfadf2b89b5ad6b4725a88f54ce029ac71e019a5e647b0acfded93fa9be8d3c48d' \
          '283b57ccf8d5662979132e28785f0191ed756055f7960e44e3d35e8c15056dd488f46dba' \
          '03a161250564f0bdc3eb9e153c9057a297271aeca93a072a1b3f6d9b1e6321f5f59c66fb' \
          '26dcf3197533d928b155fdf5035634828aba3cbb28517711c20ad9f8abcc5167ccad925f' \
          '4de817513830dc8e379d58629320f991ea7a90c2fb3e7bce5121ce64774fbe32a8b6e37e' \
          'c3293d4648de53696413e680a2ae0810dd6db22469852dfd09072166b39a460a6445c0dd' \
          '586cdecf1c20c8ae5bbef7dd1b588d40ccd2017f6bb4e3bbdda26a7e3a59ff453e350a44' \
          'bcb4cdd572eacea8fa6484bb8d6612aebf3c6f47d29be463542f5d9eaec2771bf64e6370' \
          '740e0d8de75b1357f8721671af537d5d4040cb084eb4e2cc34d2466a0115af84e1b00428' \
          '95983a1d06b89fb4ce6ea0486f3f3b823520ab82011a1d4b277227f8611560b1e7933fdc' \
          'bb3a792b344525bda08839e151ce794b2f32c9b7a01fbac9e01cc87ebcc7d1f6cf0111c3' \
          'a1e8aac71a908749d44fbd9ad0dadecbd50ada380339c32ac69136678df9317ce0b12b4f' \
          'f79e59b743f5bb3af2d519ff27d9459cbf97222c15e6fc2a0f91fc719b941525fae59361' \
          'ceb69cebc2a8645912baa8d1b6c1075ee3056a0c10d25065cb03a442e0ec6e0e1698db3b' \
          '4c98a0be3278e9649f1f9532e0d392dfd3a0342b8971f21e1b0a74414ba3348cc5be7120' \
          'c37632d8df359f8d9b992f2ee60b6f470fe3f11de54cda541edad891ce6279cfcd3e7e6f' \
          '1618b166fd2c1d05848fd2c5f6fb2299f523f357a632762393a8353156cccd02acf08162' \
          '5a75ebb56e16369788d273ccde96629281b949d04c50901b71c65614e6c6c7bd327a140a' \
          '45e1d006c3f27b9ac9aa53fd62a80f00bb25bfe235bdd2f671126905b2040222b6cbcf7c' \
          'cd769c2b53113ec01640e3d338abbd602547adf0ba38209cf746ce7677afa1c520756060' \
          '85cbfe4e8ae88dd87aaaf9b04cf9aa7e1948c25c02fb8a8c01c36ae4d6ebe1f990d4f869' \
          'a65cdea03f09252dc208e69fb74e6132ce77e25b578fdfe33ac372e6'

  # Minimum and maximum bcrypt cost factor (log2 rounds).
  MIN_COST = 4
  MAX_COST = 31
  # Cost used when bcrypt_hash gets no explicit cost argument.
  DEFAULT_COST = 12
  # bcrypt only uses the first 72 bytes of the password.
  MAX_PASSWORD_BYTES = 72

  # The magic string bcrypt encrypts 64 times to produce the digest.
  MAGIC = 'OrpheanBeholderScryDoubt'.freeze

  HASH_RE = %r{\A\$2[aby]\$(\d{2})\$([./A-Za-z0-9]{22})([./A-Za-z0-9]{31})\z}

  # Parsed bcrypt hash parts, mirroring BcryptInfo in the TS reference.
  # `version` is the full prefix (e.g. '$2b$'), `salt` the 22-char Base64 chunk.
  Info = Struct.new(:version, :cost, :salt, keyword_init: true)

  module_function

  # Split a hex string into 32-bit words. Runs twice at load time.
  def parse_hex_words(hex)
    Array.new(hex.length / 8) { |i| hex[i * 8, 8].to_i(16) }
  end

  P_INIT = parse_hex_words(P_HEX).freeze
  S_INIT = parse_hex_words(S_HEX).freeze

  # Derive the bcrypt key data from a password: UTF-8 bytes, truncated to 72.
  # A single NUL terminator is appended unless truncation already reached 72
  # bytes — the exact keying OpenBSD's bcrypt uses.
  def key_data(password)
    bytes = password.to_s.dup.force_encoding(Encoding::BINARY).bytes
    truncated = bytes.length > MAX_PASSWORD_BYTES ? bytes[0, MAX_PASSWORD_BYTES] : bytes
    return truncated if truncated.length >= MAX_PASSWORD_BYTES

    truncated + [0]
  end

  # Blowfish round function F(x) = ((S0[a] + S1[b]) ^ S2[c]) + S3[d].
  def f(sbox, x)
    a = sbox[(x >> 24) & 0xff]
    b = sbox[256 + ((x >> 16) & 0xff)]
    c = sbox[512 + ((x >> 8) & 0xff)]
    d = sbox[768 + (x & 0xff)]
    ((((a + b) & MASK) ^ c) + d) & MASK
  end

  # One Blowfish encryption of the (xl, xr) pair. Returns the new pair.
  def encipher(parray, sbox, xl, xr)
    l = xl
    r = xr
    16.times do |i|
      l = (l ^ parray[i]) & MASK
      r = (r ^ f(sbox, l)) & MASK
      l, r = r, l
    end
    l, r = r, l
    r = (r ^ parray[16]) & MASK
    l = (l ^ parray[17]) & MASK
    [l, r]
  end

  # Read 4 bytes at `offset` (wrapping around `data`) as a big-endian word.
  # Returns the word and the advanced offset — OpenBSD's stream2word.
  def stream2word(data, offset)
    word = 0
    j = offset
    4.times do
      j = 0 if j >= data.length
      word = ((word << 8) | data[j]) & MASK
      j += 1
    end
    [word, j]
  end

  # Plain Blowfish key schedule (OpenBSD's expand0state): XOR `data` into P,
  # then chain (0,0) through 521 encryptions that re-derive P and every S-box
  # entry. Unlike the salted variant, nothing is XORed into the mixing pair.
  def expand0(parray, sbox, data)
    j = 0
    18.times do |i|
      word, j = stream2word(data, j)
      parray[i] = (parray[i] ^ word) & MASK
    end
    l = 0
    r = 0
    (0...18).step(2) do |i|
      l, r = encipher(parray, sbox, l, r)
      parray[i] = l
      parray[i + 1] = r
    end
    4.times do |box|
      (0...256).step(2) do |k|
        l, r = encipher(parray, sbox, l, r)
        sbox[box * 256 + k] = l
        sbox[box * 256 + k + 1] = r
      end
    end
  end

  # Blowfish key schedule seeded with salt: P is XORed with the key while the
  # mixing pairs are salted — bcrypt's first expandstate call.
  def expand_state(parray, sbox, salt, key)
    j = 0
    18.times do |i|
      word, j = stream2word(key, j)
      parray[i] = (parray[i] ^ word) & MASK
    end
    l = 0
    r = 0
    j = 0
    (0...18).step(2) do |i|
      word, j = stream2word(salt, j)
      l = (l ^ word) & MASK
      word, j = stream2word(salt, j)
      r = (r ^ word) & MASK
      l, r = encipher(parray, sbox, l, r)
      parray[i] = l
      parray[i + 1] = r
    end
    4.times do |box|
      (0...256).step(2) do |k|
        word, j = stream2word(salt, j)
        l = (l ^ word) & MASK
        word, j = stream2word(salt, j)
        r = (r ^ word) & MASK
        l, r = encipher(parray, sbox, l, r)
        sbox[box * 256 + k] = l
        sbox[box * 256 + k + 1] = r
      end
    end
  end

  # Encode bytes with bcrypt's Base64 variant (3 bytes -> 4 chars, partial
  # groups emit 2-3 chars, no padding).
  def encode_b64(data)
    out = +''
    i = 0
    while i < data.length
      b0 = data[i]
      b1 = i + 1 < data.length ? data[i + 1] : -1
      b2 = i + 2 < data.length ? data[i + 2] : -1
      out << B64_CHARS[b0 >> 2]
      out << B64_CHARS[((b0 & 0x03) << 4) | (b1 >= 0 ? b1 >> 4 : 0)]
      break if b1.negative?

      out << B64_CHARS[((b1 & 0x0f) << 2) | (b2 >= 0 ? b2 >> 6 : 0)]
      break if b2.negative?

      out << B64_CHARS[b2 & 0x3f]
      i += 3
    end
    out
  end

  # Decode bcrypt Base64 into exactly `count` bytes. Raises on bad characters
  # or when the input carries fewer than `count` bytes worth of bits.
  def decode_b64(input, count)
    out = Array.new(count, 0)
    total_bits = count * 8
    target = 0
    input.each_char do |ch|
      break if target >= total_bits

      code = ch.ord
      value = code < 128 ? B64_INDEX[code] : -1
      raise ArgumentError, "Invalid character in bcrypt base64 data: #{ch}" if value.negative?

      5.downto(0) do |bit|
        break if target >= total_bits

        out[target >> 3] |= 1 << (7 - (target & 7)) if value.anybits?(1 << bit)
        target += 1
      end
    end
    raise ArgumentError, 'Bcrypt base64 data is too short' if target < total_bits

    out
  end

  # Validate a cost factor, raising a clear error outside 4-31.
  def assert_cost(cost)
    return if cost.is_a?(Integer) && cost >= MIN_COST && cost <= MAX_COST

    raise ArgumentError,
          "Cost factor must be an integer between #{MIN_COST} and #{MAX_COST}"
  end

  def assert_password(password)
    raise ArgumentError, 'Password must be a string' unless password.is_a?(String)
    raise ArgumentError, 'Password must not be empty' if password.empty?
  end

  # Compute the bcrypt digest of a password with an explicit salt and cost.
  # Shared by hash (fresh random salt) and verify (salt parsed from the hash) —
  # also the deterministic entry point the test vectors drive.
  #
  # `salt` is 16 raw bytes, as a binary String or an Array of Integer. The TS
  # reference awaits a tick every 64 rounds to keep the browser responsive;
  # Ruby has no UI thread to yield to, so the loop simply runs.
  def bcrypt_hash_with_salt(password, cost, salt)
    assert_cost(cost)
    salt_bytes = salt.is_a?(String) ? salt.dup.force_encoding(Encoding::BINARY).bytes : Array(salt)
    raise ArgumentError, 'Salt must be exactly 16 bytes' unless salt_bytes.length == 16

    key = key_data(password)
    parray = P_INIT.dup
    sbox = S_INIT.dup

    expand_state(parray, sbox, salt_bytes, key)
    (2**cost).times do
      expand0(parray, sbox, key)
      expand0(parray, sbox, salt_bytes)
    end

    cdata = Array.new(6) do |i|
      (MAGIC[i * 4].ord << 24) | (MAGIC[i * 4 + 1].ord << 16) |
        (MAGIC[i * 4 + 2].ord << 8) | MAGIC[i * 4 + 3].ord
    end
    64.times do
      (0...6).step(2) do |j|
        cdata[j], cdata[j + 1] = encipher(parray, sbox, cdata[j], cdata[j + 1])
      end
    end

    # 23 bytes, not 24: OpenBSD drops the final byte of the 192-bit block.
    digest_bytes = Array.new(23) { |i| (cdata[i >> 2] >> (24 - 8 * (i & 3))) & 0xff }
    encode_b64(digest_bytes)
  end

  # Hash a password with bcrypt. Generates a fresh 16-byte crypto-random salt,
  # runs 2^cost EksBlowfish rounds (default cost 12), and returns a `$2b$` hash
  # string.
  def bcrypt_hash(password, cost = DEFAULT_COST)
    assert_password(password)
    salt = SecureRandom.random_bytes(16).bytes
    digest = bcrypt_hash_with_salt(password, cost, salt)
    format('$2b$%02d$%s%s', cost, encode_b64(salt), digest)
  end

  # Verify a password against a `$2a$` / `$2b$` / `$2y$` bcrypt hash.
  # Recomputes the digest with the hash's own salt and cost, then compares in
  # constant time. An empty password is allowed here — reference bcrypt
  # implementations can hash the empty string, so their hashes must verify.
  def bcrypt_verify(password, hash)
    info = bcrypt_decode(hash)
    salt = decode_b64(info.salt, 16)
    digest = bcrypt_hash_with_salt(password, info.cost, salt)
    expected = hash.to_s.strip[-31, 31].to_s

    # Length-independent XOR accumulation: no early return leaks the position
    # of the first differing character.
    return false unless digest.bytesize == expected.bytesize

    diff = 0
    digest.each_byte.zip(expected.each_byte) { |a, b| diff |= a ^ b }
    diff.zero?
  end

  # Parse a bcrypt hash string into its parts: version prefix, cost factor and
  # 22-character Base64 salt. Raises on malformed input.
  def bcrypt_decode(hash)
    raise ArgumentError, 'Hash must be a string' unless hash.is_a?(String)

    match = HASH_RE.match(hash.strip)
    unless match
      raise ArgumentError,
            'Not a valid bcrypt hash (expected $2a$/$2b$/$2y$CC$ + 53 base64 chars)'
    end

    cost = match[1].to_i
    if cost < MIN_COST || cost > MAX_COST
      raise ArgumentError, "Cost factor out of range (#{MIN_COST}-#{MAX_COST})"
    end

    Info.new(version: match[0][0, 4], cost: cost, salt: match[2])
  end
end