enhanced hash password in bcrypt for nuGet library Why do we use EnhancedHashPassword in nuGet library and chose a SHA algorithm like this?

BCrypt.Net.BCrypt.EnhancedHashPassword(password,hashType:HashType.SHA512)

and when do we use the SHA algorithm after blowfish or before?
Why do we use EnhancedHashPassword in nuGet library and chose an SHA algorithm like this?


The Bcrypt uses a 448-bit key that makes a 56-byte password limit. Some libraries can drop parts longer than 56-byte of the passwords or don't accept it. This is not good, therefore before bcrypt a hash is applied to the password. This is the  EnhancedHashPassword method in the library and this may increase the entropy. 

The nuGet library by default uses SHA-384 which has known resistance to length extension attacks. SHA-512 doesn't have.


  when do we use the SHA algorithm after blowfish or before?


We use the hash algorithm before. The aim is using all of the password information in the blowfish. This is achieved by hashing which can hash arbitrary length input into a fixed size.



Modern password hashing algorithm Argon2 doesn't have the small password weakness. It can accept a password up to  $2^{32}\hbox{-}1$ bytes. On the other hand, PBKDF2 has no theoretical limit except the standard limits of the utilized hash functions 1,2.