Category: Expert Guide
What is the difference between bcrypt hashing and bcrypt checking?
# The Ultimate Authoritative Guide to bcrypt Hashing vs. Checking: A Deep Dive with bcrypt-check
As a tech journalist committed to dissecting the intricacies of modern cybersecurity, I understand the critical importance of robust password management. In this comprehensive guide, we will embark on an in-depth exploration of bcrypt, focusing specifically on the nuanced differences between its hashing and checking mechanisms. Our core tool for practical demonstration will be the powerful and versatile `bcrypt-check` library. This guide is meticulously crafted to be an authoritative resource, empowering developers, security professionals, and IT decision-makers with a profound understanding of bcrypt's inner workings and its application in safeguarding sensitive data.
## Executive Summary
In the realm of password security, the distinction between hashing and checking is fundamental. **Bcrypt hashing** is the process of transforming a plain-text password into a fixed-length, one-way string of characters, known as a hash. This process is computationally intensive and designed to be irreversible, meaning you cannot retrieve the original password from its hash. **Bcrypt checking**, on the other hand, is the process of verifying if a given plain-text password matches a previously generated bcrypt hash. It involves rehashing the provided password with the same parameters as the original hash and then comparing the resulting hash with the stored one.
The core of this distinction lies in their purpose and execution. Hashing is a **creation** process, generating a secure representation of a password. Checking is a **verification** process, ensuring the authenticity of a user's input against that representation. The `bcrypt-check` library, while not a primary hashing tool itself, plays a crucial role in the *checking* phase, simplifying the verification process for developers and enhancing security by abstracting away some of the underlying complexities. This guide will delve into the technical underpinnings of both, showcase practical applications, and discuss their place within global industry standards.
## Deep Technical Analysis: The Art and Science of Bcrypt
To truly grasp the difference between bcrypt hashing and checking, we must first understand the fundamental principles of cryptographic hashing and, more specifically, bcrypt's unique design.
### 1. Cryptographic Hashing: The Foundation of Password Security
Cryptographic hash functions are mathematical algorithms that take an input (or "message") of any size and produce a fixed-size output, known as a hash value or digest. For password security, ideal hash functions possess several key properties:
* **Deterministic:** The same input will always produce the same output.
* **Pre-image Resistance (One-way):** It is computationally infeasible to determine the original input from its hash output. This is crucial for password security; if an attacker obtains a hash, they cannot easily deduce the original password.
* **Second Pre-image Resistance:** It is computationally infeasible to find a different input that produces the same hash output as a given input. This prevents attackers from substituting a known password for another.
* **Collision Resistance:** It is computationally infeasible to find two different inputs that produce the same hash output. While theoretically possible, collisions should be exceedingly rare for a well-designed hash function.
* **Avalanche Effect:** A small change in the input should result in a significant change in the output hash. This makes it difficult to infer relationships between similar passwords.
### 2. Bcrypt: A Salted and Tunable Hash Function
Bcrypt is a password hashing function designed by Niels Provos and David M'Raihi. It's built upon the Blowfish cipher and is specifically engineered to be resistant to brute-force attacks, even when executed on specialized hardware like GPUs or ASICs. Bcrypt achieves this through several innovative features:
#### 2.1. The Blowfish Cipher Core
At its heart, bcrypt uses the Blowfish block cipher. Blowfish is a symmetric-key encryption algorithm known for its speed and efficiency. However, in bcrypt, Blowfish is not used for encryption in the traditional sense. Instead, its key-scheduling algorithm is adapted to perform a series of computationally intensive operations that effectively scramble the input data.
#### 2.2. The "Cost Factor" (Work Factor)
One of bcrypt's most significant strengths is its **tunable cost factor**, often referred to as the "work factor" or "rounds." This parameter dictates how many times the core hashing algorithm is executed. A higher cost factor means more computational effort is required to generate a hash, making it significantly harder and slower for attackers to brute-force passwords.
The cost factor is typically represented as a power of 2. For example, a cost factor of 12 means the algorithm will perform approximately $2^{12}$ (4096) iterations. This value is usually a base-2 logarithm of the number of iterations.
The bcrypt hash string itself encodes this cost factor. A typical bcrypt hash looks like this:
$2b$12$.................................................
* `$2b$`: Indicates the bcrypt algorithm version. `$2a$` and `$2y$` are older versions.
* `12`: This is the cost factor.
* `.................................................`: This is the actual hash output.
The ability to adjust the cost factor is paramount. As computing power increases, the cost factor can be raised to maintain the desired level of security. This adaptability is a key reason why bcrypt remains a preferred choice over older, fixed-computation algorithms like MD5 or SHA-1 for password storage.
#### 2.3. Salting: The Cornerstone of Bcrypt's Security
Bcrypt inherently incorporates **salting**. A salt is a unique, random string of data that is appended to the password *before* hashing. This is a critical security measure that prevents common attacks:
* **Rainbow Table Attacks:** Rainbow tables are pre-computed tables of hashes for common passwords. If the same password is used across multiple accounts, and it's hashed without a salt, an attacker could use a rainbow table to quickly find the original password for all accounts containing that password. Salting ensures that even identical passwords will produce different hashes because each will have a unique salt.
* **Dictionary Attacks (Optimized):** While dictionary attacks still involve trying common words, salting prevents attackers from pre-computing a single set of hashes for an entire dictionary. They must generate a unique hash for each password-salt combination, significantly increasing the computational burden.
Crucially, the salt is *not* kept secret. In fact, it is **stored alongside the hash**. This is because the salt is required during the checking phase to correctly re-hash the entered password. The bcrypt hash string format conveniently includes the salt as part of the output.
#### 2.4. The Bcrypt Hashing Process (Conceptual)
When you hash a password using bcrypt, the process conceptually involves:
1. **Generating a Unique Salt:** A random salt of a specific length is generated.
2. **Combining Password and Salt:** The plain-text password is concatenated with the generated salt.
3. **Key Expansion (Blowfish):** The salt and a fixed key (derived from the password) are used to perform an extensive key expansion on the Blowfish cipher. This is a computationally intensive step.
4. **Multiple Rounds of Hashing:** The expanded key and the salted password are then fed into the Blowfish cipher multiple times, dictated by the cost factor. Each round further scrambles the data.
5. **Output Generation:** The final output is a fixed-length string that includes the algorithm identifier, cost factor, salt, and the computed hash.
### 3. Bcrypt Checking: The Verification Dance
The process of checking a password against a bcrypt hash is where the `bcrypt-check` library shines. It's designed to abstract away the complexities of re-hashing and comparison, making it straightforward for developers to implement secure user authentication.
The core principle of bcrypt checking is **reproducibility**. Because bcrypt is deterministic and the salt and cost factor are stored with the hash, we can perfectly replicate the hashing process for a given password and its associated stored data.
#### 3.1. The Bcrypt Checking Process (Conceptual)
When a user attempts to log in and provides their password, the checking process unfolds as follows:
1. **Retrieve Stored Hash:** The system retrieves the previously stored bcrypt hash for the user's account.
2. **Extract Salt and Cost Factor:** The stored hash string is parsed to extract the salt and the cost factor that were used during the original hashing.
3. **Re-hash the Provided Password:** The plain-text password submitted by the user is then hashed using the *same* salt and cost factor that were extracted from the stored hash.
4. **Compare Hashes:** The newly generated hash (from the user's submitted password) is compared, character by character, with the original stored hash.
5. **Authentication Decision:**
* If the hashes match exactly, the password is correct, and the user is authenticated.
* If the hashes do not match, the password is incorrect, and authentication fails.
**Crucially, the original password is never revealed or directly compared.** The comparison happens at the hash level.
#### 3.2. The Role of `bcrypt-check`
The `bcrypt-check` library (and similar libraries in other languages) simplifies this checking process. Instead of manually parsing the hash, extracting the salt and cost factor, and then re-hashing, you typically provide the library with:
* The plain-text password the user entered.
* The stored bcrypt hash.
The library handles all the intricate steps internally: parsing the hash, extracting parameters, performing the computationally intensive rehashing with the correct cost factor and salt, and finally comparing the result to the stored hash. This abstraction offers several benefits:
* **Reduced Error Potential:** Developers are less likely to make mistakes in parsing or re-hashing, which could lead to security vulnerabilities.
* **Simplified Code:** The authentication logic becomes cleaner and easier to maintain.
* **Consistency:** Ensures that the verification process is always performed according to bcrypt's specifications.
**Example (Conceptual JavaScript with `bcrypt-check`):**
javascript
// Assuming you have the user's entered password and their stored hash
const enteredPassword = "user123password";
const storedHash = "$2b$12$abcdefghijklmnopqrstuvwxyz0123456789ab"; // Example stored hash
// Using a hypothetical bcrypt-check library
const bcryptCheck = require('bcrypt-check'); // Or similar
async function checkPassword(password, hash) {
try {
const isMatch = await bcryptCheck.compare(password, hash);
if (isMatch) {
console.log("Password is correct. Authenticated!");
// Proceed with user login
} else {
console.log("Incorrect password. Authentication failed.");
// Show error message to user
}
} catch (error) {
console.error("An error occurred during password check:", error);
// Handle potential errors (e.g., invalid hash format)
}
}
checkPassword(enteredPassword, storedHash);
In this example, `bcryptCheck.compare(password, hash)` encapsulates the entire checking logic. The developer doesn't need to worry about the low-level details of salt extraction or the specific number of rounds.
### 4. Why the Distinction Matters: Security Implications
The clear separation between hashing and checking is fundamental to secure authentication:
* **Hashing is for Storage:** You *only* hash a password once, when a user initially sets it or changes it. This hash is then stored in your database.
* **Checking is for Verification:** You perform the checking process *every time* a user attempts to log in.
**A common mistake is attempting to "reverse" a hash to get the original password.** This is fundamentally impossible with bcrypt due to its one-way nature. If you find yourself needing to retrieve a password from its hash, it means your system is incorrectly designed, or you are using the wrong cryptographic primitive.
Furthermore, the **cost factor is critical for both processes**. When hashing, you choose a cost factor that balances security with performance on your infrastructure. When checking, the cost factor is *automatically derived* from the stored hash, ensuring that the verification is performed with the same level of security as the original hashing. This allows for seamless upgrades; if you later increase the cost factor for new hashes, existing users can still log in with their old hashes, and their passwords will be re-hashed with the new cost factor upon their next successful login.
## Practical Scenarios: Where Bcrypt Hashing and Checking Intersect
Understanding the theoretical differences is one thing; seeing them in action in real-world scenarios is another. Here are over five practical applications where bcrypt hashing and checking are indispensable.
### Scenario 1: User Registration and Initial Password Storage
**Action:** A new user signs up for an application.
**Bcrypt Role:**
* **Hashing:** When the user submits their chosen password during registration, your backend system will use a bcrypt hashing function (e.g., `bcrypt.hash()` in Node.js) to generate a secure hash of that password. This hash, along with the embedded salt and cost factor, is then stored in your user database. The plain-text password is never stored.
**Example (Conceptual Backend Logic):**
javascript
// User submits username and password
const username = "alice";
const plainPassword = "SuperSecretPassword123!";
// Generate a bcrypt hash with a chosen cost factor (e.g., 12)
const saltRounds = 12;
const hashedPassword = bcrypt.hashSync(plainPassword, saltRounds); // Using sync for simplicity here
// Store in database:
// user_id: 1, username: "alice", password_hash: "$2b$12$..."
### Scenario 2: User Login Authentication
**Action:** An existing user attempts to log in to the application.
**Bcrypt Role:**
* **Checking:** The system retrieves the `password_hash` from the database for the provided username. It then uses a `bcrypt-check` function (e.g., `bcrypt.compare()` in Node.js, or `bcrypt-check.compare()` if using that specific library) to compare the `enteredPassword` with the `storedHash`. This function internally extracts the salt and cost factor from `storedHash`, re-hashes `enteredPassword` with them, and compares the result.
**Example (Conceptual Backend Logic):**
javascript
// User attempts to log in with username and password
const username = "alice";
const enteredPassword = "SuperSecretPassword123!"; // User typed this
// Retrieve stored hash from database for 'alice'
const storedHash = "$2b$12$abcdefghijklmnopqrstuvwxyz0123456789ab..."; // Example from DB
// Use bcrypt-check to verify
const isMatch = bcrypt.compareSync(enteredPassword, storedHash); // Or bcryptCheck.compare(...)
if (isMatch) {
// Password is correct, grant access
console.log("Login successful for alice");
} else {
// Password is incorrect, deny access
console.log("Invalid credentials for alice");
}
### Scenario 3: Password Reset Functionality
**Action:** A user forgets their password and initiates a password reset.
**Bcrypt Role:**
* **Hashing (for new password):** After the user verifies their identity (e.g., via email), they are prompted to set a *new* password. This new password is then subjected to the bcrypt hashing process, just like during initial registration, to generate a fresh, secure hash for storage.
* **Checking (optional, for old password if required):** In some reset flows, the system might ask the user to confirm their *old* password before allowing them to set a new one. In this case, bcrypt checking would be used to verify the entered old password against the stored hash.
### Scenario 4: "Forgot Password" Token Generation and Validation
**Action:** A user requests a "forgot password" link via email. A unique, time-limited token is generated.
**Bcrypt Role (indirect but crucial):**
* **Hashing (of token secret):** While the token itself might be a random string or a UUID, the *secret* used to sign or encrypt that token for validation purposes should be a strong, securely stored secret. If this secret were ever compromised, attackers could forge password reset tokens. Therefore, the application's secret keys and sensitive configuration values should ideally be managed and potentially hashed (though not typically for session secrets, but for integrity verification of critical configuration) or at least stored securely, with `bcrypt` being a candidate for hashing if the secret itself were to be stored in a persistent, albeit highly protected, manner. More commonly, the application logic uses a secure secret to sign JWTs or other tokens, and the integrity of that secret is paramount.
### Scenario 5: API Authentication with Password Credentials
**Action:** A client application needs to authenticate with your backend API using a username and password.
**Bcrypt Role:**
* **Hashing (on registration):** When the API client (or user account associated with the client) is initially set up, their password is hashed using bcrypt.
* **Checking (during API calls):** Each time the API client makes a request that requires authentication, it sends its credentials. The backend then retrieves the stored bcrypt hash and uses the bcrypt checking mechanism to verify the provided password.
### Scenario 6: Multi-Factor Authentication (MFA) - Password Component
**Action:** A user logs in, and after entering their password, they are prompted for an MFA code.
**Bcrypt Role:**
* **Checking:** The initial password verification step relies entirely on bcrypt checking. Only if the password check passes does the system proceed to the MFA verification stage. This ensures that even if an attacker obtains a user's password, they cannot bypass the MFA prompt without also compromising the second factor.
### Scenario 7: Secure Credential Management for Services
**Action:** A microservice or external service requires credentials to access another service.
**Bcrypt Role:**
* **Hashing (of service credentials):** When configuring these service-to-service credentials, the passwords or API keys (if they can be treated as passwords) should be hashed using bcrypt before being stored in configuration files, secrets managers, or databases.
* **Checking (during service-to-service communication):** When the service needs to authenticate, the stored hash is used for verification against the provided credentials.
## Global Industry Standards: Bcrypt's Place in the Pantheon of Security
Bcrypt is not just a popular choice; it's a recommended and widely adopted standard for password hashing in many industries. Its design principles align with best practices advocated by security organizations worldwide.
### 1. OWASP (Open Web Application Security Project) Recommendations
The Open Web Application Security Project (OWASP) is a leading authority on application security. Their guidelines consistently recommend using strong, adaptive hashing algorithms like bcrypt for password storage. OWASP emphasizes:
* **Using a slow, adaptive hashing algorithm:** Bcrypt is explicitly mentioned as a preferred algorithm due to its tunable cost factor.
* **Salting:** OWASP strongly advocates for salting all password hashes, a feature that bcrypt incorporates by design.
* **Not using outdated algorithms:** OWASP warns against the use of MD5, SHA-1, and even SHA-256 (without proper salting and iterative application) for password storage due to their susceptibility to brute-force attacks.
### 2. NIST (National Institute of Standards and Technology) Guidelines
NIST, a U.S. government agency, also provides guidance on cryptographic standards. While NIST's recommendations can evolve, the principles of using adaptive, salted hashing algorithms for password storage remain consistent. They often point towards algorithms like bcrypt, scrypt, and Argon2 as the current state-of-the-art.
### 3. Industry Best Practices Across Sectors
* **Financial Services:** Banks and fintech companies, handling highly sensitive financial data, employ bcrypt to protect customer credentials. The cost factor can be tuned to meet stringent regulatory requirements and evolving threat landscapes.
* **Healthcare:** Protecting Electronic Health Records (EHRs) is paramount. Healthcare organizations use bcrypt to secure patient login information, adhering to regulations like HIPAA.
* **E-commerce:** Online retailers store vast amounts of customer data, including payment information. Bcrypt is a standard for safeguarding user accounts.
* **SaaS Providers:** Software-as-a-Service companies, responsible for user data across numerous applications, rely on bcrypt for robust authentication.
### 4. The Evolution of Password Hashing Standards
It's important to note that the landscape of password hashing algorithms is not static. While bcrypt has been a stalwart, newer algorithms like **scrypt** and **Argon2** have emerged, designed to be even more resistant to specialized hardware attacks by increasing memory hardness (requiring significant RAM) in addition to computational cost. Argon2, in particular, won the Password Hashing Competition and is often considered the current "gold standard."
However, bcrypt remains highly relevant and a secure choice due to its:
* **Maturity and Widespread Adoption:** Extensive community support, robust libraries across all major programming languages, and a proven track record.
* **Ease of Implementation:** Compared to some newer, more complex algorithms, bcrypt is often simpler to integrate.
* **Sufficient Security:** For most applications, bcrypt's security, when configured with an appropriate cost factor, is more than adequate.
The key takeaway is that **any modern application should use a salted, adaptive hashing algorithm**. Bcrypt fits this description perfectly. The choice between bcrypt, scrypt, and Argon2 often depends on specific performance requirements, threat models, and implementation complexity tolerance.
## Multi-Language Code Vault: Implementing Bcrypt Hashing and Checking
The power of bcrypt lies in its availability and excellent library support across virtually every programming language. This section provides code snippets demonstrating both hashing and checking, with a focus on how `bcrypt-check` (or its equivalents) simplifies the checking process.
### 1. JavaScript (Node.js)
This is where `bcrypt-check` is most likely to be a direct library you might encounter, though the `bcrypt` npm package itself provides both hashing and checking functions.
**Hashing:**
javascript
// Install: npm install bcrypt
const bcrypt = require('bcrypt');
async function hashPassword(password) {
const saltRounds = 12; // Adjust as needed
try {
const hash = await bcrypt.hash(password, saltRounds);
console.log("Hashed Password:", hash);
return hash;
} catch (error) {
console.error("Error hashing password:", error);
throw error;
}
}
// Example Usage:
// hashPassword("mySecretPassword123");
**Checking (using `bcrypt` package's `compare` function):**
javascript
// Install: npm install bcrypt
const bcrypt = require('bcrypt');
async function checkPassword(plainPassword, hashedPassword) {
try {
// The bcrypt.compare function handles salt extraction and rehashing internally
const isMatch = await bcrypt.compare(plainPassword, hashedPassword);
console.log("Password matches:", isMatch);
return isMatch;
} catch (error) {
console.error("Error checking password:", error);
throw error;
}
}
// Example Usage:
// const plain = "mySecretPassword123";
// const hashed = "$2b$12$.................................................."; // Your stored hash
// checkPassword(plain, hashed);
**Note on `bcrypt-check`:** If you were to use a specific `bcrypt-check` library, the syntax for checking might look like:
javascript
// Hypothetical: npm install bcrypt-check
// const bcryptCheck = require('bcrypt-check');
// const isMatch = await bcryptCheck.compare(plainPassword, hashedPassword);
The core principle remains the same: abstraction of the checking logic.
### 2. Python
**Hashing:**
python
# Install: pip install bcrypt
import bcrypt
def hash_password(password):
password_bytes = password.encode('utf-8')
salt = bcrypt.gensalt(rounds=12) # Adjust rounds as needed
hashed_password = bcrypt.hashpw(password_bytes, salt)
print("Hashed Password:", hashed_password.decode('utf-8'))
return hashed_password.decode('utf-8')
# Example Usage:
# hashed = hash_password("mySecretPassword123")
**Checking (using `bcrypt` package's `checkpw` function):**
python
# Install: pip install bcrypt
import bcrypt
def check_password(plain_password, hashed_password):
plain_password_bytes = plain_password.encode('utf-8')
hashed_password_bytes = hashed_password.encode('utf-8')
# bcrypt.checkpw extracts salt and rounds from hashed_password_bytes internally
is_match = bcrypt.checkpw(plain_password_bytes, hashed_password_bytes)
print("Password matches:", is_match)
return is_match
# Example Usage:
# plain = "mySecretPassword123"
# hashed = "$2b$12$.................................................." # Your stored hash
# check_password(plain, hashed)
### 3. PHP
**Hashing:**
php
**Checking (using `password_verify`):**
php
### 4. Java
**Hashing:**
java
// Install: e.g., by adding to your pom.xml (Maven)
//
// org.mindrot
// jbcrypt
// 0.2
//
import org.mindrot.jbcrypt.BCrypt;
public class BcryptExample {
public static String hashPassword(String password) {
int cost = 12; // Adjust as needed
String hashedPassword = BCrypt.hashpw(password, BCrypt.gensalt(cost));
System.out.println("Hashed Password: " + hashedPassword);
return hashedPassword;
}
// Example Usage:
// public static void main(String[] args) {
// hashPassword("mySecretPassword123");
// }
}
**Checking (using `jBCrypt` package's `checkpw` function):**
java
// Install: e.g., by adding to your pom.xml (Maven)
//
// org.mindrot
// jbcrypt
// 0.2
//
import org.mindrot.jbcrypt.BCrypt;
public class BcryptExample {
public static boolean checkPassword(String plainPassword, String hashedPassword) {
// BCrypt.checkpw extracts salt and cost from the hashedPassword internally
boolean isMatch = BCrypt.checkpw(plainPassword, hashedPassword);
System.out.println("Password matches: " + isMatch);
return isMatch;
}
// Example Usage:
// public static void main(String[] args) {
// String plain = "mySecretPassword123";
// String hashed = "$2b$12$.................................................."; // Your stored hash
// checkPassword(plain, hashed);
// }
}
These examples illustrate how libraries abstract the complexity of the checking process, allowing developers to focus on the core logic of authentication.
## Future Outlook: Evolving Security and User Experience
The journey of password security is one of continuous adaptation. While bcrypt remains a strong contender, the future holds several interesting developments:
### 1. The Rise of Argon2 and Memory-Hard Functions
As mentioned, Argon2 is the current winner of the Password Hashing Competition and is increasingly being recommended as the successor to bcrypt and scrypt. Its design incorporates three different modes (Argon2d, Argon2i, and Argon2id) offering varying degrees of resistance to side-channel attacks and GPU acceleration. As hardware capabilities continue to advance, memory-hard functions like Argon2 are expected to become the de facto standard for new applications.
### 2. Passwordless Authentication and Biometrics
The ultimate goal for many is to move beyond passwords altogether. Technologies like WebAuthn, FIDO2, and the integration of biometrics (fingerprint, facial recognition) are paving the way for passwordless authentication. These methods offer enhanced security and a more seamless user experience. However, even in passwordless scenarios, secure credential management for the underlying authentication mechanisms remains critical.
### 3. Advanced Threat Detection and Anomaly Analysis
Future security systems will likely employ more sophisticated anomaly detection techniques. This could involve analyzing login patterns, geographic locations, device information, and typing cadence to identify potentially fraudulent login attempts, even if the correct password (or its hash) is presented.
### 4. User Education and Awareness
Despite technological advancements, human error remains a significant vulnerability. Future efforts will undoubtedly include a greater focus on educating users about strong password practices, the risks of credential stuffing, and the importance of multi-factor authentication.
### 5. Continuous Adaptation of Cost Factors
For algorithms like bcrypt that remain in use, the practice of regularly increasing the cost factor will continue. As computing power grows, what was once a secure cost factor today might be too weak tomorrow. Systems will need robust mechanisms to manage and upgrade these cost factors transparently for users.
## Conclusion
The distinction between bcrypt hashing and bcrypt checking is not merely academic; it is the bedrock of secure user authentication in modern applications. Hashing is the act of creation – transforming a sensitive password into a secure, irreversible representation. Checking is the act of verification – confirming a user's identity by comparing their entered password against its stored, hashed counterpart.
Libraries like `bcrypt-check` (and the built-in functionalities of the `bcrypt` package itself) play a vital role in simplifying the checking process, allowing developers to implement robust security with less risk of error. As the digital landscape evolves, understanding these fundamental cryptographic principles and their practical implementations remains paramount for any individual or organization committed to protecting sensitive data. Bcrypt, with its mature design and widespread adoption, continues to be a highly effective tool in this ongoing endeavor, and its principles will inform the security practices of tomorrow.